1596 matches found
RIG Exploit Kit Delivering Monero Miner Via PROPagate Injection Technique
Introduction Through FireEye Dynamic Threat Intelligence DTI, we observed RIG Exploit Kit EK delivering a dropper that leverages the PROPagate injection technique to inject code that downloads and executes a Monero miner similar activity has been reported by Trend Micro. Apart from leveraging a...
Security Bulletin: IBM Tealeaf Customer Experience is affected by a security vulnerability (CVE-2015-4989)
Summary The IBM Tealeaf Customer Experience portal is affected by a security vulnerability that might allow unauthorized access to images of charts generated by other users. Vulnerability Details CVEID: CVE-2015-4989 DESCRIPTION: The IBM Tealeaf Customer Experience portal allows an attacker with...
2345 Viewer Handles BMP Images with Denial of Service Vulnerability
2345 Viewer is one of the fastest and most format-compatible high-definition image viewing software. A denial-of-service vulnerability exists in the handling of BMP images in 2345 Chart Viewer. An attacker who exploits this vulnerability to construct a malformed BMP image can cause the program to...
OMRON CX-Supervisor SCS Scatter Chart Object Double Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of OMRON CX-Supervisor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing ...
Stellar.org: It's possible to put SDX orderbook into invalid state and execute trades at arbitrary price
stellar-core improperly handles creation of a buy offer which crosses existing sell offers immediate execution but can only be filled partially due to a trustline limit on the source account. This makes it possible to create a valid offer to buy any custom asset at higher price than existing sell...
CVE-2018-2390
Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server IGS, 7.20, 7.20EXT, 7.45, 7.49, 7.53, via IGS Chart service...
CVE-2018-2390
Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server IGS, 7.20, 7.20EXT, 7.45, 7.49, 7.53, via IGS Chart service...
Cross site request forgery (csrf)
Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server IGS, 7.20, 7.20EXT, 7.45, 7.49, 7.53, via IGS Chart service...
CVE-2018-2390
CVE-2018-2390 affects SAP Internet Graphics Server (IGS) via the IGS Chart service, impacting IGS versions 7.20, 7.20EXT, 7.45, 7.49, and 7.53. The description indicates that under certain conditions a malicious user can prevent legitimate users from accessing IGS, implying a denial-of-service-li...
PT-2018-15522
Name of the Vulnerable Software and Affected Versions SAP Internet Graphics Server IGS versions 7.20, 7.20EXT, 7.45, 7.49, 7.53 Description The issue allows a malicious user to prevent legitimate users from accessing the SAP Internet Graphics Server IGS via the IGS Chart service under certain...
CVE-2018-2390: Undefined Security Weakness
Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server IGS, 7.20, 7.20EXT, 7.45, 7.49, 7.53, via IGS Chart service...
Cross-site Scripting (XSS)
superset is vulnerable to cross-site scripting XSS attacks. A malicious user is able to inject and execute arbitrary Javascript when generating links in markdown or in the chart description...
OpenEMR open-flash-chart.swf and _posteddata.php files cross-site scripting vulnerability
OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A cross-site scripting vulnerability exists in the open-flash-chart.swf a...
CVE-2017-18035: Improper Access Control
The /rest/review-coverage-chart/1.0/data/ /.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statisti...
Oracle PeopleSoft Products PeopleSoft Enterprise HCM Human Resources Component Security Vulnerability
Oracle PeopleSoft Products is a suite of enterprise human capital management solutions from Oracle that provides human capital management, financial management, supplier relationship management, etc. PeopleSoft Enterprise HCM Human Resources is one of the human resource management components...
CVE-2018-2654
Vulnerability in the PeopleSoft Enterprise HCM Human Resources component of Oracle PeopleSoft Products subcomponent: Company Dir / Org Chart Viewer. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...
CVE-2018-2654: Undefined Security Weakness
Vulnerability in the PeopleSoft Enterprise HCM Human Resources component of Oracle PeopleSoft Products subcomponent: Company Dir / Org Chart Viewer. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...
PT-2017-16423
Name of the Vulnerable Software and Affected Versions Cambium Networks ePMP firmware versions prior to 3.5 Description The issue is related to a lack of input sanitation for certain parameters on the web management console. This allows any authenticated user, including low-privilege readonly user...
rfes.utrgv.edu XSS vulnerability
Vulnerable URL: https://rfes.utrgv.edu/images/ofc/open-flash-chart.swf?get-data=functionalert/Openbugbounty/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 04.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...
nebraska.edu XSS vulnerability
Vulnerable URL: https://nebraska.edu/docs/budget/open-flash-chart.swf?get-data=functionalert/Openbugbounty/ Details: Description| Value ---|--- Patched:| Yes, at 04.12.2017 Latest check for patch:| 04.12.2017 16:34 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...