CVE-2018-1000023

Summary: Bitpay/Insight-api’s Insight-api (versions ≤ 5.0.0) contains a CWE-20 input validation vulnerability in the transaction broadcast endpoint that can disclose full filesystem paths. The issue is described as exploitable via a Web request. The affected product is Bitpay/Insight-api Insight-...

Fedora 27 : GraphicsMagick (2018-7c61d08c4f)

Latest stable release, includes many bug and security fixes. See also http://www.graphicsmagick.org/NEWS.htmljanuary-20-2017 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clea...

Fedora 27 : couchdb / erlang-jiffy (2017-a20d92573b)

CouchDB ver. 1.7.1 - Fixed CVE-2017-12635 - Fixed CVE-2017-12636 - Switched to eunit for testing - Erlang 20 compatible Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

Linux/StrongARM - setuid() Shellcode (20 bytes)

/ 20 byte StrongARM/Linux setuid shellcode funkysh / char shellcode= "\x02\x20\x42\xe0" / sub r2, r2, r2 / "\x04\x10\x8f\xe2" / add r1, pc, 4 / "\x12\x02\xa0\xe1" / mov r0, r2, lsl r2 / "\x01\x20\xc1\xe5" / strb r2, r1, 1 / "\x17\x0b\x90\xef"; / swi 0x90ff17 /...

Juniper ScreenOS 6.3 SSG-5 and SSG-20 (KRACK)

The version of Juniper ScreenOS installed on the remote host is affected by multiple vulnerabilities related to the KRACK attacks. This may allow an attacker to decrypt, replay, and forge some frames on a WPA2 encrypted network. Note that Juniper's products do not support Fast BSS Transition...

Threat Outbreak Alert RuleID31674: Email Messages Distributing Malicious Software on December 20, 2017

Medium Alert ID: 56308 First Published: 2017 December 20 21:00 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31674 may contain the following files: Name |...

Threat Outbreak Alert RuleID31605: Email Messages Distributing Malicious Software on December 20, 2017

Medium Alert ID: 56307 First Published: 2017 December 20 21:00 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31605 may contain the following files: Name |...

aulete.com.br XSS vulnerability

Open Bug Bounty ID: OBB-456228 Description| Value ---|--- Affected Website:| aulete.com.br Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat She...

Threat Outbreak Alert RuleID31584: Email Messages Distributing Malicious Software on December 20, 2017

Medium Alert ID: 56314 First Published: 2017 December 20 17:15 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31584 may contain the following files: Name |...

skedula.com XSS vulnerability

Open Bug Bounty ID: OBB-456184 Description| Value ---|--- Affected Website:| skedula.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

nametheplayers.ie XSS vulnerability

Open Bug Bounty ID: OBB-455828 Description| Value ---|--- Affected Website:| nametheplayers.ie Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

WordPress Custom Map plugin <=1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability found by Nicolas Buzy-Debat in WordPress Custom Map plugin versions =1.1. Solution Dec 20, 2017 - we were unable to find a patched version of this plugin. Uninstall or use it at your own risk...

JVN#84182676: Multiple vulnerabilities in H2O

H2O is an open source web server software. H2O contains multiple vulnerabilities listed below. A Denial-of-service DoS due to a flaw in processing HTTP/1 header CWE-20 - CVE-2017-10868 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L| Base Score: 5.3 CVSS...

Palo Alto Networks readSessionVarsFromFile() Session Corruption

This module exploits a chain of vulnerabilities in Palo Alto Networks products running PAN-OS versions prior to 6.1.19, 7.0.19, 7.1.14, and 8.0.6. This chain starts by using an authentication bypass flaw to to exploit an XML injection issue, which is then abused to create an arbitrary directory,...

needfill.co.kr XSS vulnerability

Open Bug Bounty ID: OBB-429006 Description| Value ---|--- Affected Website:| needfill.co.kr Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

emperorsacupunctureclinic.com XSS vulnerability

Open Bug Bounty ID: OBB-428625 Description| Value ---|--- Affected Website:| emperorsacupunctureclinic.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS...

simit.it XSS vulnerability

Open Bug Bounty ID: OBB-428589 Description| Value ---|--- Affected Website:| simit.it Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

theeroticreview.com XSS vulnerability

Open Bug Bounty ID: OBB-427210 Description| Value ---|--- Affected Website:| theeroticreview.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...

Threat Outbreak Alert RuleID31367: Email Messages Distributing Malicious Software on November 20, 2017

Medium Alert ID: 55987 First Published: 2017 November 20 15:02 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31367 may contain the following files: Name |...

odys.meblemirjan.pl XSS vulnerability

Open Bug Bounty ID: OBB-424559 Description| Value ---|--- Affected Website:| odys.meblemirjan.pl Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...