Description of the security update for Word Viewer: March 13, 2018

None None...

2018 年 3 月のセキュリティ更新プログラム (月例)

2018 年 3 月 14 日 日本時間、マイクロソフトは以下のソフトウェアのセキュリティ更新プログラムを公開しまし...

mailman security update

3:2.1.12-26.3 - Related: 1545967 - Add missed import 3:2.1.12-26.2 - Resolves: 1545967 - Fix XSS vulnerability in web UI. Add sanitizer 3:2.1.12-26.1 - Resolves: 1545967 - Fix XSS vulnerability in web UI...

Solaris 10 (sparc) : 142188-01

StarOffice 9 Solaris: Update 3 requires Update 2. Date this patch was last updated by Sun : Sep/11/09 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; ...

Solaris 10 (x86) : 142190-01

StarOffice 9 Solarisx86: Update 3 requires Update 2. Date this patch was last updated by Sun : Sep/11/09 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc...

Allok QuickTime to AVI MPEG DVD Converter 3.6.1217 - Buffer Overflow

Allok QuickTime to AVI MPEG DVD Converter 3.6.1217 - Buffer Overflow Exploit Title: Allok Video Converter - Buffer Overflow Vulnerability Windows XP SP3 Date: 06-03-2018 Exploit Author: Mohan Ravichandran & Velayutham Selvaraj Organization : TwinTech Solutions Vulnerable Software: Allok Video...

CTFR - Get subdomains of an HTTPS website abusing Certificate Transparency logs

Do you miss AXFR technique? This tool allows to get the subdomains from a HTTPS website in a few seconds. How it works? CTFR does not use neither dictionary attack nor brute-force, it just abuses of Certificate Transparency logs. For more information about CT logs, check...

Joomla Joomanager 2.0.0 Component - com_Joomanager Arbitrary File Download Exploit

Exploit for php platform in category web applications !/usr/bin/python2 -- coding:utf-8 -- ''' GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright C 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it ...

NetIQ Privileged Account Manager Cross-Site Scripting Vulnerability

Micro Focus NetIQ Privileged Account Manager is a privileged user management solution from Micro Focus UK. The solution protects privileged account access to databases, applications and the cloud. A cross-site scripting vulnerability exists in versions prior to Micro Focus NetIQ Privileged Accoun...

LimeSurvey 2.6.x < 2.6.7, 2.7x.x < 2.73.1, 3.x.x < 3.4.2 File Disclosure Vulnerability

LimeSurvey mishandles application/controller/InstallerController.php after installation, which allows remote attackers to access the configuration file. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

klangforum.at XSS vulnerability

Open Bug Bounty ID: OBB-572909 Description| Value ---|--- Affected Website:| klangforum.at Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

chatwelt.ch XSS vulnerability

Open Bug Bounty ID: OBB-572897 Description| Value ---|--- Affected Website:| chatwelt.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-6929

A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal...

Bug in HP Remote Management Tool Leaves Servers Open to Attack

Hewlett Packard Enterprise has patched a vulnerability in its remote management hardware called Integrated Lights-Out 3 that is used in its popular line of HP ProLiant servers. The bug allows an attacker to launch an unauthenticated remote denial of service attack that could contribute to a...

[SECURITY] Fedora 26 Update: php-phpmyadmin-sql-parser-4.2.4-3.fc26

A validating SQL lexer and parser with a focus on MySQL dialect. This library was originally developed for phpMyAdmin during the Google Summer of Code 2015. Autoloader: /usr/share/php/PhpMyAdmin/SqlParser/autoload.php...

Sonatype Nexus Repository Manager Cross-Site Scripting Vulnerability

Sonatype Nexus Repository Manager aka NXRM is a maven repository manager. A cross-site scripting vulnerability exists in Sonatype Nexus Repository Manager version 3.x prior to 3.8. The vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML in a variety of ways...

Apache JMeter uses an unsecure RMI connection in Distributed mode

Severity: Important Vendor: The Apache Software Foundation Versions Affected: JMeter 2.X, 3.X Description 0: When using Distributed Test only RMI based, jmeter uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code. This only affect...

Ubuntu: Security Advisory (USN-3581-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2018-7301

eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. This can be exploited by sending arbitrary XML-RPC requests to control the attached BidCos devices...

CVE-2018-7299

Remote Code Execution in the addon installation process in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows authenticated attackers to create or overwrite arbitrary files or install malicious software on the device...