12177 matches found
CVE-2014-8170
CVE-2014-8170 affects ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3. The issue stems from ovirt_safe_delete_config in ovirtfunctions.py (and other locations) not properly quoting input strings, enabling arbitrary command execution when a semicolon is included in...
Trend Micro Mobile Security Arbitrary File Upload Vulnerability
Trend Micro Mobile Security Enterprise is a set of cell phone security software from Trend Micro, Inc. that integrates cell phone security scanning, real-time protection against malicious programs and monitoring of malicious behavior. An arbitrary file upload vulnerability exists in versions of...
[SECURITY] Fedora 26 Update: httpd-2.4.27-3.fc26
The Apache HTTP Server is a powerful, efficient, and extensible web server...
CVE-2017-14080
Authentication bypass vulnerability in Trend Micro Mobile Security Enterprise versions before 9.7 Patch 3 allows attackers to access a specific part of the console using a blank password...
PYSEC-2017-45
Cross-site scripting XSS vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path...
CVE-2015-4706
Cross-site scripting XSS vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path...
CVE-2015-4706
CVE-2015-4706 affects IPython 3.x before 3.2. It is a cross-site scripting (XSS) vulnerability where remote attackers can inject arbitrary web script or HTML via JSON error messages and the /api/contents path. Connected advisories (GHSA, OSV, CNVD/NVD variants) consistently describe the same issu...
Design/Logic Flaw
iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new default feature was added to iTerm2 version 3.0.0 and unreleased 2.9.x versions such as 2.9.20150717 that resulted in a potential information disclosure. In an attempt to see whether the text under...
Cross site request forgery (csrf)
Cross-site request forgery in the REST API in IPython 2 and 3...
CVE-2015-5607
IPython contains a CSRF vulnerability in its REST API for versions 2 and 3. The REST API could be abused via cross-site requests to perform unauthorized operations. Public references indicate a CSRF issue with IPython’s POST handling, and multiple advisories (including GN/Ubuntu security notices ...
Apps industrial OT over Server: Anti-Web Remote Command Execution(CVE-2017-17888)
Exploit Title: Apps industrial OT over Server: "Anti-Web 3.x.x 3.8.x" vuln: Remote Command Execution Date: 15/05/2017 Exploit Author: Fernandez Ezequiel @capitanalfa && Bertin Jose @bertinjoseb Vendor: Multiples vendors Category: Industrial OT webapps + DESCRIPTION: vulnerability: RCE REMOTE...
SMB1/2/3 connections may not require signing where they should
Description There are several code paths where the code doesn't enforce SMB signing: The fixes for CVE-2015-5296 didn't apply the implied signing protection when enforcing encryption for commands like 'smb2mount -e', 'smbcacls -e' and 'smbcquotas -e'. The python binding exported as...
Apple's FaceID
This is a good interview with Apple's SVP of Software Engineering about FaceID. Honestly, I don't know what to think. I am confident that Apple is not collecting a photo database, but not optimistic that it can't be hacked with fake faces. I dislike the fact that the police can point the phone at...
CVE-2017-12157
In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...
CVE-2017-12156
Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback...
CVE-2017-12157
In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...
CVE-2017-12156
Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback...
CVE-2017-12157
In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...