CVE-2018-20402

CVE-2018-20402 affects Safe Software FME Server up to version 2018.1. The vulnerability enables three additional accounts (guest, user, author) in addition to the initial administrator, with passwords equal to their usernames. Logging in with these accounts grants the corresponding default privil...

The vulnerability of the account management subsystem of the Cisco Web Security Appliance allows a perpetrator to execute system commands with root privileges.

The vulnerability of the account management subsystem of Cisco Web Security Appliance WSA is related to implementation errors in access control elements. Exploiting this vulnerability could allow a malicious actor to execute system commands with root privileges remotely...

School Event Management System 1.0 Cross Site Request Forgery

Exploit Title: School Event Management System 1.0 - Cross-Site Request Forgery Update Admin Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link:...

Microsoft Windows: Audit Security Group Management

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winsecuritygroupmanagement.nasl 11068 2018-08-21 11:51:41Z emoss $ Check value for Audit Security Group Management Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This progr...

Microsoft Windows: Audit Other Account Management Events

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winotheraccountevents.nasl 11068 2018-08-21 11:51:41Z emoss $ Check value for Audit Other Account Management Events Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This...

Microsoft Windows: Audit User Account Management

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winuseraccountmanagement.nasl 11068 2018-08-21 11:51:41Z emoss $ Check value for Audit User Account Management Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program i...

Microsoft Windows: Audit Computer Account Management

This test checks the setting for policy OpenVAS Vulnerability Test $Id: wincomputeraccountmanagement.nasl 11068 2018-08-21 11:51:41Z emoss $ Check value for Audit Computer Account Management Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This...

CVE-2018-0428

CVE-2018-0428 is a Cisco Web Security Appliance (WSA) elevation-of-privilege vulnerability in the account management subsystem. An authenticated local attacker with valid admin credentials can bypass access controls to elevate to root, escape the CLI subshell, and run system-level commands. The r...

CVE-2018-0428

A vulnerability in the account management subsystem of Cisco Web Security Appliance WSA could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. The vulnerability is due to improper implementation of access...

Cisco Web Security Appliance Privilege Escalation Vulnerability

A vulnerability in the account management subsystem of Cisco Web Security Appliance WSA could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. The vulnerability is due to improper implementation of access...

Request for Marketplace add-on email notifications can be sent to inactive accounts

h4. Summary Users can navigate to the Atlassian Marketplace within Jira and request add-ons to be installed. This will send all groups defined under the Jira Administrators global permission an email notification indicating a particular user has requested a particular add-on. We have observed the...

Plant Your Flag, Mark Your Territory

Many people, particularly older folks, proudly declare they avoid using the Web to manage various accounts tied to their personal and financial data -- including everything from utilities and mobile phones to retirement benefits and online banking services. The reasoning behind this strategy is a...

SUSE-SU-2018:1760-1 Security update for pam-modules

This update for pam-modules fixes the following security issue: - CVE-2011-3172: Ensure that unix2chkpwd calls pamacctmgmt to prevent usage of locked accounts bsc707645...

CVE-2018-12582

An issue was discovered in AKCMS 6.1. CSRF can add an admin account via a /index.php?file=account&action=manageaccounts&job=newaccount URI...

The digital entropy of death: what happens to your online accounts when you die

Unless you're planning on having your mind jammed inside some sort of computer chip, eventually mortality will catch up and you're going to have to work out what you'll do with all of your online accounts. When it's time to shuffle off this mortal coil, you might, theoretically, be slightly annoy...

2018 Cyberthreat Defense Report: Where IT Security Is Going

What keeps you awake at night? We asked IT security professionals the same question and found that these issues are top of mind: malware and spear phishing, securing mobile devices, employee security awareness and new technologies that detect threats capable of bypassing traditional signature-bas...

Session Hijacking Bug Exposed GitLab Users Private Tokens

GitLab, the popular web-based Git repository manager, fixed a vulnerability recently that could have exposed its users to session hijacking attacks. Daniel Svartman, a security researcher with Imperva, discovered the issue in May but couldn’t disclose it until Wednesday, after GitLab was able to...

Verizon Patches XSS Issues in its Messaging Client

Verizon late last year patched a vulnerability in its Message+ messaging client that could have allowed an attacker to take over a session and possibly extend their reach into a user’s account management settings. Researcher Randy Westergren yesterday disclosed some details on the bug, which coul...

CVE-2016-3403

Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of administrators for requests that 1 add, 2 modify, or 3 remove accounts by leveraging failure to use of a CSRF token and...

Faraday v2.4 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday is the Integrated Multiuser Risk Environment you were looking for! It maps and leverages all the knowledge you generate in real time, letting you track and understand your audits. Our dashboard for CISOs and managers uncovers the impact and risk being assessed by the audit in real-time...