CVE-2018-1000669

KOHA Library System version 16.11.x up until 16.11.13 and 17.05.x up until 17.05.05 contains a Cross Site Request Forgery CSRF vulnerability in /cgi-bin/koha/members/paycollect.pl Parameters affected: borrowernumber, amount, amountoutstanding, paid that can result in Attackers can mark payments a...

CISSP Certification Course — Become An IT Security Professional

If you dream of making it big in the IT security community, the CISSP certification is a necessary milestone. Certified Information Systems Security Professional CISSP is a globally recognised certification in the field of information security, which has become a gold standard of achievement that...

File Manager < 3.0 - Authenticated Reflected Cross-Site Scripting (XSS)

Lack of sanitisation in the lang parameter in the admin dashboard could allow attacker to perform reflected XSS attacks against logged in administrators PoC https://example.com/wp-admin/admin.php?page=wpfilemanager〈=zhCNalertXSS...

Mozilla Releases Security Updates for Firefox

Mozilla has released security updates to address multiple vulnerabilities in Firefox and Firefox ESR. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC encourages users and administrators to review the Mozilla Security Advisories for Firefo...

EmpireCMS Cross-Site Request Forgery Vulnerability

EmpireCMS Empire Website Management System is a content management system CMS. A cross-site request forgery vulnerability exists in EmpireCMS version 7.0, which can be exploited by remote attackers to add administrators with the help of the upload/e/admin/user/AddUser.php?enews=AddUser interface...

CVE-2018-16339

An issue was discovered in EmpireCMS 7.0. There is a CSRF vulnerability that can add administrators via upload/e/admin/user/AddUser.php?enews=AddUser...

Script injection vulnerability in multiple Yamaha Corporation products (CNVD-2018-16849)

Yamaha Broadband VoIP Router RT57i and others are Yamaha Corporation router products. A script injection vulnerability exists in multiple Yamaha Corporation products, where an administrator with malicious intent could embed arbitrary scripts into an administrative screen in a scenario where...

CVE-2018-15901

e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators...

Cross site request forgery (csrf)

e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators...

CVE-2018-15901

e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators...

Adobe Releases Security Update for Creative Cloud

Adobe has released a security update to address a vulnerability in Adobe Creative Cloud Desktop Application. An attacker could exploit this vulnerability to obtain access to sensitive information. NCCIC encourages users and administrators to review Adobe Security Bulletin APSB18-32 and apply the...

CVE-2018-15888

An issue was discovered in ASPCMS 2.5.6. When registering ordinary users in the addUser function of the /member/reg.asp page, they can be registered with the super administrators GroupID directly...

Design/Logic Flaw

An issue was discovered in ASPCMS 2.5.6. When registering ordinary users in the addUser function of the /member/reg.asp page, they can be registered with the super administrators GroupID directly...

CVE-2018-15888

CVE-2018-15888 affects ASPCMS 2.5.6. In /member/reg.asp, the addUser function allows registering ordinary users with the super administrator GroupID, enabling privilege elevation. The available connected sources confirm the vulnerability pattern but do not provide a concrete exploit, affected ver...

CVE-2018-15888

An issue was discovered in ASPCMS 2.5.6. When registering ordinary users in the addUser function of the /member/reg.asp page, they can be registered with the super administrators GroupID directly...

Lynis 2.6.8 - Security Auditing Tool for Unix/Linux Systems

We are excited to announce this major release of auditing tool Lynis. Several big changes have been made to core functions of Lynis. These changes are the next of simplification improvements we made. There is a risk of breaking your existing configuration. Lynis is an open source security auditin...

CVE-2018-15804

An issue was discovered in the MapR File System in MapR Converged Data Platform and MapR-XD 6.x and earlier. Under certain conditions, it is possible for MapR ticket credentials to become compromised, allowing a user to escalate their privileges to act as aka impersonate any other user, including...

Tridium Niagara AX Framework and Niagara 4 Framework Path Traversal Vulnerability

Tridium Niagara AX Framework and Niagara 4 Framework are both IoT business application frameworks from Tridium USA. A path traversal vulnerability exists in Tridium Niagara AX Framework 3.8 and earlier and Niagara 4 Framework 4.4 and earlier, where the program fails to adequately filter...

Authentication Bypass Vulnerability in Sunell Cameras

Jing Yang Sunell camera is a camera produced by Shenzhen Jing Yang Technology Co. Sunell camera has an authentication bypass vulnerability that can be exploited by attackers to add administrators, modify the configuration, and gain WEB administrator privileges...

Citrix Receiver gives error "HDX Engine Stopped Working"

This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information...