PT-2018-17647

Name of the Vulnerable Software and Affected Versions Joomla! Timetable Responsive Schedule version 1.5 Description A SQL Injection issue exists in the Timetable Responsive Schedule component for Joomla!, which can be exploited via a view=event&alias= request. Recommendations For version 1.5,...

Mail.ru: [mobs.mail.ru] nginx path traversal via misconfigured alias

Domain, site, application -- mobs.mail.ru Steps to reproduce -- http://mobs.mail.ru/media../mobs/settings.py Actual results -- py ... SECRETKEY = '████████████' ... DISTIMOPRIVATEKEY = '████████████' ... PoC, exploit code, screenshots, video, references, additional resources --...

Damon database suffers from a power lifting vulnerability (CNVD-2018-03643)

DM7 is a new-generation database product designed by Damon on the basis of summarizing the R&D and application experience of DM series products, absorbing the advantages of mainstream database products, and adopting JAVA-like virtual machine technology. DM7 database has a privilege loophole, low...

CVE-2015-5284

ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable...

CVE-2015-5284

ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable...

PT-2017-6842

Name of the Vulnerable Software and Affected Versions FreeIPA versions prior to 4.2.2 Description The issue concerns the installation of ipa-kra-install in FreeIPA, where the CA agent certificate and private key are stored in a world-readable file, /etc/httpd/alias/kra-agent.pem. Recommendations...

CVE-2017-9767

Multiple cross-site scripting XSS vulnerabilities in Quali CloudShell before 8 allow remote authenticated users to inject arbitrary web script or HTML via the 1 Name or 2 Description parameter to RM/Reservation/ReserveNew; the 3 Description parameter to RM/Topology/Update; the 4 Name, 5...

Exiv2 Denial of Service Vulnerability (CNVD-2017-27706)

Exiv2 is a suite of C++ libraries and command line applications for managing image metadata by software developer Andreas Huggel, which provides fast and easy reading and writing of image metadata in a variety of EXIF, IPTC and XMP formats. A denial of service vulnerability exists in the...

Design/Logic Flaw

There is an illegal address access in the extendaliastable function in localealias.c of Exiv2 0.26. A crafted input will lead to remote denial of service...

PT-2017-12097

Name of the Vulnerable Software and Affected Versions Exiv2 version 0.26 Description The issue is related to an illegal address access in the extend alias table function in localealias.c. A crafted input can lead to a remote denial of service. Recommendations For Exiv2 version 0.26, consider...

bind: Processing a response containing CNAME or DNAME with unusual order can crash resolver

A denial of service flaw was found in the way BIND handled a query response containing CNAME or DNAME resource records in an unusual order. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to 1 add an administrator user via a crafted POST request to...

CVE-2017-6086

CVE-2017-6086 concerns ViMbAdmin 3.0.15. The connected sources describe multiple cross-site request forgery (CSRF) vulnerabilities affecting administrator actions. The root causes are CSRF flaws in the following controller endpoints: DomainController.php (add/delete administrator, change password...

CVE-2017-6086

Multiple cross-site request forgery CSRF vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to 1 add an administrator user via a crafted POST request to...

FAQ: XenMobile Derived Credentials

What are Derived Credentials? Derived credentials provide strong authentication for mobile devices. The credentials, derived from a smart card, reside in a mobile device instead of the card. The smart card is either a Personal Identity Verification PIV card or Common Access Card CAC. The derived...

openSUSE Security Update : lynis (openSUSE-2017-705)

This update for lynis fixes the following issues : Lynis 2.5.1 : - Improved detection of SSL certificate files - Minor changes to improve logging and results - Firewall tests: Determine if CSF is in testing mode The Update also includes changes from Lynis 2.5.0 : - CVE-2017-8108: symlink attack m...

CVE-2017-8441

The CVE-2017-8441 issue affects Elastic X-Pack Security: versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This could allow a user with restricted permissions to view data they should not access when performing certain operations against an...

Open Source Solutions ViMbAdmin Cross-Site Scripting Vulnerability

Open Source Solutions ViMbAdmin is an open source Web-based virtual mailbox management system from Open Source Solutions, Ireland. The system supports administrators to manage domains , mail and aliases and so on. A cross-site scripting vulnerability exists in Open Source Solutions ViMbAdmin...

PT-2017-16723

Name of the Vulnerable Software and Affected Versions ViMbAdmin version 3.0.15 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved through various parameters, including the domain or...

ViMbAdmin 3.0.15 Cross Site Scripting

CVE-2017-5870 Multiple XSS vulnerabilities in ViMbAdmin Product Description ViMbAdmin is a web-based interface used to manage a mail server with virtual domains, mailboxes and aliases. It is an open source solution developed by Opensolutions and distributed under the GNU/GPL license version 3. Th...