org.keycloak:keycloak-account-api (1.0.3.final), org.keycloak:keycloak-account-freemarker (1.0.3.final) +48 more potentially affected by CVE-2016-8629 via org.keycloak:keycloak-core (1.0.3.final)

org.keycloak:keycloak-core MAVEN version 1.0.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0.3.final - org.keycloak:keycloak-account-freemarker 1.0.3.final ...

PT-2018-11177

Name of the Vulnerable Software and Affected Versions Corsair Utility Engine affected versions not specified Description The issue is related to the CorsairService Service in Corsair Utility Engine, which has insecure default permissions. This allows unprivileged local users to execute arbitrary...

GHSA-9Q2P-FJ49-VPXJ In marshmallow library the schema "only" option treats an empty list as implying no "only" option

In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields if the schema is being filtered dynamically using the...

GHSA-QW93-45R3-P66P Prototype Pollution in merge-options

All versions of merge-options are vulnerable to Prototype Pollution Recommendation Update to version 1.0.1 or greater...

astoriaford.net XSS vulnerability

Open Bug Bounty ID: OBB-682353 Description| Value ---|--- Affected Website:| astoriaford.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

When Security Researchers Pose as Cybercrooks, Who Can Tell the Difference?

A ridiculous number of companies are exposing some or all of their proprietary and customer data by putting it in the cloud without any kind of authentication needed to read, alter or destroy it. When cybercriminals are the first to discover these missteps, usually the outcome is a demand for mon...

Siemens TD Keypad Designer DLL Hijacking Vulnerability

Siemens TD Keypad Designer is a keyboard design program from Siemens Germany for Siemens TD 100C and other products. A DLL hijacking vulnerability exists in SIEMENS TD Keypad Designer all versions. An attacker could exploit the vulnerability to execute code with the privileges of the user running...

DEBIAN-CVE-2018-17182

An issue was discovered in the Linux kernel through 4.18.8. The vmacacheflushall function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free and possibly gain privileges via certain thread creation, map, unmap, invalidation, and dereference operations...

DEBIAN-CVE-2018-17175

In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields if the schema is being filtered dynamically using the...

PYSEC-2018-67

In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields if the schema is being filtered dynamically using the...

GHSA-CVXM-F295-X957 Prototype Pollution in merge-recursive

All versions of merge-recursive are vulnerable to Prototype Pollution. When malicious user input is merged with another object it allows the attacker to modify the prototype of Object via proto causing the addition or modification of an existing property. Proof of concept: js var merge =...

Universal Password Login Vulnerability in All-Media Content Management and Business Support Platform of Beijing Jingwei Zhongtian Information Technology Co.

Beijing Jingwei Zhongtian Information Technology Co., Ltd. is a high-tech enterprise specializing in software development and services related to network audio-visual content management and applications. A universal password login vulnerability exists in the all-media content management and...

WAVM Buffer Over-Read Vulnerability

WAVM is the WebAssembly Virtual Machine. A heap buffer over-read vulnerability exists in IR::FunctionValidationContext::catchall in WAVM 2018-07-26 and earlier versions, which can be exploited by an attacker to cause a denial of service application crash by sending a specially crafted file...

auditysonscorner.com XSS vulnerability

Open Bug Bounty ID: OBB-673424 Description| Value ---|--- Affected Website:| auditysonscorner.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

phpMyAdmin 4.7.x Cross Site Request Forgery

Exploit Title: phpMyAdmin 4.7.x - Cross-Site Request Forgery Date: 2018-08-28 Exploit Author: VulnSpy Vendor Homepage: https://www.phpmyadmin.net/ Software Link: https://www.phpmyadmin.net/downloads/ Version: Versions 4.7.x prior to 4.7.7 Tested on: php7 mysql5 CVE: CVE-2017-1000499 Exploit CSRF ...

phpMyAdmin 4.7.x - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: phpMyAdmin 4.7.x - Cross-Site Request Forgery Exploit Author: VulnSpy Vendor Homepage: https://www.phpmyadmin.net/ Software Link: https://www.phpmyadmin.net/downloads/ Version: Versions 4.7.x prior to 4.7.7 Tested on: php7 mysql...

GHSA-38F5-GHC2-FCMV Code Injection in cryo

All versions of cryo are vulnerable to code injection due to an Insecure implementation of deserialization. Proof of concept js var Cryo = require'cryo'; var frozen = '"root":"CRYOREF3","references":"contents":,"value":"CRYOFUNCTIONfunction console.log\"defconrussia\"; return...

all-mods.ru XSS vulnerability

Open Bug Bounty ID: OBB-666562 Description| Value ---|--- Affected Website:| all-mods.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

GHSA-VCFP-PPQW-MF23 fis-sass-all downloads Resources over HTTP

Affected versions of fis-sass-all insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...

fis-sass-all downloads Resources over HTTP

Affected versions of fis-sass-all insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...