PayPal Inc - Security Key Pin Approval & Expire Bypass

Document Title: =============== PayPal Inc - Security Key Pin Approval & Expire Bypass References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1666 Release Date: ============= 2018-06-26 Vulnerability Laboratory ID VL-ID: ==================================== 166...

Microsoft Windows: User Account Control: Run all administrators in Admin Approval Mode

This policy setting determines the behavior of all User Account Control UAC policies for the entire system. This is the setting that turns UAC on or off. C Microsoft Corporation 2017. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, an...

Microsoft Windows: User Account Control: Admin Approval Mode for the Built-in Administrator account

This policy setting determines the behavior of Admin Approval Mode for the built-in administrator account. When the Admin Approval Mode is enabled, the local administrator account functions like a standard user account, but it has the ability to elevate privileges without logging on by using a...

Microsoft Windows: User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

This policy setting determines the behavior of the elevation prompt for accounts that have administrative credentials. C Microsoft Corporation 2017. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

CVE-2018-1260

Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lea...

Remote code execution

Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lea...

Spring Security OAuth Remote Command Execution Vulnerability (CNVD-2018-09368)

Spring is a lightweight Java development framework . Security OAuth provides a Spring Security authorization filter. A remote command execution vulnerability exists in Spring Security OAuth. A malicious user or attacker can make an authorization request to an authorization endpoint that results i...

Remote Code Execution (RCE)

spring-security-oauth2 is vulnerable to remote code execution RCE attacks. The vulnerability occurs when a malicious user can insert an RCE payload into an authorization request to the authroization endpoint, and is executed when the resource owner is forwarded to the approval endpoint. This...

Remote Code Execution with spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.3 and 2.2 prior to 2.2.2 and 2.1 prior to 2.1.2 and 2.0 prior to 2.0.15 and older unsupported versions, contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint th...

CVE-2018-7901

RCS module in Huawei ALP-AL00B smart phones with software versions earlier than 8.0.0.129, BLA-AL00B smart phones with software versions earlier than 8.0.0.129 has a remote control vulnerability. An attacker can trick a user to install a malicious application. When the application connects with R...

MyBB Plugin Downloads 2.0.3 - Cross-Site Scripting

Exploit Title: MyBB Downloads Plugin v2.0.3 - Persistent XSS Date: 3/28/18 Author: 0xB9 Contact: luxorforums.com/User-0xB9 or 0xB9atprotonmail.com Software Link: https://community.mybb.com/mods.php?action=view&pid=854 Version: 2.0.3 Tested on: Ubuntu 17.10 1. Description: It is a plugin which add...

Facebook Bolsters Privacy Measures With New Data Access Restrictions

Facebook on Wednesday listed a number of new data access restrictions as the social media company looks to reassure end users that their personal information will remain private. The new measures, detailed in a post by Facebook CTO Mike Schroepfer, limit the personal data that apps can collect...

CVE-2017-1000505

In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion feature in Groovy to create new File objects from strings. This allowed reading arbitrary files on the Jenkins master file system. Such a type...

CVE-2017-1000386

Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on the 'Build With Parameters' page through the 'Active Choices Reactive Reference Parameter' type. This could include, for example, arbitrary JavaScript. Acti...

CVE-2017-1000386

Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on the 'Build With Parameters' page through the 'Active Choices Reactive Reference Parameter' type. This could include, for example, arbitrary JavaScript. Acti...

Oracle Siebel CRM Siebel Engineering - Unspecified Vulnerability in Installer and Deployment Component

Oracle Siebel CRM is a set of customer relationship management solutions from Oracle USA, which includes modules for sales management, marketing management, customer service system, call center, etc. Siebel Engineering - Installer and Deployment is one of the Siebel Engineering Installer and...

CVE-2018-2632

Vulnerability in the Siebel Engineering - Installer and Deployment component of Oracle Siebel CRM subcomponent: Siebel Approval Manager. Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi...

CVE-2017-6679

The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel SSH which auto initiated from the customer's appliance to Cisco's SSH Hubs in the Umbrella datacenters. These tunnels were primarily leveraged for remote support and allowed for...

Design/Logic Flaw

The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel SSH which auto initiated from the customer's appliance to Cisco's SSH Hubs in the Umbrella datacenters. These tunnels were primarily leveraged for remote support and allowed for...

Description of the security update for Project Server 2013: November 14, 2017

Description of the security update for Project Server 2013: November 14, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft...