CVE-2016-7628

An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "Assets" component, which allows local users to bypass intended permission restrictions and change a downloaded mobile asset via unspecified vectors...

CVE-2016-7628: Undefined Security Weakness

An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "Assets" component, which allows local users to bypass intended permission restrictions and change a downloaded mobile asset via unspecified vectors...

Legal Robot: Legal Robot AWS S3 Bucket Directory Listing

A security researcher found an AWS S3 bucket serving public resources intentionally. The files in this bucket were static assets like logos and marketing assets. We later removed this bucket altogether and therefore re-opened and marked this report as Resolved...

Mac OS X 10.x < 10.12.2 Multiple Vulnerabilities

Binary data 9840.prm...

Apple macOS Sierra Assets Component File Download Vulnerability

Apple macOS Sierra is a specialized operating system developed by Apple for Mac computers.Assets is one of the library components that supports multiple image selection. A security vulnerability exists in the Assets component of Apple macOS Sierra versions prior to 10.12.2. An attacker could...

macOS 10.12.x < 10.12.2 Multiple Vulnerabilities

The remote host is running a version of macOS that is 10.12.x prior to 10.12.2. It is, therefore, affected by multiple vulnerabilities in the following components : - apachemodphp - AppleGraphicsPowerManagement - Assets - Audio - Bluetooth - CoreCapture - CoreFoundation - CoreGraphics - CoreMedia...

CVE-2016-7884

Adobe Experience Manager versions 6.1 and earlier have an input validation issue in the DAM create assets that could be used in cross-site scripting attacks...

CVE-2016-7884

Adobe Experience Manager (AEM) versions 6.1 and earlier are affected by an input validation issue in the DAM create assets flow that could enable cross-site scripting. The problem is described in the CVE entry as an input validation flaw leading to XSS. The connected documents confirm the affecte...

About the security content of macOS Sierra 10.12.2, Security Update 2016-003 El Capitan, and Security Update 2016-007 Yosemite

About the security content of macOS Sierra 10.12.2, Security Update 2016-003 El Capitan, and Security Update 2016-007 Yosemite This document describes the security content of macOS Sierra 10.12.2, Security Update 2016-003 El Capitan, and Security Update 2016-007 Yosemite. About Apple security...

Cross-site scripting vulnerability in WordPress plugin debts-assets-networth-dan

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin debts-assets-networth-dan, which allows an attacker to construct malicious web pages and trick...

ManageEngine ServiceDesk Plus 9.2 Build 9207 Information Disclosure Vulnerability

Exploit for jsp platform in category web applications Title: ManageEngine ServiceDesk Plus Low Privileged User View All Tickets Date: 18 October 2016 Author: p0z Vendor: ManageEngine Vendor Homepage: https://www.manageengine.com/ Product: ServiceDesk Plus Version: 9.2 Build 9207 Other versions...

Design/Logic Flaw

The Assets component in Apple iOS before 10 allows man-in-the-middle attackers to block software updates via vectors related to lack of an HTTPS session for retrieving updates...

CVE-2016-4741: Undefined Security Weakness

The Assets component in Apple iOS before 10 allows man-in-the-middle attackers to block software updates via vectors related to lack of an HTTPS session for retrieving updates...

Apple iOS < 10 Multiple Vulnerabilities (BlueBorne)

Binary data appleios100check.nbin...

Locky Targets Hospitals In Massive Wave Of Ransomware Attacks

A massive Locky ransomware campaign spotted this month targets primarily the healthcare sector and is delivered in phishing campaigns. The payload, researchers at FireEye said, is dropped via .DOCM attachments, which are macro-enabled Office 2007 Word documents. Especially hard hit are hospitals ...

Unmasking xDedic's Black Market for Servers and PCs

LAS VEGAS — Black market machine trading of PC and server resources is maturing at alarming speeds. Underground networks such as xDedic have fine-tuned their compute platform to the point where they are almost indistinguishable to legitimate networks such as Amazon Web Services and Rackspace. Tho...

Apple OS X Scene Kit DAE XML Code Execution Vulnerability

SUMMARY An exploitable type confusion vulnerability exists in the handling of DAE images on OS X. A crafted DAE document can trigger a type confusion vulnerability which potentially could be exploited to achieve attacker controlled code execution. Vulnerability can be triggered via a saved DAE fi...

The vulnerability of the software system for managing enterprise assets in IBM Maximo Asset Management allows a perpetrator to circumvent existing access restrictions and gain access to protected information.

The vulnerability of the IBM Maximo Asset Management software system for managing corporate assets is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass existing access restrictions and gain access to protected information...

Nexpose Scan Engine on the AWS Marketplace

Rapid7 is excited to announce that you can now find a Nexpose Scan Engine AMI on the Amazon Web Services Marketplace making it simple to deploy a pre-authorized Nexpose Scan Engine from the AWS Marketplace to scan your AWS assets! What is an AMI ? An Amazon Machine Image AMI allows you to launch ...

AlienVault OSSIM 'assets[]' Parameter Command Execution Vulnerability

AlienVault OSSIM is a set of open source security information management system of the United States AlienVault company. The system can integrate open source products to provide a kind of basic platform that can realize the security monitoring function. A command execution vulnerability exists in...