7685 matches found
PT-2017-16563
Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Server versions 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0 TIBCO JasperReports Server Community Edition versions 6.4.0 and below TIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.0 and below TIBCO JasperReports...
Implementing the CIS 20 Critical Security Controls: Slash Risk of Cyber Attacks by 85%
If a CISO needed to cut cyber attack risk by 85%, how would this security chief go about accomplishing that? Would the CISO even know where to begin? It’s safe to say that such a mandate would be considered daunting, and maybe even overwhelming. CISOs are scrambling to protect IT infrastructures...
WordPress plugin "TablePress" vulnerable to improper restriction of XML external entity (XXE) references
Overview The WordPress plugin "TablePress" is a plugin to create and manage tables on WordPress site. TablePress contains a vulnerability where XML external entity XXE references are not properly restricted CWE-611. Yuji Tounai of NTT Communications Corporation reported this vulnerability to IPA...
Cross site scripting
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM...
CVE-2016-8748
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM...
CVE-2016-8748
Affected software and component: Apache NiFi; vulnerable in the connection details dialog. Root cause: user-supplied text is not properly sanitized/handled before being added to the DOM, enabling cross-site scripting. Versions affected: NiFi before 1.0.1 and 1.1.x before 1.1.1. Impact (as stated)...
CVE-2016-8748: Improper Neutralization of Input During Web Page Generation
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM...
Xxe
An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...
CVE-2017-12623
An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...
CVE-2017-12623
An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...
CVE-2017-12623
An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...
PT-2017-12607
Name of the Vulnerable Software and Affected Versions Apache NiFi versions prior to 1.4.0 Description The issue allows an authorized user to upload a template containing malicious code, which can then access sensitive files via an XML External Entity XXE attack. This occurs due to improper handli...
CVE-2017-12623: Improper Restriction of XML External Entity Reference
An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity XXE attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the...
CVE-2017-12268: Undefined Security Weakness
A vulnerability in the Network Access Manager NAM of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to enable multiple network adapters, aka a Dual-Homed Interface vulnerability. The vulnerability is due to insufficient NAM policy enforcement. An attacker cou...
CVE-2017-12225
A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication session token as pa...
Facebook worries: I didn’t post that
It is my assumption that most Facebook users don’t look at their own profile often. With your own profile, I mean the timeline that shows up when you click your own name or avatar in the Facebook menu. That’s because we think we know exactly what is posted there, so why bother to look at it? Afte...
CVE-2017-10253
Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Pivot Grid. Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...
DAws - Advanced Web Shell
There's multiple things that makes DAws better than every Web Shell out there: 1. Bypasses Security SystemsIPS, WAFs,etc like Suhosinuses up to 20 php functions just to get a command executed. 2. Drops CGI Shells and communicate with them to bypass Security Systems. 3. Uses the SSH Authorized Key...
Over-authorized Access and Weak Password Vulnerabilities in the Integrated Management System for Meteorological Information in Modern Agricultural Parks of Chongqing Lanyu Tianshen Science and Technology Co.
Modern Agricultural Park Weather Information Integrated Management System is a weather system for agriculture. Over-authorized access and weak password vulnerabilities exist in the Integrated Management System for Meteorological Information in Modern Agricultural Parks of Chongqing Lanyu Tianshen...