apps.itsc.cuhk.edu.hk XSS vulnerability

Open Bug Bounty ID: OBB-303429 Description| Value ---|--- Affected Website:| apps.itsc.cuhk.edu.hk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Ubiquiti Inc.: Remote Code Execution at http://tw.corp.ubnt.com

The researcher found a Command Injection in tw.corp.ubnt.com. While hunting i came across a host of Ubiquiti Networks tw.corp.ubnt.com , when i browsed to http://tw.corp.ubnt.com there was Dir listing enabled which contained various sensitive information. This was reported to Ubiquiti Team. Howev...

Ked Password Manager: Information leak

Background Helps to manage large numbers of passwords and related information and simplifies the tasks of searching and entering password data. Description A history file in /.kedpm/history is written in clear text. All of the commands performed in the password manager are written there. This can...

GLSA-201708-04 : Ked Password Manager: Information leak

The remote host is affected by the vulnerability described in GLSA-201708-04 Ked Password Manager: Information leak A history file in /.kedpm/history is written in clear text. All of the commands performed in the password manager are written there. This can lead to the disclosure of the master...

ALPINE-CVE-2017-12855

Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the...

CVE-2017-12855

Xen maintains the GTFread,writing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the...

Fortinet FortiWeb Information Disclosure Vulnerability

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...

Xiph.Org libvorbis 'orbis_block_clear' function denial of service vulnerability

Xiph.Org libvorbis is an open source audio music encoding and decoding function library . A security vulnerability exists in the 'orbisblockclear' function in the lib/block.c file in Xiph.Org libvorbis version 1.3.5. A remote attacker can exploit this vulnerability to cause a denial of service nu...

Cisco IOS Software Autonomic Control Plane Channel Information Disclosure Vulnerability (cisco-sa-20170726-aniacp)

A vulnerability in the Autonomic Networking feature of Cisco IOS Software could allow an unauthenticated, adjacent attacker to reset the Autonomic Control Plane ACP of an affected system and view ACP packets that are transferred in clear text within an affected system. SPDX-FileCopyrightText: 201...

Cisco IOS and IOS XE Software Autonomic Control Plane Channel Information Disclosure Vulnerability

A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to reset the Autonomic Control Plane ACP of an affected system and view ACP packets that are transferred in clear text within an affected system. T...

Sweden Accidentally Leaks Personal Details of Nearly All Citizens

Another day, Another data breach! This time sensitive and personal data of millions of transporters in Sweden, along with the nation's military secrets, have been exposed, putting every individual's as well as national security at risk. Who exposed the sensitive data? The Swedish government itsel...

“The 101” – Episode 1 – What is a Non-Malware Attack?

Welcome to our new video series, “The 101!” This weekly security series aims to do one thing: define endpoint security, one question at a time. Tune in each week as we tackle a new term, concept or comparison in our ongoing effort to cut through the noise and provide clear definitions. Security c...

Dr0p1t Framework 1.3 - A Framework That Creates An Advanced FUD Dropper With Some Tricks

Have you ever heard about trojan droppers ? In short dropper is type of trojans that downloads other malwares and Dr0p1t gives you the chance to create a stealthy dropper that bypass most AVs and have a lot of tricks! Features Generated executable properties: The executable size is smaller compar...

CVE-2017-6709

A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller ESC and Cisco OpenStack deployments in an affected system. The vulnerability exists because the...

Code injection

A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller ESC and Cisco OpenStack deployments in an affected system. The vulnerability exists because the...

CVE-2017-6709

A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller ESC and Cisco OpenStack deployments in an affected system. The vulnerability exists because the...

Cisco Ultra Services Framework AutoVNF Log File User Credential Information Disclosure Vulnerability

A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller ESC and Cisco OpenStack deployments in an affected system. The vulnerability exists because the...

OAuth - Critical - Access Bypass - SA-CONTRIB-2017-056

This module enables you to protect requests via the OAuth authentication protocol. The module doesn't sufficiently notify the Cache API to avoid caching responses under the scenario in which an authenticated user requests a resource such as unpublished node. This vulnerability is mitigated by the...

Authentication flaw

A vulnerability in the Extensible Messaging and Presence Protocol XMPP service of Cisco Unified Contact Center Express UCCx could allow an unauthenticated, remote attacker to masquerade as a legitimate user, aka a Clear Text Authentication Vulnerability. More Information: CSCuw86638. Known Affect...

CVE-2017-6722

A vulnerability in the Extensible Messaging and Presence Protocol XMPP service of Cisco Unified Contact Center Express UCCx could allow an unauthenticated, remote attacker to masquerade as a legitimate user, aka a Clear Text Authentication Vulnerability. More Information: CSCuw86638. Known Affect...