8663 matches found
CVE-2019-12746
CVE-2019-12746 affects Open Ticket Request System (OTRS) Community Edition: an agent login session ID could be disclosed by sharing a link to an embedded ticket article, enabling potential impersonation. Affected: OTRS 5.0.x up to 5.0.36 and 6.0.x up to 6.0.19. Impact: session impersonation risk ...
CVE-2019-12746
An issue was discovered in Open Ticket Request System OTRS Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be...
CVE-2019-11209
The realm configuration component of TIBCO Software Inc.'s TIBCO FTL Community Edition, TIBCO FTL Developer Edition, TIBCO FTL Enterprise Edition contains a vulnerability that theoretically fails to properly enforce access controls. This issue affects TIBCO FTL Community Edition 6.0.0; 6.0.1;...
DEF CON and Feds Partner on Anonymous Bug Submission Program
Hacking conference organizer DEF CON Communications said it plans to roll out a global anonymous bug submission platform based on the SecureDrop communications tool. During a session at DEF CON in Las Vegas last week, conference founder Jeff Moss said the goal was to launch the yet-to-be-named...
[SECURITY] Fedora 29 Update: igraph-0.7.1-12.fc29
igraph wants to be an efficient platform for 1 complex network analysis and 2 developing and implementing graph algorithms. It provides flexible and efficient data structures for graphs and related tasks. It also provides implementation to many classic and new graph algorithms like: maximum flows...
[SECURITY] Fedora 30 Update: igraph-0.7.1-12.fc30
igraph wants to be an efficient platform for 1 complex network analysis and 2 developing and implementing graph algorithms. It provides flexible and efficient data structures for graphs and related tasks. It also provides implementation to many classic and new graph algorithms like: maximum flows...
Congratulations to our Query of the Month Winner for July 2019!
Our Query of The Month competition recognizes the top community-shared query that provides value to other Osquery users. To determine the query of the month, our team selects the customer query that has the most engagement or helps solve an important problem. The winner of the contest each month...
Authorization Bypass
magento/community-edition is vulnerable to authorization bypass. The vulnerability exists as a user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially confidental information...
SQL Injection
magento/community-edition is vulnerable to SQL injection. The vulnerability exists as a user with marketing manipulation privileges can invoke methods that alter data of the underlying model followed by corresponding database modifications...
Information Disclosure
magento/community-edition is vulnerable to information disclosure. The vulnerability exists as the samples of disabled downloadable products are accessible due to the lack of user input sanitization...
Authorization Bypass
magento/community-edition is vulnerable to authorization bypass. The vulnerability exists as a low-privileged user to make unauthorized environment configuration changes...
Libgit2 -- multiple vulnerabilities
The Git community reports: A carefully constructed commit object with a very large number of parents may lead to potential out-of-bounds writes or potential denial of service. The ProgramData configuration file is always read for compatibility with Git for Windows and Portable Git installations...
4 Dating Apps Pinpoint Users' Precise Locations – and Leak the Data
Four popular dating apps that together can claim 10 million users have been found to leak precise locations of their members. “By simply knowing a person’s username we can track them from home, to work,” explained Alex Lomas, researcher at Pen Test Partners, in a blog on Sunday. “We can find out...
Evaluating the NSA's Telephony Metadata Program
Interesting analysis: "Examining the Anomalies, Explaining the Value: Should the USA FREEDOM Act's Metadata Program be Extended?" by Susan Landau and Asaf Lubin. Abstract: The telephony metadata program which was authorized under Section 215 of the PATRIOT Act, remains one of the most controversi...
Dating apps that track users from home to work and everywhere in-between
TL;DR We were able to precisely locate and track the users of four major dating apps, potentially putting at risk 10 million users This risk level is elevated for the LGBT+ community who may use these apps in countries with poor human rights where they may be subject to arrest and persecution. Ap...
Open-School 3.0 / Community Edition 2.3 - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Open-School 3.0 / Community Edition 2.3 - Cross-Site Scripting Vulnerability Exploit Author: Greg.Priest Vendor Homepage: https://open-school.org/ Software Link: Version: Open-School 3.0/Community Edition 2.3 Tested on: Windows/Linux CVE :...
Apple Upgrades Bug Bounty Program: Adds Macs, $1M Reward
LAS VEGAS – Apple is giving its bug bounty program a much-needed makeover. The device manufacturer in a Thursday Black Hat USA 2019 session said it will open the historically private program to all researchers in the fall. In addition, it plans to drastically boost some rewards for vulnerabilitie...
Low: Red Hat Security Advisory: libreoffice security and bug fix update
An update for libreoffice is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
