community.bethesda.net Open Redirect vulnerability

Open Bug Bounty ID: OBB-455091 Description| Value ---|--- Affected Website:| community.bethesda.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Directory Traversal

node is vulnerable to directory traversal attacks. Attackers can gain access to files due to a change in pathname validation for ".." which affected path checks in community modules...

CVE-2017-5534

The tibbr user profiles components of tibbr Community, and tibbr Enterprise expose a weakness in an improperly sandboxed third-party component. Affected releases are TIBCO Software Inc. tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0, tibbr Enterprise 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0...

CVE-2017-5530

The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0,...

CVE-2017-5534

The tibbr user profiles components of tibbr Community, and tibbr Enterprise expose a weakness in an improperly sandboxed third-party component. Affected releases are TIBCO Software Inc. tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0, tibbr Enterprise 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0...

Code injection

The tibbr user profiles components of tibbr Community, and tibbr Enterprise expose a weakness in an improperly sandboxed third-party component. Affected releases are TIBCO Software Inc. tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0, tibbr Enterprise 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0...

Code injection

The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0,...

A state of constant uncertainty or uncertain constancy? Fast flux explained

Last August, WireX made headlines. For one thing, it was dubbed the first-known DDoS botnet that used the Android platform. For another, it used a technique that—for those who have been around in the industry for quite a while now—rung familiar in the ears: fast flux. In the context of...

SQL Injection Vulnerability in EasySNS Community Backend Administrator copyfile Method

EasySNS community group version for the new database architecture and program structure, to group as the basic unit to form an interactive community. There is a SQL injection vulnerability in the copyfile method of the EasySNS Community background administrator, which can be exploited by attacker...

SQL Injection Vulnerability in EasySNS Community Backend Administrator locker method

EasySNS community group version for the new database architecture and program structure, to group as the basic unit to form an interactive community. There is a SQL injection vulnerability in the EasySNS Community background administrator locker method, which can be exploited by attackers to obta...

PHP Security Advent Calendar 2017

The end of the year is coming closer and the cheery advent time begins. We are looking back at a spectacular year and it is time to thank and give back to the great PHP, infosec, and RIPS community. Thank you for developing, auditing, and securing your PHP applications with us in 2017! Similar to...

EasySNS Minimalist Community loginHandle method suffers from SQL injection vulnerability

EasySNS Minimalist Community is for the new database architecture and program structure, to the group as the basic unit to form an interactive community. A SQL injection vulnerability exists in the loginHandle method of the EasySNS community. The vulnerability is due to the failure of the system ...

EasySNS Minimalist Community callback_setinfo method suffers from SQL injection vulnerability

EasySNS Minimalist Community is for the new database architecture and program structure, to the group as the basic unit to form an interactive community. There is a SQL injection vulnerability in the callbacksetinfo method of EasySNS Minimalist Community. The vulnerability is due to the failure o...

3 #Infosec Things I Am Grateful For This Thanksgiving

Thanksgiving is a great time to eat, drink and reflect on the previous year. This year I am thankful for: Innovation. This is often overstated and has become a dirty buzzword, but I believe innovation in the space has driven solutions that are providing defenders a huge amount of value. From...

ContextIS Introduces CbRCLI to Access Cb Response via the Command Line for Faster, More Efficient Incident Response

When you think of incident response, there are two key factors. The incident itself, and the need to respond quickly and effectively. You need to have an incident response toolkit that contains everything you need to be able to perform investigations and forensic analysis with speed, accuracy and...

CVE-2017-5533 TIBCO JasperReports Server credentials disclosure

A vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability whic...

#AVGater vulnerability does not affect Windows Defender Antivirus, MSE, or SCEP

On November 10, 2017, a vulnerability called AVGater was discovered affecting some antivirus products. The vulnerability requires a non-administrator-level account to perform a restore of a quarantined file. Windows Defender Antivirus and other Microsoft antimalware products, including System...

GDPR Talk Dominates Barcelona’s  PCI DSS Community Conference

Recently, I returned from the European PCI DSS community conference in Barcelona. As always, the conference featured analysis of current hot topics within the PCI community and was helpful for any security professional looking to learn about the latest advancements in data security and protection...

Shopware 5.3.3: PHP Object Instantiation to Blind XXE

Shopwareis a popular e-commerce software. It is based on PHP using technologies like Symfony 2, Doctrine and the Zend Framework. The code base of its open source community edition encompasses over 690,000 lines of code which we scanned for security vulnerabilities with our RIPS static code...

EasySNS Minimalist Community getgrouptopic method has SQL injection vulnerability

EasySNS Minimalist Community Group Edition is a new database architecture and program structure to form an interactive community with a group as the basic unit. EasySNS Minimalist Community getgrouptopic method has a SQL injection vulnerability, which can be exploited by attackers to obtain...