Department of Education Lambasted Over Database Vulnerabilities

Like the Office of Personnel Management before it, the Department of Education has failed to heed repeated warnings that its systems contain multiple weaknesses. In a House Committee on Oversight and Government Reform hearing held this week, Congressman and committee chair Jason Chaffetz R-Utah...

ZTE ADSL ZXV10 W300 Authorization / Disclosure / Backdoor

Exploit Title: ZTE ADSL ZXV10 W300 modems - Multiple vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: www.zte.com.cn Versions Reported: W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 CVE-ID: CVE-2015-7257 CVE-2015-7258 CVE-2015-7259 Note: Large deployment size, primarily in Peru, used b...

ZTE ADSL ZXV10 W300 Modems - Multiple Vulnerabilities

ZTE ADSL ZXV10 W300 Modems - Multiple Vulnerabilities Exploit Title: ZTE ADSL ZXV10 W300 modems - Multiple vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: www.zte.com.cn Versions Reported: W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 CVE-ID: CVE-2015-7257 CVE-2015-7258 CVE-2015-7259...

The vulnerability of the Cisco Secure Access Control System allows a perpetrator to bypass access restrictions and read log files as well as device status information.

The vulnerability of the report generation web interface of the Solution Engine component of the Cisco Secure Access Control System relates to deficiencies in access control for certain functions. Exploiting this vulnerability could allow a malicious actor to bypass access restrictions and read l...

The vulnerability of the Android operating system allows attackers to circumvent existing access restrictions, breach data confidentiality, or cause service failures.

The vulnerability of the Android operating system is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions, compromise data confidentiality, or cause service failures through a specially creat...

The vulnerability of the Firefox browser allows a violator to circumvent domain restrictions and breach data confidentiality.

The vulnerability of Firefox browsers is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to bypass access controls and compromise data confidentiality using a specially crafted HTML document...

CVE-2015-7910

Exemys Telemetry Web Server relies on an HTTP Location header to indicate that a client is unauthorized, which allows remote attackers to bypass intended access restrictions by disregarding this header and processing the response body...

ZTE ADSL Authorization Bypass / Information Disclosure

ZTE ADSL modems - Multiple vulnerabilities Confirmed on 2 of multiple software versions - W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 1 Insufficient authorization controls CVE-ID: CVE-2015-7257 Observed in Password Change functionality. Other functions may be vulnerable as well. Expected behavior...

CVE-2015-6478

Unitronics VisiLogic OPLC IDE before 9.8.02 does not properly restrict access to ActiveX controls, which allows remote attackers to have an unspecified impact via a crafted web site...

Code injection

Unitronics VisiLogic OPLC IDE before 9.8.02 does not properly restrict access to ActiveX controls, which allows remote attackers to have an unspecified impact via a crafted web site...

CVE-2015-6478

Unitronics VisiLogic OPLC IDE before 9.8.02 does not properly restrict access to ActiveX controls, which allows remote attackers to have an unspecified impact via a crafted web site...

Cisco Connected Grid Network Management System Privilege Escalation Vulnerability

A vulnerability in the web GUI of Cisco Connected Grid Network Management System could allow an authenticated, remote attacker to perform limited configuration changes while logged in as a user having the Monitor-Only role. The vulnerability is due to insufficient authorization controls. An...

The vulnerability of the web application for data synchronization with ownCloud allows a hacker to circumvent existing access restrictions and gain access to users’ files.

The vulnerability of the virtual file system of the web application for data synchronization with ownCloud is related to the lack of data validation during data retrieval. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions and gain access to user files b...

The vulnerability of the Radia Client Automation program allows a hacker to circumvent existing access restrictions.

The vulnerability of the Radia Client Automation user automation program is related to errors in security settings during default configuration. Exploiting this vulnerability can allow a malicious actor to circumvent existing access restrictions remotely...

librsync Limit Bypass Vulnerability

librsync is a free software library developed by software developer Martin Pool that implements the rsync remote-delta algorithm which enables fast and instantaneous updating of remote files over a network. A security restriction bypass vulnerability exists in versions of librsync prior to 1.0.0...

johnsoncontrols.co.jp XSS vulnerability

Vulnerable URL: http://www.johnsoncontrols.co.jp/content/jp/ja/search.html?q=%22%3E%3Cscript%3Ealert%28%22XSSPOSED%22%29%3C%2Fscript%3E Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 20:15 GMT Vulnerability type:| XSS Vulnerability status:|...

johnsoncontrols.at XSS vulnerability

Vulnerable URL: http://www.johnsoncontrols.at/content/at/de/search.html?q="...

johnsoncontrols.pl XSS vulnerability

Vulnerable URL: http://www.johnsoncontrols.pl/content/pl/pl/search.html?q=%22%3E%3Cscript%3Ealert%28%22XSSPOSED%22%29%3C%2Fscript%3E Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 20:15 GMT Vulnerability type:| XSS Vulnerability status:|...

johnsoncontrols.sg XSS vulnerability

Vulnerable URL: http://www.johnsoncontrols.sg/content/sg/en/search.html?q=%22%3E%3Cscript%3Ealert%28%22XSSPOSED%22%29%3C%2Fscript%3E Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 20:15 GMT Vulnerability type:| XSS Vulnerability status:|...

The vulnerabilities of PDF editing programs like Adobe Acrobat and Adobe Acrobat Document Cloud, as well as PDF viewing programs like Adobe Reader and Adobe Reader Document Cloud, allow attackers to circumvent existing restrictions and gain access to protected information.

The vulnerabilities of PDF editing programs like Adobe Acrobat and Adobe Acrobat Document Cloud, as well as PDF viewing programs like Adobe Reader and Adobe Reader Document Cloud, are related to lack of access control mechanisms. Exploiting these vulnerabilities can allow attackers to bypass...