Hardcoded credentials

A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed...

CVE-2016-9335

CVE-2016-9335 affects Red Lion Controls Sixnet-Managed Industrial Switches (firmware 5.0.196) and AutomationDirect/Stride-Managed Ethernet Switches (firmware 5.0.190). The root cause is hard-coded HTTP SSL/SSH keys that cannot be regenerated, causing all devices to share the same key. Consequence...

CVE-2016-9335

A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed...

CVE-2016-9335: Use of Hard-coded Cryptographic Key

A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride-Managed Ethernet Switches running firmware Version 5.0.190. Vulnerable versions of Stride-Managed Ethernet switches and Sixnet-Managed...

JasperReports - (Authenticated) File Read

JasperReports - Authenticated File Read TIBCO’s JasperReports string = wrapper.getParameterValues"page" To: getResource @ DirResourceSet.java:101 file = new File/home/rhino/jasperreports...mcat/webapps/jasperserver,"/WEB-INF/jsp/modules/administer/adminImport.jsp" Due to a lack of input validatio...

JasperReports - (Authenticated) File Read

TIBCO’s JasperReports string = wrapper.getParameterValues"page" To: getResource @ DirResourceSet.java:101 file = new File/home/rhino/jasperreports...mcat/webapps/jasperserver,"/WEB-INF/jsp/modules/administer/adminImport.jsp" Due to a lack of input validation we found ourselves with the capability...

CVE-2017-4952

VMware Xenon 1.x, prior to 1.5.4-CR71, 1.5.77, 1.5.4-CR62, 1.3.7-CR12, 1.1.0-CR0-3, 1.1.0-CR31,1.4.2-CR41, and 1.5.48, contains an authentication bypass vulnerability due to insufficient access controls for utility endpoints. Successful exploitation of this issue may result in information...

CVE-2017-4952

VMware Xenon 1.x, prior to 1.5.4-CR71, 1.5.77, 1.5.4-CR62, 1.3.7-CR12, 1.1.0-CR0-3, 1.1.0-CR31,1.4.2-CR41, and 1.5.48, contains an authentication bypass vulnerability due to insufficient access controls for utility endpoints. Successful exploitation of this issue may result in information...

Authentication flaw

VMware Xenon 1.x, prior to 1.5.4-CR71, 1.5.77, 1.5.4-CR62, 1.3.7-CR12, 1.1.0-CR0-3, 1.1.0-CR31,1.4.2-CR41, and 1.5.48, contains an authentication bypass vulnerability due to insufficient access controls for utility endpoints. Successful exploitation of this issue may result in information...

CVE-2017-4952

VMware Xenon 1.x, prior to 1.5.4-CR71, 1.5.77, 1.5.4-CR62, 1.3.7-CR12, 1.1.0-CR0-3, 1.1.0-CR31,1.4.2-CR41, and 1.5.48, contains an authentication bypass vulnerability due to insufficient access controls for utility endpoints. Successful exploitation of this issue may result in information...

The Catch 22 of Base64: Attacker Dilemma from a Defender Point of View

Web application threats come in different shapes and sizes. These threats mostly stem from web application vulnerabilities, published daily by the vendors themselves or by third-party researchers, followed by vigilant attackers exploiting them. To cover their tracks and increase their attack...

CVE-2018-10545

An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpmunix.c makes a PRSETDUMPABLE prctl call, allowing one user in a multiuser environment to obtain sensitive...

CVE-2018-10545

Technical details (affected products, versions, exploit information, and fixes) are not provided in the supplied documents. Please monitor for updates.

CVE-2018-10545

An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpmunix.c makes a PRSETDUMPABLE prctl call, allowing one user in a multiuser environment to obtain sensitive...

MS08-070: Vulnerabilities in Visual Basic 6.0 Runtime Extended Files (ActiveX Controls) could allow remote code execution

Resolves vulnerabilities in Visual Basic 6.0 Runtime Extended Files ActiveX Controls that could allow remote code execution.INTRODUCTIONMicrosoft has released security bulletin MS08-070. To view the complete security bulletin, visit one of the following Microsoft Web sites:Home users:...

Critical Actions to Finalize Your GDPR Compliance Program

Starting May 25, 2018, enforcement begins for the new EU General Data Protection Regulation GDPR and its heightened principles and requirements regarding data privacy, data processing, and data security. The newly revised regulation applies to organizations doing business in the European Union or...

CVE-2018-10305

The MessageSearch2 function in PersonalMessage.php in Simple Machines Forum SMF before 2.0.15 does not properly use the possibleusers variable in a query, which might allow attackers to bypass intended access restrictions...

GLSA-201804-22 : Chromium, Google Chrome: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201804-22 Chromium, Google Chrome: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the referenced CVE identifiers and Google Chrome Releases for details. Impact :...

BD Pyxis

1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION : Public exploits are available. Vendor : Becton, Dickinson and Company BD Equipment : Certain BD Pyxis Products Vulnerability : Reusing a Nonce 2. RISK EVALUATION Successful exploitation of this vulnerability could allow data traffic manipulation,...

System Preferences Security Bypass Vulnerability in Multiple Apple Products

Apple iOS, macOS High Sierra, tvOS, and watchOS are products of Apple Inc. Apple iOS is a set of operating systems for mobile devices; macOS High Sierra is a specialized operating system for Mac computers; tvOS is a smart TV operating system; watchOS is a smart watch operating system; and System...