CVE-2016-3100

kinit in KDE Frameworks before 5.23.0 uses weak permissions 644 for /tmp/xauth-xxx-y, which allows local users to obtain X11 cookies of other users and consequently capture keystrokes and possibly gain privileges by reading the file...

CVE-2016-3100

kinit in KDE Frameworks before 5.23.0 uses weak permissions 644 for /tmp/xauth-xxx-y, which allows local users to obtain X11 cookies of other users and consequently capture keystrokes and possibly gain privileges by reading the file...

DEBIAN-CVE-2016-3100

kinit in KDE Frameworks before 5.23.0 uses weak permissions 644 for /tmp/xauth-xxx-y, which allows local users to obtain X11 cookies of other users and consequently capture keystrokes and possibly gain privileges by reading the file...

CVE-2016-3100

kinit in KDE Frameworks before 5.23.0 uses weak permissions 644 for /tmp/xauth-xxx-y, which allows local users to obtain X11 cookies of other users and consequently capture keystrokes and possibly gain privileges by reading the file...

CVE-2016-3100

kinit in KDE Frameworks before 5.23.0 uses weak permissions 644 for /tmp/xauth-xxx-y, which allows local users to obtain X11 cookies of other users and consequently capture keystrokes and possibly gain privileges by reading the file...

CVE-2016-3100

KDE Frameworks components suffer from a local-privilege issue in kinit prior to v5.23.0: the directory /tmp/xauth-xxx-_y is created with weak permissions (644), enabling local users to read X11 cookies of other users and potentially capture keystrokes or escalate privileges. Remediation: upgrade ...

Moodle: source code security analysis report

Several vulnerabilities were discovered in Moodle 'Moodle' software: File System Path Manipulation Incorrect User Input Filtration when Using the unserialize Function Incorrect Newline Symbol Filtration in HTTP-response Headers Using Insufficiently Random Generators in Cryptography HttpOnly Cooki...

WordPress < 4.5.3 Multiple Vulnerabilities

Binary data 9388.prm...

The vulnerability of the implementation of the getClass method in the CookieInterceptor class of the Apache Struts software framework allows a hacker to gain access to read, modify, or delete data.

The vulnerability of the CookieInterceptor class implementation in the Apache Struts software platform is related to deficiencies in access control when processing the cookiesName parameter with the symbol “”. Exploiting this vulnerability can allow an attacker to gain access to, read, modify, or...

Symphony CMS Session Fixation Vulnerability

Symphony CMS is a content management system developed in PHP and MySQL. A session fixation vulnerability exists in Symphony CMS when session.useonlycookies is enabled in the program, which can be exploited by a remote attacker to hijack a web session by submitting the PHPSESSID parameter...

Siemens SCALANCE M-800/S615 Web Vulnerability

OVERVIEW Siemens has identified a web security vulnerability in Siemen’s SCALANCE M-800 and S615 modules. This vulnerability was reported directly to Siemens by Alexander Van Maele and Tijl Deneut from HOWEST. Siemens has produced a new firmware version to mitigate this vulnerability. AFFECTED...

Enonic XP: source code security analysis report

Several vulnerabilities were discovered in Enonic AS 'Enonic XP' software: Утечка пользовательских данных между сессиями Использование XSL трансформации для исполнения произвольного кода Отсутствие верификации цифровой подписи исполняемых файлов, полученных из недоверенных источников HttpOnly...

WordPress < 4.5.3 Multiple Vulnerabilities

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.5.3. It is, therefore, affected by the following vulnerabilities : - An unspecified flaw exists in the Customizer component that allows an unauthenticated, remote attacker to...

Slack: XSS vulnerable parameter in a location hash

Hi! There is a vulnerability on your pages, using convertro. Vulnerable parameter from location hash cvosid1, used in your live.js to call convertro code without sanitizing. On the convertro side it is sanitized, but with help of this parameter you could push another parameter typ, that leads to...

Jetpack for WordPress: source code security analysis report

Several vulnerabilities were discovered in Automatic 'Jetpack for WordPress' software: Incorrect User Input Filtration when Connecting to External Files File System Path Manipulation Incorrect User Input Filtration when Using the unserialize Function Using Insufficiently Random Generators in...

cisco wireless kit there is a serious vulnerability, so far no fix-bug warning-the black bar safety net

Cisco recently released a security Advisory to announce the three Cisco wireless packet is subjected to a severe bug effects,but there is still no solution available. SOHO equipment is mainly used in most of the goals between network components,and often in the wild, they often lack the protectiv...

op5 7.1.9 - Configuration Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'op5 v7.1.9 Configuration Command Execution', 'Description' = %q op5 an open source network monitoring software. The configurati...

Cross-site Request Forgery

keycloak-services is vulnerable to cross-site request forgery CSRF attacks. The earlier versions of keycloak-services did not include CSRF protection mechanisms, thus allowing attackers with valid session cookies to perform CSRF attacks...

CMSimple CMS: source code security analysis report

Several vulnerabilities were discovered in CMSimple 'CMSimple CMS' software: File System Path Manipulation Incorrect User Input Filtration when Using Regular Expressions while Calling the pregreplace Function Using Global Variables Using Insufficiently Random Generators in Cryptography HttpOnly...

Facebook Ads now Tracks you, Even if you don't have an Account

There's nowhere to hide across the web, especially from the marketing and advertising companies. If you are paranoid about your privacy, you may get upset to know that Facebook will now track and deliver targeted Ads on other apps and websites for everyone, even if you do not have Facebook...