Information Disclosure Vulnerability in Hitachi Automation Director

Overview An Information Disclosure Vulnerability was found in Hitachi Automation Director. Impact Information might be disclosed. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take appropriate action...

Information Disclosure Vulnerability in Hitachi Global Link Manager

Overview An Information Disclosure Vulnerability was found in Hitachi Global Link Manager. Impact Information might be disclosed. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take appropriate action...

The vulnerability of Kaspersky Internet Security for Android, related to the lack of encryption for certain log file files, allows a hacker to disclose confidential information.

The vulnerability of Kaspersky Internet Security for Android lies in the lack of encryption for certain files in the logging application. Exploiting this vulnerability can allow a malicious actor to disclose confidential information remotely...

AlienVault USM 5.4.2 Cross Site Request Forgery Vulnerability

Exploit for php platform in category web applications 1. ADVISORY INFORMATION ======================= Product: AlienVault USM Vendor URL: https://www.alienvault.com Type: Cross-Site Request Forgery CWE-253 Date found: 2017-09-22 Date published: 2017-10-13 CVSSv3 Score: 6.5...

ImageMagick and GraphicsMagick Information Disclosure Vulnerability

ImageMagick is a software for creating, editing, and compositing images that can read, convert, and write images in many formats. A security vulnerability exists in ReadGIFImage in the coders/gif.c file in ImageMagick version 7.0.6-1 and GraphicsMagick version 1.3.26. An attacker can exploit this...

The vulnerability of the interface for internal and external switches of the GlobalProtect operating system PAN-OS allows a attacker to cause a service failure or obtain confidential information.

The vulnerability of the internal and external gateway interfaces of the GlobalProtect operating system PAN-OS is related to incorrect restrictions on XML links to external objects XXE. Exploiting this vulnerability can allow a malicious actor to obtain confidential information, cause service...

PT-2017-5767 · Apache · Apache Roller

Name of the Vulnerable Software and Affected Versions: Apache Roller versions prior to 5.0.3 Description: The issue allows attackers to conduct XML External Entity XXE attacks. XXE attacks occur when an application parses XML input that contains malicious external entities, which can lead to the...

Lansweeper 6.0.100.29 XXE Injection Vulnerability

Exploit for asp platform in category web applications ============================================= - Discovered by: BarkA+-n KA+-lA+-ASS, Mehmet Dursun Adegnce - Severity: High ============================================= I. VULNERABILITY ------------------------- Lansweeper XXE vulnerability...

WordPress: Information / sensitive data disclosure on some endpoints

Hello team! While doing a preliminary recon on .wordpress.org I've come across a few sensitive files that should not be facing the public web; I'll leave you a list organized by criticality and some proof. High priority .travis.yml configuration file with credentials php maintenance/install.php...

S-CMS /js/pic.asp page suffers from SQL injection vulnerability

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. A SQL injection vulnerability exists in the S-CMS /js/pic.asp page. The vulnerability is due to the system failing to effectively filter user-submitted data. An attacker could exploit this vulnerability ...

The Data Tinder Collects, Saves, and Uses

Under European law, service providers like Tinder are required to show users what information they have on them when requested. This author requested, and this is what she received: Some 800 pages came back containing information such as my Facebook "likes," my photos from Instagram even after I...

WordPress Simple Ads Manager Plugin Information Disclosure Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.Simple Ads Manager is one of the plug-ins used to manage ads. A security vulnerability exists in the WordPress Simp...

ImageMagick coders/tiff.c file out-of-bounds read vulnerability

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. An out-of-bounds read vulnerability exists in the coders/tiff.c file in ImageMagick version 7.0.7-4 Q16. An attacker...

Pragyan CMS SQL Injection Vulnerability (CNVD-2017-34576)

Pragyan CMS is a multi-user, modular PHP and MySQL based Content Management System CMS. The system supports custom built-in frameworks, user group rights management, search engine optimization and more. A SQL injection vulnerability exists in Pragyan CMS version 3.0. A remote attacker can exploit...

ALPINE-CVE-2017-0898

Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap...

The vulnerability of the SDP server for Bluetooth protocol implementations allows a hacker to disclose sensitive system information.

The vulnerability of the SDP-server of the BlueZ software package, which implements a Bluetooth protocol stack, stems from the possibility of reading data beyond the memory buffer boundaries. Exploiting this vulnerability allows a malicious actor to read memory bits by using a specially crafted...

CVE-2017-1490

An unspecified vulnerability in the Lifecycle Query Engine of Jazz Reporting Service 6.0 through 6.0.4 could disclose highly sensitive information...

AIX Java Advisory : java_jan2017_advisory.asc (January 2017 CPU) (SWEET32)

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following subcomponents : - A vulnerability exists in the Libraries subcomponent, known as SWEET32, in the 3DES and Blowfish algorithms due to the use of weak 64-bit block ciphers by default. A...

Vulnerability Spotlight: Content Security Policy bypass in Microsoft Edge, Google Chrome and Apple Safari

The vulnerabilities were discovered by Nicolai Grdum of Cisco.Today, Talos is releasing details of vulnerabilities discovered in Microsoft Edge browser as well as older versions of Google Chrome CVE-2017-5033 and browsers based on the Webkit such as Apple Safari CVE-2017-2419 . An attacker may be...

IBM QRadar Network Security XML External Entity Injection Vulnerability

IBM QRadar Network Security is a suite of network threat protection software from IBM in the United States. The software uses deep packet inspection and behavior-based analysis to detect and protect against known and unknown threats. An XML external entity injection vulnerability exists in IBM...