802 matches found
“The 101” – Episode 14 – What Makes Up a Cyberattack? (Part 2)
We’re back with another episode of The 101! This regular security series aims to define endpoint security one question at a time. Tune in each week as we tackle a new term, concept, or comparison in our ongoing effort to provide clear definitions. Last episode we started answering a pivotal...
“The 101” – Episode 13 – What Makes Up a Cyberattack? (Part 1)
We’re back with another episode of The 101! This regular security series aims to define endpoint security one question at a time. Tune in each week as we tackle a new term, concept, or comparison in our ongoing effort to provide clear definitions. Sometimes in security we find ourselves using...
CVE-2017-15936
In Artica Pandora FMS version 7.0, an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, the script will get executed...
CVE-2017-15936
Artica Pandora FMS 7.0 contains a Cross‑Site Scripting vulnerability. An attacker with write permission can create an agent carrying an XSS payload, which executes when a user visits the agent definitions page. The underlying root cause is not specified in the provided documents. The exact affect...
CVE-2017-15936
In Artica Pandora FMS version 7.0, an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, the script will get executed...
CVE-2017-15936: Improper Neutralization of Input During Web Page Generation
In Artica Pandora FMS version 7.0, an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, the script will get executed...
[SECURITY] Fedora 25 Update: augeas-1.8.1-1.fc25
A library for programmatically editing configuration files. Augeas parses configuration files into a tree structure, which it exposes through its public API. Changes made through the API are written back to the initially read files. The transformation works very hard to preserve comments and...
camel-core: Validation component vulnerable to SSRF via remote DTDs and XXE
It was found that Apache Camel's validation component evaluates DTD headers of XML stream sources, although a validation against XML schemas XSD is executed. Remote attackers can use this feature to make Server-Side Request Forgery SSRF attacks by sending XML documents with remote DTDs URLs or XM...
August 8, 2017 – Morning Cyber Coffee Headlines – “Smokey the Bear” Edition
Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 8, 2017 - Headlines NetWorks Group Joins “Carbon Black Connect” Partner...
EulerOS 2.0 SP2 : librsvg2 (EulerOS-SA-2017-1137)
According to the version of the librsvg2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The rsvgcssnormalizefontsize function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service stack consumption and...
EulerOS 2.0 SP1 : librsvg2 (EulerOS-SA-2017-1136)
According to the version of the librsvg2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The rsvgcssnormalizefontsize function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service stack consumption and...
Fedora 26 : php-symfony (2017-4fcbd8a4c3)
2.8.25 2017-07-17 - security 23507 Security validate empty passwords again xabbuh - bug 23526 HttpFoundation Set meta refresh time to 0 in RedirectResponse content jnvsor - bug 23540 Disable inlining deprecated services alekitto - bug 23468 DI Handle root namespace in service definitions ro0NL -...
Sql injection
IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatIfGadget/getmetrics.php via the element parameter...
CVE-2017-11471
IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatIfGadget/getmetrics.php via the element parameter...
“The 101” – Episode 1 – What is a Non-Malware Attack?
Welcome to our new video series, “The 101!” This weekly security series aims to do one thing: define endpoint security, one question at a time. Tune in each week as we tackle a new term, concept or comparison in our ongoing effort to cut through the noise and provide clear definitions. Security c...
Qualys Cloud Suite 8.10 New Features
This new release of the Qualys Cloud Suite, version 8.10, includes new capabilities and improvements to for VM, PC and shared platform improvements: Authentication Vault integration with BeyondTrust Mandate-Based reporting for Policy Compliance to simplify reporting against multiple mandates and...
Apache Ranger =< 0.5.2 allows to download policy definitions without authentication
Apache Ranger =:6080/service/plugins/policies/download/ The prerequisite to exploit this flaw is to know or guess the policy name. This finding may not constitute a vulnerability by itself, but is equivalent to having access to a network filtering policy: finding holes in policies is then easier...
CVE-2016-5682
Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section...
