3307 matches found
CVE-2017-1723
IBM Security QRadar SIEM 7.2 and 7.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 134812...
New Crossrider variant installs configuration profiles on Macs
A new variant of the Crossrider adware has been spotted that is infecting Macs in a unique way. For the most part, this variant is still quite ordinary, doing some of the same old things that we've been seeing for years in Mac adware. However, the use of a configuration profile introduces a uniqu...
DEBIAN-CVE-2018-9263
In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the Kerberos dissector could crash. This was addressed in epan/dissectors/packet-kerberos.c by ensuring a nonzero key length...
ALPINE-CVE-2018-6914
Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. dot dot in the prefix argument...
UBUNTU-CVE-2018-6914
Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. dot dot in the prefix argument...
Car Dot App Has Logic Design Flaws
Car Dot APP is a mobile APP product specially created for car owner users, dedicated to providing professional car services. A logical design vulnerability exists in CarDotDot APP. The attacker obtains the corresponding data packets through the cell phone number login function, and then can repla...
Node.js third-party modules: [serve] Directory listing and File access even when they have been set to be ignored (using dot-slash)
I would like to report a vulnerability in serve. It allows listing directory and reading local files on the target server. Module module name: serve version: 6.5.3 npm page: https://www.npmjs.com/package/serve Module Description Ever wanted to share a project on your network by running just a...
San Diego Sues Experian Over ID Theft Service
The City of San Diego, Calif. is suing consumer credit bureau Experian, alleging that a data breach first reported by KrebsOnSecurity in 2013 affected more than a quarter-million people in San Diego but that Experian never alerted affected consumers as required under California law. The lawsuit,...
Microsoft .NET Core Denial of Service Vulnerability
Microsoft .NET Core is a free and open source development platform from Microsoft. The platform has multi-language support and cross-platform features.PowerShell Core is a task automation and management framework based on the . A denial of service vulnerability exists in Microsoft .NET Core and...
Path Traversal
angular-http-server is vulnerable to path traversal attacks. Using a string including ../, attackers can traverse the server and any file with a known path...
2,000 Colorado DOT computers infected with SamSam Ransomware
By Uzair Amir Another day, another ransomware scam - This time, it is This is a post from HackRead.com Read the original post: 2,000 Colorado DOT computers infected with SamSam Ransomware...
February 2018 Preview of the Quality Rollups for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 for Windows 8.1, RT 8.1 and Server 2012 R2 (KB 4074807)
February 2018 Preview of the Quality Rollups for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 for Windows 8.1, RT 8.1 and Server 2012 R2 KB 4074807 Notice Update KB 4074807 has been released as part of the Preview of Quality Rollups for .NET Framework for February 2018. Parts ...
ozkent.com.tr XSS vulnerability
Open Bug Bounty ID: OBB-550166 Description| Value ---|--- Affected Website:| ozkent.com.tr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2018-5328
ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows access to various /UserManagement/ privileged modules without authenticating the user; an attacker can misuse these functionalities to perform unauthorized actions, as demonstrated by Edit User Details...
Canadian Police Charge Operator of Hacked Password Service Leakedsource.com
Canadian authorities have arrested and charged a 27-year-old Ontario man for allegedly selling billions of stolen passwords online through the now-defunct service Leakedsource.com. The now-defunct Leakedsource service. On Dec. 22, 2017, the Royal Canadian Mounted Police RCMP charged Jordan Evan...
Microsoft .NET Framework and .NET Core Denial of Service Vulnerability
NET Framework and .NET Core are both products of Microsoft Corporation.Microsoft .NET Framework is a comprehensive and consistent programming model and development platform for building applications for Windows, Windows Store, Windows Server, and Microsoft Azure. NET Framework is a comprehensive...
CVE-2017-1671
IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 133638...
QuickApps CMS Cross-Site Scripting Vulnerability
QuickApps CMS is a PHP-based, open source, modular content management system. A cross-site scripting vulnerability exists in the user's real name field in QuickApps CMS version 2.0.0. A remote attacker can exploit this vulnerability to cause a denial of service and perform unauthorized operations...
CVE-2017-1548
IBM Sterling File Gateway 2.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 131288...