CVE-2015-0839

The CVE-2015-0839 issue affects the hp-plugin download verification in HP Linux Imaging and Printing (HPLIP). Root cause: verification uses a short GPG key ID from a keyserver, enabling MITM attackers to potentially drive arbitrary code execution during print plugin downloads. Impact: network-exp...

CVE-2015-0839

The hp-plugin utility in HP Linux Imaging and Printing HPLIP makes it easier for man-in-the-middle attackers to execute arbitrary code by leveraging use of a short GPG key id from a keyserver to verify print plugin downloads...

Fedora 24 : webkitgtk4 (2017-37f68e3534)

This update addresses the following vulnerabilities : - CVE-2017-2538 Additional fixes : - Fix web process deadlock when seeking youtube videos. - Fix blob downloads. - Improve theme rendering performance when using GTK+ = 3.20. - Fix positioning of popup menus in Wayland. - Fix JavaScriptCore...

CVE-2017-7480

rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remote code execution...

Fedora 26 : webkitgtk4 (2017-772bf90b03)

This update addresses the following vulnerabilities : - CVE-2017-2538 Additional fixes : - Fix web process deadlock when seeking youtube videos. - Fix blob downloads. - Improve theme rendering performance when using GTK+ = 3.20. - Fix positioning of popup menus in Wayland. - Fix several crashes a...

Fedora 25 : webkitgtk4 (2017-bff1b87765)

This update addresses the following vulnerabilities : - CVE-2017-2538 Additional fixes : - Fix web process deadlock when seeking youtube videos. - Fix blob downloads. - Improve theme rendering performance when using GTK+ = 3.20. - Fix positioning of popup menus in Wayland. - Fix JavaScriptCore...

Git downloads over HTTP

SourceTree downloads the standalone Git and every other zips over HTTP from the Atlassian servers. This is not secure and should be switched to HTTPS...

Man-in-the-Middle (MitM)

ikst is vulnerable to resources downloaded through insecure protocol. The library downloads resources through HTTP, allowing a man-in-the-middle attack to tamper with the content in transit...

CVE-2017-6704

A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an authenticated, remote attacker to perform arbitrary file downloads that could allow the attacker to read files from the underlying filesystem. More Information: CSCvc90335. Known Affected...

Information disclosure

A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an authenticated, remote attacker to perform arbitrary file downloads that could allow the attacker to read files from the underlying filesystem. More Information: CSCvc90335. Known Affected...

CVE-2017-6704

CVE-2017-6704 applies to the Cisco Prime Collaboration Provisioning Tool web application. An authenticated, remote attacker could exploit insufficient input validation to download arbitrary files from the system, reading files on the underlying filesystem. Public references in Cisco’s advisory co...

CVE-2017-6704

A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an authenticated, remote attacker to perform arbitrary file downloads that could allow the attacker to read files from the underlying filesystem. More Information: CSCvc90335. Known Affected...

CVE-2017-9248

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leadi...

CVE-2017-9248

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leadi...

proquote-solutions.com XSS vulnerability

Vulnerable URL: http://proquote-solutions.com/Downloads-Viewer.asp?literature=1"...

CVE-2017-9248

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leadi...

Man-in-the-Middle (MitM) Through Insecure Binary Downloads

edp-package is vulnerable to man-in-the-middle MitM attacks. It uses an insecure protocol to download resources. This allows attackers to trigger MitM and other possible attacks such as remote code execution RCE on the server...

Cisco Prime Collaboration Provisioning Tool Arbitrary File Download Vulnerability

A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an authenticated, remote attacker to perform arbitrary file downloads that could allow the attacker to read files from the underlying filesystem. The vulnerability is due to insufficient input...

Man-in-the-Middle (MitM) Through Insecure Binary Downloads

ruby-gpgme is vulnerable to man-in-the-middle attacks. The vulnerability exists because the library downloads binary resources via FTP. Also, the issue may potentially cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the...

INFOR EAM Cross-Site Scripting Attack Vulnerability

Infor EAM is the best configurable enterprise-class asset management solution on the market. Improve capital asset management by increasing reliability, enhancing predictive maintenance, ensuring regulatory compliance, reducing energy consumption, and supporting sustainability programs. A...