CVE-2018-9317

CVE-2018-9313 describes a vulnerability in BMW i/X/3/5/7 series Head Unit HU_NBT (Infotainment) from 2012–2018. A remote Bluetooth attack, usable when in pairing mode, could reboot the Head Unit. Affected component: HU_NBT Infotainment; impact: head unit reboot per description. Vulnerability deta...

UBUNTU-CVE-2018-0491

A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service relay crash because the KIST implementation allows a channel to be added more than once in the pending list...

CVE-2017-18196

Leptonica 1.74.4 constructs unintended pathnames containing duplicated path components when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as...

CVE-2018-1000016

CVE-2018-1000016 is rejected and not an active vulnerability entry; reference CVE-2017-17383 instead.

CVE-2017-17457

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-14246. Reason: This candidate is a duplicate of CVE-2017-14246. Notes: All CVE users should reference CVE-2017-14246 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2017-17456

CVE-2017-17456 is rejected/not used; refer to CVE-2017-14245.

Mentalist - Graphical Tool For Custom Wordlist Generation

Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper. Install from Source Prerequisites Linux APT package manager Check if Python 3 ...

Low: Red Hat Enhancement Advisory: Red Hat Virtualization Manager (ovirt-engine) 4.1.7

An update is now available for Red Hat Virtualization Manager. The Red Hat Virtualization Manager is a centralized management platform that allows system administrators to view and manage virtual machines. The Manager provides a comprehensive range of features including search capabilities,...

CVE-2013-6355

CVE-2013-6355 is rejected/not used; reference CVE-2014-6355 instead.

tomcat: Incorrect handling of pipelined requests when send file was used

A vulnerability was discovered in Tomcat's handling of pipelined requests when "Sendfile" was used. If sendfile processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could lead to invalid responses or information disclosure...

CVE-2017-1000124

CVE-2017-1000124 is rejected/not used; this entry does not represent an active vulnerability.

CVE-2016-9717

HTTP Parameter Override is identified in the IBM Infosphere Master Data Management MDM 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 product. It enables attackers by exposing the presence of duplicated parameters which may produce an anomalous behavior in the application that can be potentially exploite...

WakaTime: Session Duplication due to Broken Access Control

Due to improper validation of user before generating an API-KEY and improper measures taken at the time of password reset, it is possible to generate a parallel session at the attacker's end. Proof of concept video is attached to confirm the vulnerability and to demonstrate the Impact of this...

WakaTime: Session Duplication due to Improper Validation

Initially at the time of sign-up the user is able to enter any email-id and account is created without any verification. Later a pop-up arises for verification, but all functions are available without verification. Attacker can use victims email and create an account, he can work on wakatime as t...

Now It's Easier than Ever to Steal Someone's Keys

The website key.me will make a duplicate key from a digital photo. If a friend or coworker leaves their keys unattended for a few seconds, you know what to do...

CVE-2015-0955

CVE-2016-0955 is an XSS vulnerability in Adobe Experience Manager (AEM) 6.1.0. The issue arises from how a folder title field is handled in the Deletion popup dialog, enabling remote authenticated users to inject arbitrary web script or HTML. The connected sources confirm the affected product/ver...

Nextcloud: SQL exception in JSON format

Hi, I know this is not critical, just a design issue, but it will be better if it will not show up to the user as an error, maybe in log files readable to the www-user or to the root user in order to debug. PoC: ---------------------- 1. Create a user and confirm the password 2. Capture the packe...

tomcat: information disclosure due to incorrect Processor sharing

A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body...

CVE-2016-9725

IBM QRadar Incident Forensics 7.2 allows for Cross-Origin Resource Sharing CORS, which is a mechanism that allows web sites to request resources from external sites, avoiding the need to duplicate them. IBM Reference : 1999539...

SUSE-SU-2017:0554-1 Security update for util-linux

This update for util-linux fixes the following issues: This security issue was fixed: - CVE-2017-2616: In su with PAM support it was possible for local users to send SIGKILL to selected other processes with root privileges bsc1023041. This non-security issues were fixed: - lscpu: Implement WSL...