Node.js third-party modules: Remote code executio in NPM package getcookies

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report remote code...

PT-2018-8687

Name of the Vulnerable Software and Affected Versions: Cisco Aironet 1800 Series Access Points versions 8.2.121.0 through 8.5.105.0 Cisco Aironet 2800 Series Access Points versions 8.3.102.0 through 8.5.105.0 Cisco Aironet 3800 Series Access Points versions 8.3.102.0 through 8.5.105.0 Description...

CVE-2018-0226: Undefined Security Weakness

A vulnerability in the assignment and management of default user accounts for Secure Shell SSH access to Cisco Aironet 1800, 2800, and 3800 Series Access Points that are running Cisco Mobility Express Software could allow an authenticated, remote attacker to gain elevated privileges on an affecte...

CVE-2018-0235: Improper Input Validation

A vulnerability in the 802.11 frame validation functionality of the Cisco Wireless LAN Controller WLC could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. The vulnerability is due to incomplete input...

Threat Outbreak Alert RuleID32583: Email Messages Distributing Malicious Software on April 26, 2018

Medium Alert ID: 57604 First Published: 2018 April 30 14:11 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32583 may contain the following files: Name| Siz...

Node.js third-party modules: Unrestricted file upload (RCE)

I would like to report an unrestricted file upload in express-cart. It allows a user with administrative privileges to upload a file to any path. Module module name: express-cart version: 1.1.5 npm page: https://www.npmjs.com/package/express-cart Module Description expressCart is a fully function...

Node.js third-party modules: Privilege escalation allows any user to add an administrator

I would like to report privilege escalation in the npm module express-cart. It allows a normal user to add another user with administrator privileges. Module module name: express-cart version: 1.1.5 npm page: https://www.npmjs.com/package/express-cart Module Description expressCart is a fully...

Threat Outbreak Alert RuleID32515: Email Messages Distributing Malicious Software on April 18, 2018

Medium Alert ID: 57535 First Published: 2018 April 18 19:22 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32515 may contain the following files: Name | Si...

MS11-049: Description of the security update for Visual Studio 2008 SP1: June 14, 2011

MS11-049: Description of the security update for Visual Studio 2008 SP1: June 14, 2011 INTRODUCTION Microsoft has released security bulletin MS11-049. To view the complete security bulletin, visit one of the following Microsoft websites: Home users:...

Threat Outbreak Alert RuleID32439: Email Messages Distributing Malicious Software on April 11, 2018

Medium Alert ID: 57472 First Published: 2018 April 11 20:15 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32439 may contain the following files: Name | Si...

Not All Privileges are Assigned to Caller error during upgrade/install

Challenge When upgrading, the installer encounters the following error message which prevents it from proceeding: "Not all privileges or groups referenced are assigned to the caller" Affected Application Installers Veeam Backup & Replication Veeam Backup Enterprise Manager Veeam ONE Veeam Recover...

Directory Traversal

express-blinker is vulnerable to directory traversal attacks. The vulnerability exists due to the lack of ../ sanitization on the user input, allowing attackers to access files outside of the server's scope...

Intentionally Insecure Webapp for Security Training: OWASP Juice Shop

OWASP Juice Shop is an intentionally insecure webapp for security trainings written entirely in JavaScript which encompasses the entire OWASP Top Ten and other severe security flaws. Juice Shop is written in Node.js, Express and AngularJS. It was the first application written entirely in JavaScri...

Oracle Enterprise Manager Database Express (EM Express) Detection

Binary data oracleenterprisemanagerdatabaseexpressdetect.nbin...

express-papier.de XSS vulnerability

Open Bug Bounty ID: OBB-581921 Description| Value ---|--- Affected Website:| express-papier.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

express-office.ru XSS vulnerability

Open Bug Bounty ID: OBB-571587 Description| Value ---|--- Affected Website:| express-office.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

id.sport-express.ru XSS vulnerability

Open Bug Bounty ID: OBB-564462 Description| Value ---|--- Affected Website:| id.sport-express.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-6835

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...

PT-2018-17768

Name of the Vulnerable Software and Affected Versions Etherpad Lite versions prior to 1.6.3 Description The issue is related to the mishandling of JSONP in the node/hooks/express/apicalls.js file, which allows remote attackers to bypass intended access restrictions. Recommendations For versions...

CVE-2018-6835: Improper Input Validation

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions...