Cross site request forgery (csrf)

csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses ===, a fail first string comparison, instead of a time constant string comparison This enables an attacker to guess the secret in no more than 1618288 guesses, instead of the 16^18 guesses...

DomainMod cross-site scripting vulnerability (CNVD-2018-10862)

DomainMod is a PHP and MySQL based open source application for managing centrally located domain names and other Internet assets. A cross-site scripting vulnerability exists in DomainMod version 4.10.0. A remote attacker can exploit this vulnerability to execute JavaScript code with the help of t...

SAP NetWeaver Web Dynpro Information Disclosure

Application: SAP NetWeaver Web Dynpro 6.4 to 7.5 - Information disclosure Versions Affected: SAP NetWeaver 6.4 - 7.5 Vendor URL: http://SAP.com Bugs: Information disclosure Enumerate users Sent: 2016-12-15 Reported: 2016-12-15 Date of Public Advisory: 09.02.2016 Reference: SAP Security Note 23445...

First Lady’s 'Be Best' Initiative Addresses Kids' Online Safety

First Lady Melania Trump has announced her initiative to help children be their best. As part of her initiative, the First Lady released a guide to help parents and other adults discuss online safety and responsibility with children. Children taught about internet safety, appropriate online...

Phone Maker BLU Settles with FTC Over Unauthorized User Data Extraction

Android phone-maker BLU Products agreed to a proposed settlement on Tuesday with the Federal Trade Commission, over allegations it allowed the third-party firm Adups Technology to collect detailed consumer data from users without their consent. In an administrative complaint filed earlier this we...

HRSALE The Ultimate HRM Cross-Site Scripting Vulnerability

HRSALE The Ultimate HRM is a PHP-based human resource management system. A cross-site scripting vulnerability exists in HRSALE The Ultimate HRM version 1.0.2, which originates from the program failing to validate user-submitted input. A remote attacker can exploit this vulnerability by injecting...

CVE-2018-7901

RCS module in Huawei ALP-AL00B smart phones with software versions earlier than 8.0.0.129, BLA-AL00B smart phones with software versions earlier than 8.0.0.129 has a remote control vulnerability. An attacker can trick a user to install a malicious application. When the application connects with R...

CVE-2018-2847

Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications subcomponent: Operations. Supported versions that are affected are 1.6 and 1.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2018-2851

Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications subcomponent: Enterprise Management Console. Supported versions that are affected are 1.6 and 1.7. Easily exploitable vulnerability allows low privileged attacker with network access via HT...

CVE-2018-2853

Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications subcomponent: Operations, Client Application Loader. Supported versions that are affected are 1.6 and 1.7. Easily exploitable vulnerability allows low privileged attacker with network acces...

CVE-2018-2851

Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications subcomponent: Enterprise Management Console. Supported versions that are affected are 1.6 and 1.7. Easily exploitable vulnerability allows low privileged attacker with network access via HT...

CVE-2018-2848

Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications subcomponent: Client Application Loader. Supported versions that are affected are 1.6 and 1.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

CVE-2018-2847

Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications subcomponent: Operations. Supported versions that are affected are 1.6 and 1.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

Buffer overflow

Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications subcomponent: Operations, Client Application Loader. Supported versions that are affected are 1.6 and 1.7. Easily exploitable vulnerability allows low privileged attacker with network acces...

Buffer overflow

Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications subcomponent: Operations. Supported versions that are affected are 1.6 and 1.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

Design/Logic Flaw

Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications subcomponent: Enterprise Management Console. Supported versions that are affected are 1.6 and 1.7. Easily exploitable vulnerability allows low privileged attacker with network access via HT...

CVE-2018-2848

CVE-2018-2848 affects Oracle Hospitality Simphony First Edition, specifically the Client Application Loader. Vulnerable versions are 1.6 and 1.7. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the system, potentially resulting in unauthorized access to crit...

CVE-2018-2847

Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications subcomponent: Operations. Supported versions that are affected are 1.6 and 1.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2018-2851

The CVE-2018-2851 vulnerability affects Oracle Hospitality Simphony First Edition, specifically the Enterprise Management Console subcomponent, in versions 1.6 and 1.7. The issue allows a low-privileged attacker with network access via HTTP to compromise data, enabling unauthorized creation, dele...

CVE-2018-2853

Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications subcomponent: Operations, Client Application Loader. Supported versions that are affected are 1.6 and 1.7. Easily exploitable vulnerability allows low privileged attacker with network acces...