PT-2017-10777

Name of the Vulnerable Software and Affected Versions Bitly oauth2 proxy versions 2.1 and earlier Description The issue is related to an open redirect vulnerability that occurs during the start and termination of the 2-legged OAuth flow. This is caused by improper input validation and a violation...

Automated posting on Vkontakte public pages using VK API and Python

Vk.com Vkontakte is the most popular social network Russia and Ex-USSR with 430+ million users. Originally it was a Facebook clone. But now, after 10 years of development, these two services are quite different from each other. Traditional advantages of vk.com - huge amount of free music and vide...

cc.autoapi.pucong:auto-flow-core-flow (>=2.0.0, <=2.0.9), cc.autoapi.pucong:auto-flow-persistence (>=2.0.0, <=2.0.9) +179 more potentially affected by CVE-2016-4000 via org.python:jython-standalone (>=2.5.2, <=2.7.1b2)

org.python:jython-standalone MAVEN version =2.5.2, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.0, =1.0.0, =1.3.0, =1.0, =1.0-m1, =1.0-m3, =0.2.13, =0.2.13, =1.0.0, =1.1.0 and more Source cves: CVE-2016-4000 Source advisory: MEND:CVE-2016-4000...

CVE-2017-9899

XnView Classic for Windows Version 2.40 allows remote attackers to execute code via a crafted .fpx file, related to "Data from Faulting Address controls Code Flow starting at Xfpx!gffGetFormatInfo+0x000000000002e388."...

CVE-2017-9895

XnView Classic for Windows Version 2.40 allows remote attackers to execute code via a crafted .fpx file, related to a "Read Access Violation on Control Flow starting at Xfpx!gffGetFormatInfo+0x0000000000020e95."...

CVE-2017-9900

XnView Classic for Windows Version 2.40 allows remote attackers to execute code via a crafted .fpx file, related to "Data from Faulting Address controls Code Flow starting at Xfpx!gffGetFormatInfo+0x000000000002e385."...

CVE-2017-10744

XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "Read Access Violation on Control Flow starting at COMCTL32!CToolTipsMgr::sToolTipsWndProc+0x0000000000000032."...

Code injection

XnView Classic for Windows Version 2.40 allows remote attackers to execute code via a crafted .fpx file, related to "Data from Faulting Address controls Code Flow starting at Xfpx!gffGetFormatInfo+0x0000000000020e91."...

Design/Logic Flaw

XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "Read Access Violation on Control Flow starting at COMCTL32!CToolTipsMgr::sToolTipsWndProc+0x0000000000000032."...

Design/Logic Flaw

IrfanView version 4.44 32bit with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "Read Access Violation on Control Flow starting at FPX!FPXGetScanDevicePropertyGroup+0x000000000000c99a."...

CVE-2017-9873

IrfanView version 4.44 32bit with FPX Plugin 4.46 allows attackers to execute arbitrary code or cause a denial of service via a crafted .fpx file, related to a "Read Access Violation on Control Flow starting at FPX!GetPlugInInfo+0x0000000000012bf2."...

Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based application interface of the Cisco Identity Services Engine ISE portal could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to...

PT-2017-11465

Name of the Vulnerable Software and Affected Versions XnView Classic for Windows version 2.40 Description The issue allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file. It is related to a "Read Access Violation on Control Flow" error. Recommendations Fo...

AWS Auditing & Hardening Tool: Zeus

Zeus is a powerful tool for AWS EC2 / S3 / CloudTrail / CloudWatch / KMS best hardening practices. It checks security settings according to the profiles the user creates and changes them to recommended settings based on the CIS AWS Benchmark source at request of the user. Identity and Access...

Elasticsearch Logstash Denial of Service Vulnerability

Elasticsearch Logstash is a set of log analysis and monitoring tools from Elasticsearch Netherlands. The tool provides functions such as search, processing and management of logs or events. A security vulnerability exists in Elasticsearch Logstash versions prior to 2.3.3. A remote attacker can...

Inflection: Session ID is accessible via XSS

Researcher found a vulnerability in the authentication flow that, when chained with an XSS vulnerability could lead to session take over...

Inflection: XSS at https://app.goodhire.com/member/GH.aspx

Unescaped input from a URL parameter in the checkout flow was being used as a JavaScript variable for determining what cart contents to render. By manipulating the URL parameter, the researcher was able to execute arbitrary JavaScript on the page...

Dynamic Questionnaire: Accelerate Quick and Efficient Responses with Question Gating

As you roll out Security Assessment Questionnaire to your vendors and internal stakeholders, it is necessary to avoid lengthy questionnaires containing many sections with questions that are not relevant to their area of work. It is important that respondents don’t get overwhelmed and spend a lot ...

CVE-2017-4971

An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default i.e., set to 'false' can be vulnerable to malicious EL expressions in view states that process form...

Design/Logic Flaw

An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default i.e., set to 'false' can be vulnerable to malicious EL expressions in view states that process form...