TIBCO Security Advisory: February 13, 2019 - TIBCO SilverFabric

TIBCO Silver Fabric Vulnerable to Reflected Cross-Site Scripting attacks Original release date: February 13,2019 Last revised: CVE-2018-12409 Source: TIBCO Software Inc. TIBCO Silver Fabric Vulnerable to Reflected Cross-Site Scripting attacks Original release date: February 13, 2019 Last revised:...

Code injection

BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. and Malaysian Releases, between November 2017 and November 2018 and BD FACSLyric IVD Windows 10 Professional Operating System US release does not properly enforce user access control to privileged accounts, which may...

CVE-2019-6517

CVE-2019-6517 affects BD FACSLyric on Windows 10 Pro (RUO and IVD US releases) where the system does not properly enforce access control to privileged accounts (CWE-284). Root cause: improper access control, allowing unauthorized access to administrative level functions. Impact: potential elevati...

CVE-2019-6517

BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. and Malaysian Releases, between November 2017 and November 2018 and BD FACSLyric IVD Windows 10 Professional Operating System US release does not properly enforce user access control to privileged accounts, which may...

PT-2019-18135

Name of the Vulnerable Software and Affected Versions BD FACSLyric Research Use Only versions between November 2017 and November 2018 BD FACSLyric IVD is not affected as it properly enforces user access control. Description The issue concerns improper enforcement of user access control to...

CVE-2019-6517: Improper Access Control

BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. and Malaysian Releases, between November 2017 and November 2018 and BD FACSLyric IVD Windows 10 Professional Operating System US release does not properly enforce user access control to privileged accounts, which may...

DEBIAN-CVE-2019-7345

Self - Stored Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, as the view 'options' options.php does no input validation for the WEBTITLE, HOMEURL, HOMECONTENT, or WEBCONSOLEBANNER value, allowing an attacker to execute HTML or JavaScript code. This relates to functions.php...

DEBIAN-CVE-2019-7337

Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3 as the view 'events' events.php insecurely displays the limit parameter value, without applying any proper output filtration. This issue exists because of the function sortHeader in functions.php, which insecurely returns the...

Mac "CookieMiner" Malware Aims to Gobble Crypto Funds

A newly-discovered malware is targeting Mac users’ web cookies and credentials in hopes of withdrawing funds on their cryptocurrency exchange accounts. The malware, discovered this month and aptly named “CookieMiner,” collects cryptocurrency-related cookies – in addition to compromised credential...

CVE-2019-3910

Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device...

Critical, Unpatched Cisco Flaw Leaves Small Business Networks Wide Open

A critical and unpatched vulnerability in the widely deployed Cisco Small Business Switch software leaves the door open to remote, unauthenticated attackers gaining full administrative control over the device – and therefore the network. Cisco Small Business Switches were developed for small offi...

Castlamp Zenbership Cross-Site Request Forgery Vulnerability

Castlamp Zenbership is an open source and free membership CRM software from Castlamp USA. The software is capable of providing a specialized customer relationship management system for membership sites. A cross-site request forgery vulnerability exists in Castlamp Zenbership version 107, which ca...

CVE-2016-10738

Zenbership v107 has CSRF via admin/cp-functions/event-add.php...

CVE-2016-10738

Zenbership v107 has CSRF via admin/cp-functions/event-add.php...

CVE-2016-10738

Zenbership v107 has CSRF via admin/cp-functions/event-add.php...

CVE-2016-10738

Zenbership v107 is affected by a CSRF vulnerability located at admin/cp-functions/event-add.php. The description explicitly states CSRF via that endpoint, indicating potential unauthorized operations could be triggered by attackers. No concrete patch/version remediation details are provided in th...

CVE-2016-10738: Cross-Site Request Forgery (CSRF)

Zenbership v107 has CSRF via admin/cp-functions/event-add.php...

PT-2019-7537

Name of the Vulnerable Software and Affected Versions Zenbership version 1.07 Description The issue allows for CSRF via the "admin/cp-functions/event-add.php" API endpoint. Recommendations For Zenbership version 1.07, update to a version that includes a fix for this issue, or as a temporary...

CVE-2019-3557

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as streamgetline, to trigger an out-of-bounds read when operating on such malformed streams. The implementations wer...

CVE-2019-3557

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as streamgetline, to trigger an out-of-bounds read when operating on such malformed streams. The implementations wer...