January 17, 2019—KB4480955 (Preview of Monthly Rollup)

None None...

Soleo: Directory Traversal + HTTP Paramater Pollution leaking SQL/LDAP credentials

Upon visiting the login page of a provider’s IP Relay client, we noticed that if someone were to click the “forgot password” link, it would bring them to a URL which appeared as the following: https://./IPRelayApp/servlet/IPRelay?page=forgotPassword When attempting to modify the "page" GET...

June 21, 2018—KB4284842 ( Preview of Monthly Rollup)

None None...

bioinf.mpi-inf.mpg.de XSS vulnerability

Open Bug Bounty ID: OBB-633250 Description| Value ---|--- Affected Website:| bioinf.mpi-inf.mpg.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

AppLocker Bypass – CMSTP

CMSTP is a binary which is associated with the Microsoft Connection Manager Profile Installer. It accepts INF files which can be weaponised with malicious commands in order to execute arbitrary code in the form of scriptlets SCT and DLL. It is a trusted Microsoft binary which is located in the...

Input validation

An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitiv...

CVE-2018-1000068

An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitiv...

CVE-2018-1000068: Exposure of Sensitive Information to an Unauthorized Actor

An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitiv...

CVE-2018-1000068

An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitiv...

CVE-2018-1000068

CVE-2018-1000068 affects Jenkins core versions <= 2.106 and LTS

Improper input validation allows unintended access to plugin resource files on case-insensitive file systems

Jenkins did not take into account case-insensitive file systems when preventing access to plugin resource files that should not be accessible. This allowed users with Overall/Read permission to download plugin resource files in META-INF and WEB-INF directories, such as the plugins' JAR files, whi...

CVE-2016-6602: Use of a Broken or Risky Cryptographic Algorithm

ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit...

PT-2017-9000

Name of the Vulnerable Software and Affected Versions ZOHO WebNMS Framework versions 5.2 and 5.2 SP1 Description The issue allows context-dependent attackers to obtain cleartext passwords by leveraging access to the "WEB-INF/conf/securitydbData.xml" file, due to the use of a weak obfuscation...

TinyPDF Installer DLL Hijacking / Unsafe Temp Directory

Hi @ll, the executable installer "InstallTinyPDF.exe", available from , is surprise.- vulnerable: 1. DLL hijacking this is well-known and well-documented; see , , , and "InstallTinyPDF.exe" loads and executes UXTheme.dll and/or DWMAPI.dll from its "application directory" instead Windows' "system...

PT-2016-6370

Name of the Vulnerable Software and Affected Versions VMware Identity Manager versions prior to 2.7.1 vRealize Automation versions prior to 7.2.0 Description The issue allows remote attackers to read sensitive files, specifically /SAAS/WEB-INF and /SAAS/META-INF files, via unspecified vectors...

Cisco AnyConnect Secure Mobility Client 4.2.x < 4.2.5015.0 / 4.3.x < 4.3.2039.0 Privilege Escalation Vulnerability

The version of Cisco AnyConnect Secure Mobility Client installed on the remote Windows host is 4.2.x prior to 4.2.5015.0 or 4.3.x prior to 4.3.2039.0. It is, therefore, affected by a privilege escalation vulnerability due to incomplete validation of path names and file names at installation time....

CVE-2016-6369

Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCuz92464...

CVE-2016-6369

Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCuz92464...

CVE-2016-6369: Undefined Security Weakness

Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCuz92464...

PT-2016-6850

Name of the Vulnerable Software and Affected Versions Cisco AnyConnect Secure Mobility Client versions prior to 4.2.05015 Cisco AnyConnect Secure Mobility Client versions 4.3.x prior to 4.3.02039 Description The issue is related to the mishandling of pathnames by the software, allowing local user...