CVE-2017-3508

Vulnerability in the Primavera Gateway component of Oracle Primavera Products Suite subcomponent: Primavera Desktop Integration. Supported versions that are affected are 1.0, 1.1, 14.2, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows high privileged attacker with network acce...

CVE-2017-3548

The CVE-2017-3548 issue affects Oracle PeopleSoft Enterprise PeopleTools (subcomponent Integration Broker) with affected versions 8.54 and 8.55. It is an XML External Entity (XXE) vulnerability in the PeopleSoftServiceListeningConnector that allows an unauthenticated remote attacker, over HTTP, t...

EUVD-2017-12668

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Integration Broker. Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2017-3548

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Integration Broker. Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2016-4459

Stack-based buffer overflow in native/modmanager/node.c in modcluster 1.2.9...

Scheduler Workbench Integration - Critical - Unsupported - SA-CONTRIB-2017-39

Updates 20170414 - A new module maintainer has been found and a new release for this module has been published. Provides integration between the Scheduler module and the Workbench Moderation module. The security team is marking this module unsupported. There is a known security issue with the...

Microsoft Windows Monthly Rollup (KB4015551)

This host is missing a monthly rollup according to Microsoft KB4015551. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Kong and Wallarm Partner Up to Boost Microservices API Security

Wallarm has partnered with Mashape to provide the microservices community with API security. Mashape enterprise customers who use Kong API gateway can now quickly add API security protection without change in Kong user’s deployment. Read more about Kong and Wallarm partnership in this blog. Today...

CSRF in Facebook/Dropbox - "Mallory added a file using Dropbox"

tl;dr Facebook Groups offers the option to upload files directly from the Dropbox account. This integration is done using the OAuth 2.0 protocol and suffered from a variant of the classic OAuth CSRF defined by Egor Homakov as the the Most Common OAuth2 Vulnerability, see video below: Introduction...

Harvest: Client can redirect payment, causing payment discrepancy between Harvest and PayPal

Vulnerability details When a client views an invoice through the web interface, it'll show a "Pay with PayPal" button when a standard PayPal integration has been enabled. Clicking this button will submit a POST request to PayPal. This request contains a business parameter, which is the receiver o...

CVE-2017-4964

Cloud Foundry Foundation BOSH Azure CPI v22 could potentially allow a maliciously crafted stemcell to execute arbitrary code on VMs created by the director, aka a "CPI code injection vulnerability."...

Rapid7 Nexpose in 2017

Last year I tested Rapid7 Nexpose and wrote two posts about installation and use of Nexpose Community Edition and Nexpose API. I didn't follow news of this vendor for a about year. Today I watched live demo of Nexpose latest version. It has some new interesting features, improvements and ideas,...

[SECURITY] Fedora 26 Update: rkward-0.6.5-5.fc26

RKWard aims to provide an easily extensible, easy to use IDE/GUI for the R-project. RKWard tries to combine the power of the R-language with the relative ease of use of commercial statistics tools. Long term plans include integration with office suites...

The vulnerability of the Windows operating system allows a perpetrator to obtain information about the integration platform and the operating system.

The vulnerability of the Windows operating system exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor, operating remotely, to obtain information about the integration platform and the operating system through a...

Dropbox: CSV Injection with the CVS export feature

The report mentions a well known problem with any CSV export function. If the exported data has an Excel formula, the user will be warned and if the user clicks through a warning they might get some code execution. At the same time, fixing this bug means that the CSV data is no longer correct and...

How to Configure NetScaler as IDP for SAML Based Integration with 15Five

This article describes how to configure NetScaler as an Identity Service Provider IDP for 15Five SaaS applications, using SAML Security Assertion Markup Language protocol. Introduction 15Five is a company that provides performance management platform that combines employee feedback, objectives...

File Upload in Integration Gateway (PSIGW) - PeopleSoft

Application: Oracle PeopleSoft Versions Affected: PeopleTools 8.54, 8.55 Vendor: Oracle Bugs: File Upload Reported: 27.03.2017 Vendor response: 28.03.2017 Date of Public Advisory: 18.07.2017 Reference: Oracle CPU July 2017 Authors: Roman Shalymov ERPScan VULNERABILITY INFORMATION Class: File Uplo...

Joomla! Component JooCart 2.x - 'product_id' Parameter SQL Injection

Exploit Title: Joomla! Component JooCart Joomla OpenCart Integration v2.x - SQL Injection Google Dork: N/A Date: 20.03.2017 Vendor Homepage: http://soft-php.com Software: https://www.opencart.com/index.php?route=marketplace/extension/info&extensionid=4478 Demo: http://demo.soft-php.com Version: 2...

IBM Integration Bus Detection (Windows SMB Login)

Detects the installed version of IBM Integration Bus. The script logs in via smb, searches for SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

[SECURITY] Fedora 25 Update: rkward-0.6.5-5.fc25

RKWard aims to provide an easily extensible, easy to use IDE/GUI for the R-project. RKWard tries to combine the power of the R-language with the relative ease of use of commercial statistics tools. Long term plans include integration with office suites...