CVE-2016-2202

The CVE-2016-2202 issue affects Symantec ITMS (Inventory Solution component in the Management Agent on the client). The vulnerability allows a local user to bypass the inventory’s application-denial/blacklist functionality, effectively bypassing policy to run unauthorized applications. The root c...

[SECURITY] Fedora 24 Update: glpi-0.90.3-1.fc24

GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...

OCS Inventory NG SQL Injection Vulnerability

OCS Inventory NG Open Computer and Software Inventory Next Generation is a system management software that helps administrators keep track of computer software installations and configurations, and enables low network traffic communication between HTTP proxies and servers. OCS Inventory NG suffer...

Symantec ITMS Inventory Solution Application Denial Functionality Bypass

SUMMARY The Inventory Solution component of Symantecs IT Management Agent, the client portion of Symantec IT Management Suite ITMS powered by Altiris, can be configured to deny one or more applications from running on a windows managed client as part of IT management functions. A determined user...

Movie Collection & Inventory - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Movie Collection & Inventory published at the 'play' market has multiple vulnerabilities...

My Inventory (free) - Dangerous filesystem permissions, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application My Inventory free published at the 'play' market has multiple vulnerabilities...

curtistrailers.com XSS vulnerability

Open Bug Bounty ID: OBB-141282 Description| Value ---|--- Affected Website:| curtistrailers.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

OCS Inventory NG 2.2 - SQL Injection

OCS Inventory NG 2.2 - SQL Injection Exploit Title: OCS Inventory NG /ocsreports/index.php?function=visusearch - Time-based SQL Injection Choose a parameter, use EXACTLY operator: ' union select sleep5; - Code execution Bypass input escape and write to filesystem webshell PoC: ' union select...

OCS Inventory NG 2.2 - SQL Injection

Exploit Title: OCS Inventory NG /ocsreports/index.php?function=visusearch - Time-based SQL Injection Choose a parameter, use EXACTLY operator: ' union select sleep5; - Code execution Bypass input escape and write to filesystem webshell PoC: ' union select CONCATchar60,char63,'php echo...

Design/Logic Flaw

The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware aka Spectrum Protect for Virtual Environments 7.1 before 7.1.4 and Tivoli Storage FlashCopy Manager for VMware aka Spectrum Protect Snapshot 4.1 before 4.1.4 allows...

Top 10 — 2016 New Year's Resolutions for Cyber Security Professionals

Billions of dollars are spent in securing business operations, and yet attackers still find ways to breach a network. With the ever increasing growth in security attacks across all threat vectors, you should consider these New Year’s resolutions to help solve your security challenges in 2016: 1...

Use DHCP Discovery to Implement Critical Security Control #1

The number one critical security control from the Center for Internet Security recommends actively managing all hardware devices on the network: CSC 1: Inventory of Authorized and Unauthorized Devices Actively manage inventory, track, and correct all hardware devices on the network so that only...

Apple iOS/OS X/watchOS Heap Buffer Overflow Vulnerability

OS X formerly Mac OS X is the latest version of Apple's proprietary operating system for the Macintosh computer. iOS is an operating system developed by Apple for mobile devices. Apple iOS versions prior to 9.1, Apple OS X versions prior to 10.11.1, and watchOS versions prior to 2.0.1, DNS client...

cds.library.brown.edu XSS vulnerability

Vulnerable URL: http://cds.library.brown.edu/projects/romanianCharms/inventoryDetailPublic.php?keyword=functions=%27%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 04.08.2016 Latest check for patch:| 04.08.2016 08:25 GMT Vulnerability type:| XSS...

MC Inventory Manager Cross Site Scripting

Vulnerability title: MC Inventory Manager Stored Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Product: MC Inventory Manager Date: 2015/10/13 Vendor Homepage: http://microcode.ws/inventory-manager.php Introduction: ============= Manage and maintain inventory of your company...

MC Inventory Manager SQL Injection

Vulnerability title: MC Inventory Manager Authentication Bypass Exploit Author : Ashiyane Digital Security Team Product: MC Inventory Manager Date: 2015.10.13 Vendor Homepage: http://microcode.ws/inventory-manager.php Introduction: ============= Manage and maintain inventory of your company, item...

GLPI 0.85.5 - Arbitrary File Upload Filter Bypass Remote Code Execution

GLPI 0.85.5 - Arbitrary File Upload Filter Bypass Remote Code Execution Exploit Title: GLPI 0.85.5 RCE through file upload filter bypass Date: September 7th, 2015 Exploit Author: Raffaele Forte Vendor Homepage: http://www.glpi-project.org/ Software Link:...

Webroot SecureAnywhere Mobile Protection - MITM SSL Certificate Vulnerability

Webroot SecureAnywhere Mobile Protection - MITM SSL Certificate Vulnerability -- http://www.info-sec.ca/advisories/Webroot-SecureAnywhere.html Overview "Webroot SecureAnywhere Business – Mobile Protection provides essential security for iPhones and iPads and includes lost device protection that...

OPM Warned About Vulnerabilities, Governance Weaknesses

It’s hardly a surprise that the U.S. Office of Personnel Management OPM was targeted by nation-state hackers, given the sensitivity of the personal information the office stored. It’s also no shocker that OPM has been successfully infiltrated more than once given the state of its information...

Multiple IBM Product Denial of Service Vulnerabilities (CNVD-2015-03496)

IBM manufactures and sells computer hardware and software, and provides consulting services for systems architecture and web hosting. Common Inventory Technology CIT versions prior to 2.7.0.2050 are used in IBM License Metric Tool versions 7.2.2, 7.5 and 9, Endpoint Manger for Software Use Analys...