Security Bulletin: Cross Site Scripting (XSS) vulnerability affects Cognos Analytics

Summary Cognos Analytics is vulnerable to a XSS attack when executing a report. Vulnerability Details CVEID: CVE-2016-3032 DESCRIPTION: IBM Cognos Analytics is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

Drupal Cloud Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Services is one of the modules that allows users to programmatically create customized Web service items. A cross-site request forgery vulnerability exists in Drupal's Cloud module. An...

Reverb.com: Items bought for free due to lacks of quantity controls

Hi, The server fails to check the quantity of the items that are going to be sell. Values = 0 are accepted as 1. PoC: Go here https://sandbox.reverb.com/fr/item/139897-fender-2-strap-leather-test-2018-leather Intercept the response after clicking "Add to cart" and put "quantity: 0" F302179 Procee...

HackerOne: Hacktivity of a private program visible to banned user if he gets invited to a program by hackbot

Summary: The hacktivity of a private program is visible to banned user if he gets invited to a program by hackbot. Description: Back in 2016 i was banned by █████'s private program ███ due to some conflict between me and their security team, i think they manually put me in banned users list, but...

[SECURITY] Fedora 26 Update: xdg-utils-1.1.3-1.fc26

The xdg-utils package is a set of simple scripts that provide basic desktop integration functions for any Free Desktop, such as Linux. They are intended to provide a set of defacto standards. This means that: Third party software developers can rely on these xdg-utils for all of their simple...

Securing the Hybrid Cloud: A Guide to Using Security Controls, Tools and Automation

When a bank recently created a consumer mobile wallet, it built the entire project -- from development to deployment -- in the cloud, an increasingly common decision among enterprises. A less common step taken by this multinational bank and Qualys customer was incorporating the security team from...

DRUPAL-CONTRIB-2018-018

This module helps in exporting and importing Menu Items via the administrative interface. The module does not properly restrict access to administrative pages, allowing anonymous users to export and import menu links. There is no mitigation for this vulnerability...

CVE-2017-2599

Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items e.g. jobs to overwrite existing items they don't have access to SECURITY-321...

Design/Logic Flaw

Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items e.g. jobs to overwrite existing items they don't have access to SECURITY-321...

PT-2018-7126 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 2.44 Jenkins versions prior to 2.32.2 Description: The issue is related to an insufficient permission check, allowing users with permissions to create new items, such as jobs, to overwrite existing items they do not...

DEBIAN-CVE-2018-1000127

memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:itemfree that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service...

How to Fix a Mac That’s Running Slow

Every device sooner or later begins to run slower and slower. Even the Mac, which is a highly-efficient Apple product, starts to slow down and becomes a real pain to use over time. If you are a heavy Mac user this is especially true and you are more likely to experience performance issues. There...

TeamPass items.series.php Access Control Vulnerability

TeamPass is a dedicated password manager for Apache, MySQL and PHP. An access control vulnerability exists in versions prior to TeamPass 2.1.27.9 that stems from the program failing to properly enforce item access control. An attacker can exploit the vulnerability by tampering with requests to...

Feds Seize Over 20,500 Domain Names For Selling Counterfeit Products

In a coordinated International cyber operation, law enforcement agencies have seized over 20,520 website domains for illegally selling counterfeit products, including luxury products, sportswear, electronics, pharmaceuticals and online piracy on e-commerce platforms and social networks...

OSXAuditor - Free Mac OS X Computer Forensics Tool

OS X Auditor is a free Mac OS X computer forensics tool. OS X Auditor parses and hashes the following artifacts on the running system or a copy of a system you want to analyze: the kernel extensions the system agents and daemons the third party's agents and daemons the old and deprecated system a...

Threat Outbreak Alert RuleID30124: Email Messages Distributing Malicious Software on August 7, 2017

Medium Alert ID: 54778 First Published: 2017 August 7 19:28 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30124 may contain the following files: Name | Si...

Vik Rent Items 1.3 and previous

Vik Rent Items 1.3 and previous SQL injection Resolution:update to version 1.4 Update notice: https://extensionsforjoomla.com/blog/12-updates/46-security-notices-sql-injection-reports...

Windows 10 + Citrix Profile Management : Start Menu Unable to Retain Pinned Items and Becomes Unresponsive

After installing Win10 and Citrix Profile Management 5.x you may notice that the Start menu cannot retain pinned items after restart and sometimes it may not even launch...

How Do I Set Up Automatic Client Machine Clean Up on NetScaler Gateway?

This article describes how to set up automatic client machine clean up on NetScaler Gateway. Background This article will allow a NetScaler administrator to force clean-up when an user closes a session. You can specify all, none, or any combination of the client-side items. These items are: Cooki...

CVE-2016-6335

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php...