job-mo.ru XSS vulnerability

Open Bug Bounty ID: OBB-638981 Description| Value ---|--- Affected Website:| job-mo.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Pspy - Monitor Linux Processes Without Root Permissions

pspy is a command line tool designed to snoop on processes without need for root permissions. It allows you to see commands run by other users, cron jobs, etc. as they execute. Great for enumeration of Linux systems in CTFs. Also great to demonstrate your colleagues why passing secrets as argumen...

A week in security (June 18 – June 24)

Last week, we took a deep dive into SamSam ransomware, looked at ways how to identify and delete malicious emails, recognized that there are now risks affecting job recruitment portals, analyzed a malicious Android app banking on the popularity of Fortnite, and identified causes and solutions for...

ansible-tower: Remote code execution by users with access to define variables in job templates

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server...

AWS CodeBuild Plugin stored AWS Secret Key in plain text

AWS CodeBuild Plugin stored the AWS Secret Key in its configuration unencrypted in jobs' config.xml files on the Jenkins controller. This key could be viewed by users with Extended Read permission, or access to the Jenkins controller file system. While masked from view using a password form field...

jira.job-flex.com XSS vulnerability

Open Bug Bounty ID: OBB-635997 Description| Value ---|--- Affected Website:| jira.job-flex.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Reliable Controls MACH-ProWebCom Information Disclosure Vulnerability

The Reliable Controls MACH-ProWebCom is a building controller from Canada's Reliable Controls that supports custom programming and has a built-in web server. A security vulnerability exists in Reliable Controls MACH-ProWebCom version 7.80. A remote attacker can exploit the vulnerability by sendin...

Default credentials

Reliable Controls MACH-ProWebCom 7.80 devices allow remote attackers to obtain sensitive information via a direct request for the data/fileinfo.xml or job/job.json file, as demonstrated the Master Password field...

CVE-2018-12594

Reliable Controls MACH-ProWebCom 7.80 devices allow remote attackers to obtain sensitive information via a direct request for the data/fileinfo.xml or job/job.json file, as demonstrated the Master Password field...

CVE-2018-12594: Exposure of Sensitive Information to an Unauthorized Actor

Reliable Controls MACH-ProWebCom 7.80 devices allow remote attackers to obtain sensitive information via a direct request for the data/fileinfo.xml or job/job.json file, as demonstrated the Master Password field...

PT-2018-11279

Name of the Vulnerable Software and Affected Versions MACH-ProWebCom version 7.80 Description The issue allows remote attackers to obtain sensitive information by making a direct request for specific files, such as data/fileinfo.xml or job/job.json, which can expose the Master Password field...

PT-2018-11268

Name of the Vulnerable Software and Affected Versions AKCMS version 6.1 Description An issue was discovered that allows CSRF to add an admin account via the "/index.php?file=account&action=manageaccounts&job=newaccount" API endpoint. Recommendations For AKCMS version 6.1, consider disabling the...

[SECURITY] Fedora 27 Update: slurm-17.02.11-1.fc27

Slurm is an open source, fault-tolerant, and highly scalable cluster management and job scheduling system for large and small Linux clusters...

[SECURITY] Fedora 28 Update: slurm-17.11.7-1.fc28

Slurm is an open source, fault-tolerant, and highly scalable cluster management and job scheduling system for Linux clusters. Components include machine status, partition management, job management, scheduling and accounting modules...

Adobe Issues Patch for Actively Exploited Flash Player Zero-Day Exploit

If you have already uninstalled Flash player, well done! But if you haven't, here's another great reason for ditching it. Adobe has released a security patch update for a critical vulnerability in its Flash Player software that is actively being exploited in the wild by hackers in targeted attack...

Debian DLA-1387-1 : cups security update

CVE-2017-18248 It was found that by submitting a print job with an invalid username, the CUPS server can be crashed, when D-Bus support is enabled which is the case for Debian. For Debian 7 'Wheezy', these problems have been fixed in version 1.5.3-5+deb7u8. We recommend that you upgrade your cups...

datak.ir XSS vulnerability

Open Bug Bounty ID: OBB-623410 Description| Value ---|--- Affected Website:| datak.ir Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Debian: Security Advisory (DLA-1387-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1387-1] cups security update

Package : cups Version : 1.5.3-5+deb7u8 CVE ID : CVE-2017-18248 CVE-2017-18248 It was found that by submitting a print job with an invalid username, the CUPS server can be crashed, when D-Bus support is enabled which is the case for Debian. For Debian 7 "Wheezy", these problems have been fixed in...

CVE-2017-2601: Improper Neutralization of Input During Web Page Generation

Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions SECURITY-353. Users with the permission to configure jobs were able to inject JavaScript into parameter names and descriptions...