PT-2017-11554

Name of the Vulnerable Software and Affected Versions DocuWorks versions 8.0.7 and earlier DocuWorks Viewer Light versions published in Jul 2017 and earlier Description The issue allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This is due to an untrusted...

CVE-2017-10848: Untrusted Search Path

Untrusted search path vulnerability in Installers for DocuWorks 8.0.7 and earlier and DocuWorks Viewer Light published in Jul 2017 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

Fuji Xerox DocuWorks and DocuWorks Viewer Light Untrusted Search Path Vulnerability

Fuji Xerox DocuWorks and DocuWorks Viewer Light are both products of Fuji Xerox Japan.DocuWorks is a document management solution.DocuWorks Viewer Light is a document reader. An untrusted search path vulnerability exists in Fuji Xerox DocuWorks versions 8.0.7 and earlier and DocuWorks Viewer Ligh...

UBUNTU-CVE-2015-8308

LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections...

Friday Squid Blogging: Squid Eyeballs

Details on how a squid's eye corrects for underwater distortion: Spherical lenses, like the squids', usually can't focus the incoming light to one point as it passes through the curved surface, which causes an unclear image. The only way to correct this is by bending each ray of light differently...

Splunk Enterprise and Splunk Light Cross-Site Scripting Vulnerabilities

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze machine-generated data, including data generated by all IT systems and infrastructures physical, virtual, and cloud.Splunk Enterprise is...

CVE-2017-12572

Persistent Cross Site Scripting XSS exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2, with exploitation requiring administrative access, aka SPL-134104...

Cross site scripting

Persistent Cross Site Scripting XSS exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2, with exploitation requiring administrative access, aka SPL-134104...

PT-2017-12583

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 6.3.x through 6.3.8 Splunk Enterprise versions 6.4.x through 6.4.5 Splunk Enterprise versions 6.5.x through 6.5.1 Splunk Light versions 6.5.x through 6.5.1 Description A Persistent Cross Site Scripting XSS issue...

CVE-2017-12572: Improper Neutralization of Input During Web Page Generation

Persistent Cross Site Scripting XSS exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2, with exploitation requiring administrative access, aka SPL-134104...

IJSEO, 3.1.17, SQL Injection

IJSEO from IJoomla, 3.1.17, SQL Injection Resolution: update to 3.1.18 Update notice: https://seo.ijoomla.com/blog/entry/joomla-iseo-extension-got-important-security-fix-1-1 The issue affects both the commercial Pro and the non-commercial Light versions of the extension. The developer released a...

netlink.alphasource.com XSS vulnerability

Vulnerable URL: http://netlink.alphasource.com/AL/nlhtml/bin/catalog.php?desckeyword=medical xenon light"'--!...

Pelco Sarix/Spectra Cameras - Remote Code Execution

Schneider Electric Pelco Sarix/Spectra Cameras Root Remote Code Execution Vendor: Schneider Electric SE Product web page: https://www.pelco.com Affected version: Sarix Enhanced - Model: IME219 Firmware: 2.1.2.0.8280-A0.0 Sarix Enhanced - Model: IME119 Firmware: 2.1.2.0.8280-A0.0 Sarix - Model:...

deltalight.com XSS vulnerability

Vulnerable URL: http://deltalight.com/dldfile/download.php?code=%3Csvg/onload=alert/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 246127 VIP website status:| No...

Buffer Overflow Vulnerability in Multiple Stepok Products Processing TGA Files

Stepok Light Developer is a professional photo post-processing tool.Stepok Recomposit is a Chinese version of the photo compositing software.Stepok RAW Importer is a RAW file conversion software, you can convert RAW photos to JPG images, support for opening and converting most of the digital came...

Memory Corruption Vulnerability in Light Developer's Handling of TIFF Format Files

Stepok Light Developer is a professional photo post-processing tool with features that cover most of the needs of photography enthusiasts. A memory corruption vulnerability exists in Light Developer's handling of TIFF format files. An attacker can exploit this vulnerability by constructing a...

Memory Corruption Vulnerability in Light Developer's Handling of BMP Formats

Stepok Light Developer is a professional photo post-processing tool with features that cover most of the needs of photography enthusiasts. Light Developer handles BMP format memory corruption vulnerability, attackers can use the vulnerability to construct deformed BMP files can lead to program...

CVE-2016-4858

Cross-site scripting vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light...

CVE-2016-4857

Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.11 and Splunk Light prior to 6.4.2 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2016-4856

Cross-site scripting vulnerability in Splunk Enterprise 6.3.x prior to 6.3.5 and Splunk Light 6.3.x prior to 6.3.5 allows attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors...