CVE-2018-19329

GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...

CVE-2018-19329: Improper Limitation of a Pathname to a Restricted Directory

GreenCMS v2.3.0603 allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an m=admin&c=media&a=delfilehandle&id= call, related to the m=admin&c=media&a=restorefile delete button...

PT-2018-14919

Name of the Vulnerable Software and Affected Versions GreenCMS version 2.3.0603 Description The issue allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an "m=admin&c=media&a=delfilehandle&id=" call. This is related to the delete button ...

PT-2018-14915

Name of the Vulnerable Software and Affected Versions SRCMS version 3.0.0 Description The issue allows for a CSRF attack via the "admin.php?m=Admin&c=gifts&a=update" API endpoint to change goods prices with the privileges of a super administrator. Recommendations For SRCMS version 3.0.0, as a...

PT-2018-14914

Name of the Vulnerable Software and Affected Versions SRCMS version 3.0.0 Description The issue allows for a CSRF attack via the "admin.php?m=Admin&c=manager&a=update" endpoint to change the username and password of the super administrator account. Recommendations For SRCMS version 3.0.0, update ...

UBUNTU-CVE-2018-19216

Netwide Assembler NASM before 2.13.02 has a use-after-free in detoken at asm/preproc.c...

Path Traversal

Overview Versions of m-server before 1.4.2 are vulnerable to path traversal allowing a remote attacker to display content of arbitrary files from the server. Recommendation Update to version 1.4.2 or later. References - HackerOne Report - Node.js security-wg - GitHub Advisory...

Cross-Site Scripting

Overview Versions of m-server before 1.4.2 are vulnerable to stored cross-site scripting. This vulnerability is exploitable if an attacker is able to control the name of a file that m-server is serving. Recommendation Update to version 1.4.2 or later. References - HackerOne Report - Node.js...

CVE-2018-18939: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field...

m.11street.my Open Redirect vulnerability

Open Bug Bounty ID: OBB-694157 Description| Value ---|--- Affected Website:| m.11street.my Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| hidden until...

Cybersecurity and Class M Planets

I was considering another debate about appropriate cybersecurity measures and I had the following thought: not all networks are the same. Profound, right? This is so obvious, yet so obviously forgotten. Too often when confronting a proposed defensive measure, an audience approaches the concept fr...

CVE-2018-18711: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=editinfo...

CVE-2018-18622: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Waimai Super Cms 20150505. There is XSS via the index.php?m=public&a=doregister username parameter...

The Titan M Chip Powers Up Pixel 3 Security

Google's latest flagship smartphone includes the Titan M, a security-focused chip that keeps users safe against sophisticated attacks...

gold-m XSS vulnerability

Open Bug Bounty ID: OBB-685174 Description| Value ---|--- Affected Website:| gold-m Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-18191: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password...

Fedora Update for visualboyadvance-m FEDORA-2018-34fac89d51

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 28 Update: visualboyadvance-m-2.1.0-2.fc28

VisualBoyAdvance-M is a Nintendo Game Boy Emulator with high compatibility with commercial games. It emulates the Nintendo Game Boy Advance hand held conso le, in addition to the original Game Boy hand held systems and its Super and Co lor variants. VBA-M is a continued development of the now...

Fedora Update for visualboyadvance-m FEDORA-2018-9fc46b45ab

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 27 : visualboyadvance-m (2018-34fac89d51)

Fixed 2.1.0 update, includes security fixes and added performance fix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...