PT-2020-8650

Name of the Vulnerable Software and Affected Versions: Fleetco Fleet Maintenance Management FMM versions 1.2 and earlier Description: The issue allows uploading an arbitrary ".php" file with the application/x-php Content-Type to the "accidents add.php?submit=1" URI, as demonstrated by the value...

CVE-2018-19798: Unrestricted Upload of File with Dangerous Type

Fleetco Fleet Maintenance Management FMM 1.2 and earlier allows uploading an arbitrary ".php" file with the application/x-php Content-Type to the accidentsadd.php?submit=1 URI, as demonstrated by the valueImages1 field, which leads to remote command execution on the remote server. Any authenticat...

(RHSA-2020:0638) Low: Red Hat Satellite Proxy 5 - 90 day End Of Life Notice

After May 31, 2020, as per the life-cycle support policy for Red Hat Satellite Proxy, Red Hat will discontinue technical support services as well as software maintenance services for all Red Hat Satellite and Proxy versions 5.8 or older on Red Hat Enterprise Linux 6. The listed versions will exit...

(RHSA-2020:0637) Low: Red Hat Satellite 5 - 90 day End Of Life Notice

After May 31, 2020, as per the life-cycle support policy for Red Hat Satellite, Red Hat will discontinue technical support services as well as software maintenance services for all Red Hat Satellite and Proxy versions 5.8 or older on Red Hat Enterprise Linux 6. The listed versions will exit the...

February 25, 2020-KB4537478 Cumulative Update for .NET Framework 4.8 for Windows 10 Version 1709

None None...

Denial Of Service (DoS)

silverstripe/framework is susceptible to denial of service DoS. The attack exists when an authenticated user with administrative privileges are tricked to open maintenance services in the form of URL Variable Tools such as ?flush, ?isDev and ?isTest or development admin urls /dev/...

Security Bulletin: Multiple security vulnerabilities may affect IBM SDK, Java Technology Edition shipped with Predictive Maintenance and Quality

Summary IBM SDK, Java Technology Edition is shipped with IBM Predictive Maintenance and Quality. Information about some security vulnerabilities affecting IBM SDK, Java Technology Edition have been published in their respective security bulletins. Vulnerability Details Refer to the security...

How we productized our staging environment and survived to tell the tale

Managing the Imperva SaaS infrastructure is like herding cats. There are so many moving parts, new developments, testing, fixing bugs, patching, reducing our SLAs, fighting the bad guys and, most importantly, pushing our latest and greatest to production every week. And it all runs like clockwork...

CVE-2020-9028

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, Deletion and Password Maintenance" screen when creating a new user...

CVE-2020-9028

The CVE-2020-9028 entry concerns Symmetricom SyncServer devices (S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, S350 2.80.1) that allow stored XSS via the newUserName parameter on the User Creation, Deletion and Password Maintenance screen when creating a new user. The connected documents con...

CVE-2020-9028: Improper Neutralization of Input During Web Page Generation

Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, Deletion and Password Maintenance" screen when creating a new user...

PT-2020-20443

Name of the Vulnerable Software and Affected Versions Symmetricom SyncServer S100 version 2.90.70.3 Symmetricom SyncServer S200 version 1.30 Symmetricom SyncServer S250 version 1.25 Symmetricom SyncServer S300 version 2.65.0 Symmetricom SyncServer S350 version 2.80.1 Description The issue allows...

Cisco Software Maintenance Update Enumeration

It is possible to enumerate the installed Cisco Software Maintenance Updates on the remote Cisco device using the 'show install active' or 'show version' command. TRUSTED...

USN-4263-2 sudo vulnerability

USN-4263-1 fixed a vulnerability in Sudo. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Joe Vennix discovered that Sudo incorrectly handled memory operations when the pwfeedback option is enabled. A local attacker could possibl...

ASSURE Aviation Cyber Security Testing

We've long been supporters and champions of a formalised approach to Aviation Cyber Security Testing. Our research and blogging has taken us on an interesting journey regarding airside and landside security, mapping attack surfaces and explaining how systems work and interact. Speaking and...

CVE-2019-17651

An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM version 5.2.5 and below may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack XSS by injecting malicious JavaScript code into...

Cross site scripting

An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM version 5.2.5 and below may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack XSS by injecting malicious JavaScript code into...

CVE-2019-17651

An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM version 5.2.5 and below may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack XSS by injecting malicious JavaScript code into...

CVE-2019-17651: Improper Neutralization of Input During Web Page Generation

An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM version 5.2.5 and below may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack XSS by injecting malicious JavaScript code into...

PT-2020-5530

Name of the Vulnerable Software and Affected Versions FortiSIEM versions 5.2.5 and below Description The issue is related to improper neutralization of input in the description and title parameters of a Device Maintenance Schedule. This could allow a remote attacker to conduct a Stored Cross Site...