7663 matches found
WordPress Plugin Quiz And Survey Master (Formerly Quiz Master Next) Multiple Vulnerabilities
Vulnerability A CSRF vulnerability allows an unauthenticated attacker to add questions to existing quizzes. The questionname parameter is put into a manually-constructed JavaScript object and escaped with escjs php/qmnoptionsquestionstab.php line 499. If the user or attacker creates a new questio...
Error: "Personal vDisk Inventory Is Not Up To Date. Update the Inventory in the Master Image, And Then Try Again" In Studio
New deployed target device shows "Personal vDisk inventory is not up to date. Update the inventory in the master image, and then try again." in studio...
SQL Injection Vulnerability in Cache Master Web Appliance
Cache Master is able to optimize caching for web videos including mobile videos, as well as smart caching for http downloads of web pages and web images. A SQL injection vulnerability exists in the Cache Master web appliance. An attacker can use this vulnerability to log into the backend of a...
CVE-2017-7391
A Cross-Site Scripting XSS was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data prefix passed to the 'magmi-git-master/magmi/web/ajaxgettime.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of...
CVE-2017-7386
citymont/symetrie v.0.9.6 is vulnerable to a reflected XSS in symetrie-master/app/commands/page.php model parameter...
New Clues Surface on Shamoon 2's Destructive Behavior
Researchers on Monday reported progress in piecing together some of the missing pieces of the Shamoon 2 puzzle that have been eluding them when it comes to lateral network movement and execution of the Disttrack malware component used in past campaigns. Shamoon 2 uses a combination of legitimate...
wireshark security and bug fix update
1.8.10-25.0.1 - Fix ocfs2 dissector John Haxby orabug 21505640 - Add oracle-ocfs2-network.patch to allow disassembly of OCFS2 interconnect 1.8.10-25 - rebuilt 1.8.10-24 - Related: 1245887 - segfault with CVE-2013-4075 capture - valgrind error with CVE-2015-3812 capture 1.8.10-23 - Resolves: 12381...
CVE-2017-6907
An issue was discovered in Open.GL before 2017-03-13. The vulnerability exists due to insufficient filtration of user-supplied data content passed to the "Open.GL-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website...
Error: "Unable to connect server" when connecting XenCenter to a Pool Master
Cannot connect to Pool Master by using XenCenter. XenCenter gives anerror message: Unable to connect to server '10.90.206.83'. Could not find XenServer on '10.90.206.83'. Check that XenServer is configured correctly on '10.90.206.83 and try again. However, Pool Master is accessible by SSH. The...
CVE-2016-9315
Privilege Escalation Vulnerability in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance IWSVA version 6.5-SP2BuildLinux1707 and earlier allows authenticated, remote users with least privileges to change Master Admin's password and/or ad...
CVE-2016-9315
CVE-2016-9315 affects Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 and earlier. The issue is a privilege-escalation in the com.trend.iwss.gui.servlet.updateaccountadministration servlet, where an authenticated, low-privilege user can change the Master Admin password or add new...
CVE-2016-6173
NSD before 4.1.11 allows remote DNS master servers to cause a denial of service /tmp disk consumption and slave server crash via a zone transfer with unlimited data...
Code injection
NSD before 4.1.11 allows remote DNS master servers to cause a denial of service /tmp disk consumption and slave server crash via a zone transfer with unlimited data...
Information Disclosure
OpenSSL is vulnerable to decryption oracle attacks. A malicious user on the network can use the server as an oracle to determine the SSLv2 master key...
Followers Master for IG Prank - Dangerous filesystem permissions, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Followers Master for IG Prank published at the 'play' market has multiple vulnerabilities...
CVE-2017-2611
Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes SECURITY-389. The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes that a...
CVE-2017-5599
An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a reflected Cross Site Scripting vulnerability which affects the raceMasterList.jsp page within the Patient Portal. Inserted payload is rendered within the Patient Portal and the raceMasterList.jsp page does not requir...
New Relic: Restricted User can view multiple account details including customer_root_account_id, payment method, date of first payment, etc.
Summary When a restricted user visits this URL: There is a request sent to this URL: https://www.staging-bam.nr-data.net. Within that request leaks the following information about the entire account, that the restricted user can view:...
Insecure NAS Device Exposes 350 Ameriprise Investment Accounts
A trove of data belonging to Ameriprise Financial was found earlier this month that included Social Security numbers, decryption keys and confidential internal company documents. The breach is related to the use of a network attacked storage device that insecurely backed up data from an internal...
WordPress Quiz And Survey Master 4.7.8 / 4.5.4 XSS / CSRF Vulnerabilities
WordPress Quiz and Survey Master versions 4.5.4 and 4.7.8 suffer from cross site request forgery and cross site scripting vulnerabilities. Details ================ Software: Quiz And Survey Master Formerly Quiz Master Next Version: 4.5.4,4.7.8 Homepage:...