Gratipay: Saying goodbye to HackerOne and Gratipay.

Thank you, HackerOne I would like to make this the final report to Gratipay and thank everyone that was involved in this amazing journey. Gratipay is shutting down at the end of the year https://gratipay.news/the-end-cbfba8f50981 and to finish on a happy note we closed all of our reports as...

PT-2017-4315

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.29.1 Description: The issue is related to integer-overflow protection in the print gnu property note function. This allows remote attackers to cause a denial of service, potentially leading to a segmentation violation a...

Oracle Linux 6 / 7 : java-1.8.0-openjdk (ELSA-2017-2998)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2998 advisory. 1:1.8.0.151-1.b12 - repack policies adapted to new counts and paths - note that also c-j-c is needed to make this apply in next update - Resolves:...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6355. Reason: This candidate is a duplicate of CVE-2014-6355. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2014-6355 instead of this candidate. All references and descriptions in this...

CVE-2017-15296

The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964...

CVE-2017-15295

Xpress Server in SAP POS does not require authentication for read/write/delete file access. This is SAP Security Note 2520064...

CVE-2017-15297

SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993...

CVE-2017-15296

The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964...

CVE-2017-15297

SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993...

CVE-2017-15293

Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal read operations, or certain attacks on credentials. This is SAP Security Note 2520064...

Cross site request forgery (csrf)

The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964...

Design/Logic Flaw

The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964...

Authentication flaw

SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993...

CVE-2017-15294

The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964...

CVE-2017-15293

Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal read operations, or certain attacks on credentials. This is SAP Security Note 2520064...

CVE-2017-15294

The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964...

CVE-2017-15294

The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964...

CVE-2017-15295

Xpress Server in SAP POS does not require authentication for read/write/delete file access. This is SAP Security Note 2520064...

CVE-2017-15296

The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964...

CVE-2017-15297

SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint. This is SAP Security Note 2442993...