CVE-2018-1802

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege user full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 149640...

Multiple vulnerabilities in Calsos CSDX and CSDJ series products

Overview Calsos CSDX and CSDJ series products provided by NEC Platforms, Ltd. contain multiple vulnerabilities listed below. Access Restriction Bypass CWE-284 - CVE-2018-0613 Cross-site scripting CWE-79 - CVE-2018-0614 NEC Platforms, Ltd. reported this vulnerability to JPCERT/CC to notify users o...

Exploit for Incorrect Privilege Assignment in Redhat Gluster_Storage

GEVAUDAN Gluster Environment Vulnerable AUthentication Data A...

Cloud Credentials: New Attack Surface for Old Problem

SAN FRANCISCO – Credential theft and abuse have long been a nagging problem for local network administrators. The threat surface ranges from pretexting scams to insiders who abuse network privileges in order to grant themselves higher permissions than otherwise assigned. Here at RSA Conference,...

Integrate Your Ticketing System into Database Security to Prevent DBA Privilege Abuse

Many of the recent high-profile data security breaches were made by trusted insiders. They are often database administrators DBAs who are highly privileged and trusted insiders with access to sensitive data. In this blog post, I will discuss the inherent risk introduced by highly privileged...

UBUNTU-CVE-2017-3465

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Privileges. Supported versions that are affected are 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL...

Telecom's Campus Network Common Management Platform Has Overstepping Vulnerabilities

Telecom Campus Network Common Management Platform is a set of telecom campus network of China Telecom Group Corporation serving colleges and universities. An override vulnerability exists in the Telecom Campus Network Common Management Platform. The system fails to correctly verify user privilege...

Multiple Command Injection Vulnerabilities in SAP Netweaver

SAP NetWeaver is an integrated application platform based on professional standards that significantly reduces the complexity of system integration. 1 Command injection exists in SCTCREFRESHCHECKENV in SAP Netweaver version 7.40 SP 12. When this SCTCREFRESHCHECKENV function fails to perform clean...

Oracle MySQL for Microsoft Windows FILE Privilege Abuse Exploit

Exploit for windows platform in category remote exploits Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Oracle MySQL for Microsoft Windows FILE Privilege Abuse', 'Description' = %q This module takes advantage of a file privilege misconfigurati...

Oracle MySQL (Windows) - FILE Privilege Abuse (Metasploit)

Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Oracle MySQL for Microsoft Windows FILE Privilege Abuse', 'Description' = %q This module takes advantage of a file privilege misconfiguration problem specifically against Windows MySQL servers. Th...

Gentoo Security Advisory GLSA 200410-22 (MySQL)

The remote host is missing updates announced in advisory GLSA 200410-22. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200410-22 (MySQL)

The remote host is missing updates announced in advisory GLSA 200410-22. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...