DEBIAN-CVE-2018-3719

mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data MAID vulnerability, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects...

Apple Mac OS X Security Updates (HT208849)-03

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 28 Update: nodejs-mixin-deep-1.3.1-1.fc28

Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone...

Apache Impala Information Disclosure Vulnerability (CNVD-2018-10329)

Apache Impala incubating is a large-scale, distributed parallel processing database query system of the United States Apache Apache Software Foundation. The system is able to query the Hadoop big data analytics software stored in HDFS distributed file system and HBase database in the petabytes of...

A look into Drupalgeddon’s client-side attacks

Drupal is one of the most popular Content Management Systems CMS, along with WordPress and Joomla. In late March 2018, Drupal was affected by a major remote code execution vulnerability CVE-2018-7600 followed by yet another CVE-2018-7602 almost a month later, both aptly nicknamed Drupalgeddon 2 a...

SAP MaxDB Data Link Properties Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP MaxDB. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of UDL fil...

php: Use-after-free vulnerability when resizing the 'properties' hash table of a serialized object

In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-free. A remote attacker may exploit this bug to gain arbitrary code execution...

Microsoft Windows 10: Create a pagefile

This policy setting determines which users can create and change the size of a page file. It determines whether users can specify a page file size for a particular drive in the Performance Options box located on the Advanced tab of the System Properties dialog box or through using internal...

moveindubai.com XSS vulnerability

Open Bug Bounty ID: OBB-606304 Description| Value ---|--- Affected Website:| moveindubai.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Microsoft Edge CSS Custom Property Type Confusion Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Edge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Microsoft Office: Turn on privacy setting in Office Telemetry Agent

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013privacysettingofficetelemetryagent.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Turn on privacy setting in Office Telemetry Agent Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Microsoft Office: Encrypt document properties

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013encryptdocumentproperties.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Encrypt document properties Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This...

CVE-2014-1398

The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on comment, user and node statistics properties via unspecified vectors...

Authentication flaw

RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list ACL permissions on a Windows Named Pipe were not sufficient to prevent access by unauthorized users. The attacker with local access to the system can exploit this vulnerability to...

Microsoft Edge CSS var Function Type Confusion Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Edge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

vDisk Lost Properties in PVS Console

vDisk lost properties in PVS consoleafter move vDisk to individual file server with MS DFS enabled,vDisk is shown as No server and filesize can not be identified...

openstack-nova: Nova Filter Scheduler bypass through rebuild action

By rebuilding an instance using a new image, an authenticated user may be able to circumvent the Filter Scheduler, bypassing imposed filters for example, the ImagePropertiesFilter or the IsolatedHostsFilter...

Microsoft Edge CSS var Function Type Confusion Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Edge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Cross site scripting

DISPUTED Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages - Edit template properties - Device Layouts -...

CVE-2018-7205

Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages - Edit template properties - Device Layouts - Create devic...