CVE-2018-9022

An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code or commands by poisoning a configuration file...

CVE-2018-12532

JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language EL variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309...

Security Bulletin: Samba vulnerability issue on SONAS (CVE-2013-4408 and CVE-2012-6105)

Summary An attacker could gain privileged access to SONAS system by exploiting a vulnerability in Samba. Vulnerability Details CVE ID: CVE-2013-4408 and CVE-2012-6105 DESCRIPTION: This issue affects only those SONAS systems that use Active Directory server for authentication. Configuration with...

phpMyAdmin 4.x Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'phpMyAdmin Authenticated Remote Code Execution', 'Description' = %q phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before...

Security Bulletin: Tivoli Usage and Accounting Manager / SmartCloud Cost Management

Summary Tivoli Usage and Accounting Manager / SmartCloud Cost Management bundles WebSphere Application Server. WebSphere Application Server could allow a remote attacker to execute arbitrary code by connecting to a management port and executing a specific sequence of instructions. Vulnerability...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Security Access Manager for Web

Summary OpenSSL vulnerabilities were disclosed on June 11, 2015 by the OpenSSL Project. OpenSSL is used by IBM Security Access Manager for Web. IBM Security Access Manager for Web has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2014-8176 DESCRIPTION: OpenSSL could allow a remo...

Security Bulletin: Cross Site Scripting vulnerability in IBM Directory Server (CVE-2014-6100)

Summary The Directory Server Admin UI is vulnerable to cross site scripting which allows remote execution of scripts due to insufficient input validation of URL parameters. Vulnerability Details CVE-ID: CVE-2014-6100 IBM Security Directory Server is vulnerable to cross-site scripting, caused by...

Security Bulletin: Multiple vulnerabilities in GPFS affects IBM® DB2® LUW on AIX and Linux (CVE-2015-0197, CVE-2015-0198, CVE-2015-0199)

Summary There are multiple vulnerabilities in IBM® General Parallel File System, Versions V3.4 and V3.5 that are used by DB2® pureScale™ Feature on AIX and Linux. Vulnerability Details CVEID: CVE-2015-0197 DESCRIPTION: IBM General Parallel File System could allow a local attacker which only has a...

wixtoolset Remote Code Execution Vulnerability

wixtoolset is a set of tools for building installers for Windows applications. A security vulnerability exists in wixtoolset that originates when the program downloads an executable file over an unencrypted HTTP connection. A remote attacker could exploit the vulnerability by intercepting the...

Slimerjs-edge Remote Code Execution Vulnerability

slimerjs-edge is a scriptable browser for web development and testing. A security vulnerability exists in slimerjs-edge that originates when the program downloads binary resources over the HTTP protocol. A remote attacker could exploit the vulnerability by replacing the requested binary with an...

cmake Remote Code Execution Vulnerability

cmake is a set of open source, cross-platform tools for building, testing and packaging software . A security vulnerability exists in cmake that originates when the program downloads binary resources over the HTTP protocol. A remote attacker could exploit the vulnerability by replacing the...

Restify Cross-Site Scripting Vulnerability

Restify a framework for building REST APIs using Connect middleware . A cross-site scripting vulnerability exists in Restify versions 2.0.0 through 4.0.4. A remote attacker can exploit this vulnerability to execute script in a browser...

serc.js remote code execution vulnerability

serc.js is a Selenium RC Process Wrapper A security vulnerability exists in serc.js, which originates when a program downloads an executable file over an unencrypted HTTP connection. A remote attacker can exploit the vulnerability by intercepting the response and replacing the requested executabl...

Microsoft Windows Media Foundation Memory Corruption Vulnerability

Microsoft Windows 10 and others are a series of operating systems released by Microsoft Corporation in the U.S. Microsoft Windows 10 is a set of operating systems for personal computers.Windows Server 2016 is a set of server operating systems.Media Foundation is one of the Media Foundation is one...

KLA11266 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, cause denial of service, bypass security restrictions, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An elevation...

mysql node module SQL injection vulnerability

The mysql node module is a node.js driver for MySQL written in JavaScript. A SQL injection vulnerability exists in the 'mysql.escape' function in mysql node module version 2.0.0-alpha7 and earlier, which stems from the program's failure to properly encode object keys. A remote attacker can exploi...

Synology DiskStation Manager Command Injection Vulnerability (CNVD-2018-11370)

Synology DiskStation Manager DSM is a set of operating systems for use on networked storage servers NAS from Synology Inc. The operating system can manage information such as data, files, photos, music, etc. EZ-Internet is one of the network configuration tools. A command injection vulnerability...

Microsoft MSDN - Cross Site Request Forgery Vulnerability

Document Title: =============== Microsoft MSDN - Cross Site Request Forgery Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2125 View Video: https://www.youtube.com/watch?v=xgKYZ4u-6lc Release Date: ============= 2018-06-11 Vulnerability Laboratory ID...

Schools Alert Management Script SQL Injection Vulnerability (CNVD-2018-11296)

PHP Scripts Mall Schools Alert Management Script is a school management system script by PHP Scripts Mall India. A SQL injection vulnerability exists in several cgi's in PHP Scripts Mall Schools Alert Management Script. A remote attacker can exploit this vulnerability by sending specially crafted...

[SECURITY] Fedora 27 Update: remctl-3.14-1.fc27

remctl the client and remctld the server implement a client/server protocol for running single commands on a remote host using Kerberos v5 authentication and returning the output. They use a very simple GSS-API-authenticated network protocol, combined with server-side ACL support and a server...