CVE-2012-0803

The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request...

CVE-2012-0803: Improper Authentication

The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request...

NIST Releases New Digital Identity Guidelines

The National Institute of Standards and Technology NIST has released the Digital Identity Guidelines document suite. The four-volume suite offers technical guidelines for organizations that use digital identity services. US-CERT encourages information security practitioners in industry, governmen...

CVE-2017-9306

inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of an "svg/onload=" substring instead of an "svg onload=" substring...

CVE-2017-9306: Improper Neutralization of Input During Web Page Generation

inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of an "...

rioclaro.sp.gov.br XSS vulnerability

Vulnerable URL: http://www.rioclaro.sp.gov.br/busca/index.php?txtBusca=%22%3E%3Csvg%2Fonload%3Dprompt%28%2FOPENBUGBOUNTY%2F%29%3E=0=0 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

Dup Scout Enterprise 9.5.14 Buffer Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Dup Scout Enterprise GET Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow vulnerability ...

Threat Outbreak Alert RuleID29057: Email Messages Distributing Malicious Software on May 11, 2017

Medium Alert ID: 53794 First Published: 2017 May 11 15:08 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29057 may contain the following files: Name | Size...

PT-2017-8705

Name of the Vulnerable Software and Affected Versions Symantec Advanced Threat Protection: Network ATP affected versions not specified Symantec Email Security.Cloud affected versions not specified Symantec Data Center Security: Server affected versions not specified Symantec Endpoint Protection S...

CVE-2017-6606

A vulnerability in a startup script of Cisco IOS XE Software could allow an unauthenticated attacker with physical access to the targeted system to execute arbitrary commands on the underlying operating system with the privileges of the root user. More Information: CSCuz06639 CSCuz42122. Known...

How to Deploy and Troubleshoot ADC as a SAML IdP or SP

SAML is an authentication method which allows the Client to authenticate to a trusted third party before accessing protected resources. For a SAML setup, the authenticating party is called the Identity Provider IdP and the resource that the user is trying to access is called the Service Provider...

CVE-2017-5999

An issue was discovered in sysPass 2.x before 2.1, in which an algorithm was never sufficiently reviewed by cryptographers. The fact that inc/SP/Core/Crypt.class is using the MCRYPTRIJNDAEL256 function the 256-bit block version of Rijndael, not AES instead of MCRYPTRIJNDAEL128 real AES could help...

CVE-2017-5999: Inadequate Encryption Strength

An issue was discovered in sysPass 2.x before 2.1, in which an algorithm was never sufficiently reviewed by cryptographers. The fact that inc/SP/Core/Crypt.class is using the MCRYPTRIJNDAEL256 function the 256-bit block version of Rijndael, not AES instead of MCRYPTRIJNDAEL128 real AES could help...

aguai.sp.gov.br XSS vulnerability

Vulnerable URL: http://www.aguai.sp.gov.br/home/noticias.php?id=566%27%27%27%27=%27%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 14:07 GMT Vulnerability type:| XSS Vulnerability status:|...

Reliability Rollup 3179930 for the .NET Framework 4.5.2 on Windows Vista SP2, Windows 7 SP1, Windows Server 2008 SP2, and Windows Server 2008 R2 SP1

Reliability Rollup 3179930 for the .NET Framework 4.5.2 on Windows Vista SP2, Windows 7 SP1, Windows Server 2008 SP2, and Windows Server 2008 R2 SP1 This article describes the reliability rollup 3179930 for the Microsoft .NET Framework on Windows Vista Service Pack 2 SP2, Windows 7 SP1, Windows...

NIST Calls for Submissions to Secure Data Against Quantum Computing

For a layman, it may be difficult to fathom how a standards body could be playing catch-up to a threat that could be at least a decade away. But that’s the position NIST finds itself in with the risk that quantum computers pose to existing cryptographic algorithms. Working, practical quantum...

UBUNTU-CVE-2016-7506

An out-of-bounds read vulnerability was observed in Spreplaceregexp function of Artifex Software, Inc. MuJS before 5000749f5afe3b956fc916e407309de840997f4a. A successful exploitation of this issue can lead to code execution or denial of service condition...

PT-2016-7354

Name of the Vulnerable Software and Affected Versions MuJS versions prior to 5000749f5afe3b956fc916e407309de840997f4a Description An out-of-bounds read issue was found in the Sp replace regexp function, potentially leading to code execution or a denial of service condition. Recommendations For...

Design/Logic Flaw

The 1 SCTCREFRESHEXPORTTABCOMP, 2 SCTCREFRESHCHECKENV, and 3 SCTCTMSMAINTAINALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote authenticated users with certain permissions to execute arbitrary commands via vectors involving a CALL 'SYSTEM' statement, aka SAP Security...

CVE-2016-7435: Undefined Security Weakness

The 1 SCTCREFRESHEXPORTTABCOMP, 2 SCTCREFRESHCHECKENV, and 3 SCTCTMSMAINTAINALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote authenticated users with certain permissions to execute arbitrary commands via vectors involving a CALL 'SYSTEM' statement, aka SAP Security...