Missing permission check in review coverage REST endpoint - CVE-2017-18035

The /rest/review-coverage-chart/1.0/data//.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistic...

[SECURITY] Fedora 26 Update: awstats-7.6-4.fc26

Advanced Web Statistics is a powerful and featureful tool that generates advanced web server graphic statistics. This server log analyzer works from command line or as a CGI and shows you all information your log contai ns, in graphical web pages. It can analyze a lot of web/wap/proxy servers lik...

[SECURITY] Fedora 27 Update: awstats-7.6-8.fc27

Advanced Web Statistics is a powerful and featureful tool that generates advanced web server graphic statistics. This server log analyzer works from command line or as a CGI and shows you all information your log contai ns, in graphical web pages. It can analyze a lot of web/wap/proxy servers lik...

New Rules Announced for Border Inspection of Electronic Devices

The U.S. Customs and Border Patrol announced new restrictions on when agents can copy data from digital devices at border crossing points. Agents now need “reasonable suspicion” in advance of searches of phones, computers, tablets, cameras or any other digital device belonging to people entering ...

FiberHome LM53Q1 - Multiple Vulnerabilities

Exploit for hardware platform in category web applications !/usr/bin/python Exploit Title: FiberHome MIFI LM53Q1 Multiple Vulnerabilities Exploit Author: Ibad Shah Vendor Homepage: www.fiberhome.com Version: VH519R05C01S38 Tested on: Linux Platform : Hardware CVE : CVE-2017-16885, CVE-2017-16886,...

FiberHome MIFI LM53Q1 Information Disclosure / Password Change

!/usr/bin/python /$$$$$$$$ /$$ /$$ /$$ /$$ /$$$$$$$ /$$ /$$$$$$$$ /$$ /$$ /$$ | $$/|/| $$ | $$ | $$ | $$ $$ | $$ | $$/ | $$ |/ | $$ | $$ /$$| $$$$$$$ /$$$$$$ /$$$$$$ | $$ | $$ /$$$$$$ /$$$$$$/$$$$ /$$$$$$ | $$ \ $$ /$$$$$$ /$$$$$$/$$$$ /$$$$$$ /$$$$$$ /$$$$$$ | $$ /$$ /$$ /$$$$$$ | $$ /$$$$$$ /$$...

BlueMaho v090417 - Bluetooth Security Testing Suite

BlueMaho is GUI-shell interface for suite of tools for testing security of bluetooth devices. It is freeware, opensource, written on python, uses wxPyhon. It can be used for testing BT-devices for known vulnerabilities and major thing to do - testing to find unknown vulns. Also it can form nice...

The State of Web Application Vulnerabilities in 2017

As a web application firewall provider, part of our job at Imperva is constantly monitoring new security vulnerabilities. To do this, we use internal software that collects information from various data sources such as vulnerability databases, newsletters, forums, social media and more, integrate...

Telesquare SKT LTE Router SDT-CS3B1 - Information Disclosure Vulnerability

Exploit for hardware platform in category web applications Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference Info Leak Vendor: Telesquare Co., Ltd. Product web page: http://www.telesquare.co.kr Affected version: FwVer: SDT-CS3B1, sw version 1.2.0 LteVer: ML300S5XEA41090 1 0.1.0...

Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference

Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference Info Leak Vendor: Telesquare Co., Ltd. Product web page: http://www.telesquare.co.kr Affected version: FwVer: SDT-CS3B1, sw version 1.2.0 LteVer: ML300S5XEA41090 1 0.1.0 Modem model: PM-L300S Summary: We introduce SDT-CS3B1 LTE...

Telesquare SKT LTE Router SDT-CS3B1 - Information Disclosure

Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference Info Leak Vendor: Telesquare Co., Ltd. Product web page: http://www.telesquare.co.kr Affected version: FwVer: SDT-CS3B1, sw version 1.2.0 LteVer: ML300S5XEA41090 1 0.1.0 Modem model: PM-L300S Summary: We introduce SDT-CS3B1 LTE...

WordPress Feed-Statistics 4.1 Open Redirect

Title: WordPress feed-statistics Plugin Open Redirect Vulnerability + Date: 2017-12-20 + Author: Mostafa Gharzi + Vendor Homepage: www.WordPress.org + Tested on: Windows 10 & Kali Linux + Vulnerable File: /feed-statistics.php?url= + Vulnerable Parameter: Get Method + Dork :...

[SECURITY] Fedora 26 Update: collectd-5.8.0-2.fc26

collectd is a daemon which collects system performance statistics periodica lly and provides mechanisms to store the values in a variety of ways, for example in RRD files...

Foreman cross-site scripting vulnerability (CNVD-2017-35447)

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A cross-site scripting vulnerability exists in the Facts, Trends, and Statistics pages in Foreman. A...

CVE-2017-15100

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: 1 Facts page, when clicking on the "chart" button and hovering over the chart; 2 Trends page, when checking the graph for a trend based on a such fact; 3 Statistics page, for facts that are...

CVE-2017-15100

An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: 1 Facts page, when clicking on the "chart" button and hovering over the chart; 2 Trends page, when checking the graph for a trend based on a such fact; 3 Statistics page, for facts that are...

PT-2017-13869 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman affected versions not specified Description: The issue allows an attacker to perform a stored XSS attack by submitting facts containing HTML to the Foreman server. This can lead to exploitation on certain pages, including the Facts pa...

Password Recovery Platform: Wavecrack

A user-friendly Web interface to share an hashcat cracking box among multiple users with some pre-defined options. Outline This Web application can be used to launch asynchronous password cracks with hashcat . The interface tries to be as user-friendly as possible and facilitates the password...

Debian DSA-4021-1 : otrs2 - security update

It was discovered that missing input validation in the Open Ticket Request System could result in privilege escalation by an agent with write permissions for statistics. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Low: Red Hat Enhancement Advisory: Red Hat Virtualization Manager (ovirt-engine) 4.1.7

An update is now available for Red Hat Virtualization Manager. The Red Hat Virtualization Manager is a centralized management platform that allows system administrators to view and manage virtual machines. The Manager provides a comprehensive range of features including search capabilities,...