3634 matches found
CVE-2018-1314: Missing Authorization
In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics...
Setup only possible with sending user statistics
One of our customers reported an error: panel There is a problem with the setup of the new version of SourceTree 3.0.8. In the last screen the preferences are requested. It is not possible to click "Weiter" Continue without checking the second option. !Preferences.png|thumbnail! But this needs to...
Setup only possible with sending user statistics
One of our customers reported an error: panel There is a problem with the setup of the new version of SourceTree 3.0.8. In the last screen the preferences are requested. It is not possible to click "Weiter" Continue without checking the second option. !Preferences.png|thumbnail! But this needs to...
glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code
It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator. An attacker can use this flaw to create files and execute arbitrary code. To exploit this, the attacker would require...
Rocket.Chat: Blind SQL injection in third-party software, that allows to reveal user statistic from rocket.chat and possibly hack into the rocketchat.agilecrm.com
Hi. I decided to go to static website https://rocket.chat/ and look what is there. I found third-party website request...
foreman: Stored XSS in fact name or value
An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: 1 Facts page, when clicking on the "chart" button and hovering over the chart; 2 Trends page, when checking the graph for a trend based on a such fact; 3 Statistics page, for facts that are...
CVE-2018-12410
The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote execution of code. Without needing to authenticate, an attacker may be able to remotely execute code with the permissions of the system account used to run the...
Design/Logic Flaw
The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote execution of code. Without needing to authenticate, an attacker may be able to remotely execute code with the permissions of the system account used to run the...
CVE-2018-12410
The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote execution of code. Without needing to authenticate, an attacker may be able to remotely execute code with the permissions of the system account used to run the...
CVE-2018-12410 TIBCO Spotfire Statistics Services remote execution vulnerabilities
The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote execution of code. Without needing to authenticate, an attacker may be able to remotely execute code with the permissions of the system account used to run the...
CVE-2018-12410
CVE-2018-12410 involves the web server component of TIBCO Spotfire Statistics Services, which (without authentication) may allow remote code execution with the system account’s privileges. Affected releases are Spotfire Statistics Services up to version 7.11.0. The provided documents describe the...
PT-2018-11151
Name of the Vulnerable Software and Affected Versions TIBCO Spotfire Statistics Services versions up to and including 7.11.0 Description The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple issues that may allow remote code execution. An attacker may be...
CVE-2018-12410: Undefined Security Weakness
The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote execution of code. Without needing to authenticate, an attacker may be able to remotely execute code with the permissions of the system account used to run the...
CVE-2017-5658
The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the conten...
PT-2018-8256
Name of the Vulnerable Software and Affected Versions: Apache Pony Mail versions 0.7 through 0.9 Description: The statistics generator in Apache Pony Mail was found to be returning timestamp data without proper authorization checks, potentially leading to derived information disclosure on private...
CVE-2017-5658: Exposure of Sensitive Information to an Unauthorized Actor
The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the conten...
Unspecified Vulnerability in WordPress Feed Statistics Plugin
WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site.Feed Statistics plugin is used in one of the tracking RSS statistics plugin. An unspecified vulnerability exists in t...
CVE-2018-17074
The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter...