CVE-2016-4455

The Subscription Manager package aka subscription-manager before 1.17.7-1 for Candlepin uses weak permissions 755 for subscription-manager cache directories, which allows local users to obtain sensitive information by reading files in the directories...

Design/Logic Flaw

The Subscription Manager package aka subscription-manager before 1.17.7-1 for Candlepin uses weak permissions 755 for subscription-manager cache directories, which allows local users to obtain sensitive information by reading files in the directories...

CVE-2016-4455

The Subscription Manager package aka subscription-manager before 1.17.7-1 for Candlepin uses weak permissions 755 for subscription-manager cache directories, which allows local users to obtain sensitive information by reading files in the directories...

CVE-2016-4455

CVE-2016-4455 affects the Subscription Manager (subscription-manager) before 1.17.7-1 for Candlepin. The weakness is weak permissions (755) on subscription-manager cache directories, enabling local users to read files and obtain sensitive information. The connected documents corroborate the affec...

CVE-2016-4455

The Subscription Manager package aka subscription-manager before 1.17.7-1 for Candlepin uses weak permissions 755 for subscription-manager cache directories, which allows local users to obtain sensitive information by reading files in the directories...

How to request for XenMobile Service in Citrix Cloud

Citrix Cloud is a platform that hosts and administers Citrix services. It connects to your resources, via theCitrix Cloud Connector, on any cloud or infrastructure you choose. It allows you to create, manage, and deploy workspaces with apps and data to your end-users from a single console. The...

New Relic: Manipulation of submit payment request allows me to obtain Infrastructure Pro/Other Services for free or at greatly reduced price

@jonbottarini discovered an issue with our purchase process validation. This allowed subscription purchases to complete, even when they did not equal the intended price for the service provided. I wanted to test the New Relic pro features. I didn't want to pay full price I hacked the payment page...

Scientific Linux Security Update : subscription-manager on SL6.x i386/x86_64 (20170321)

Security Fixes : - It was found that subscription-manager set weak permissions on files in /var/lib/rhsm/, causing an information disclosure. A local, unprivileged user could use this flaw to access sensitive data that could potentially be used in a social engineering attack. CVE-2016-4455...

Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY)

Mandiant has observed APT29 using a stealthy backdoor that we call POSHSPY. POSHSPY leverages two of the tools the group frequently uses: PowerShell and Windows Management Instrumentation WMI. In the investigations Mandiant has conducted, it appeared that APT29 deployed POSHSPY as a secondary...

Multiple Local Elevation of Privilege Vulnerabilities in Red Hat Candlepin subscription-manager

Red Hat Candlepin is a Red Hat Red Hat set of tools for managing software subscriptions. subscription-manager is one of the GUI and CLI client . A local elevation of privilege vulnerability exists in Red Hat Candlepin subscription-manager versions 1.19.0-1 and 1.19.3-1. A local attacker could...

Use Secure VPNs (Lifetime Subscription) to Prevent ISPs From Spying On You

Data Privacy is a serious concern today with the vast availability of personal data over the Internet – a digital universe where websites collect your personal information and sell them to advertisers for dollars, and where hackers can easily steal your data from the ill-equipped. If this wasn't...

RedHat Update for subscription-manager RHSA-2017:0698-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 6 : subscription-manager (RHSA-2017:0698)

An update for subscription-manager, subscription-manager-migration-data, and python-rhsm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...

CVE-2017-2663

It was found that subscription-manager's DBus interface let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and com.redhat.RHSM1.Config.Set methods. An unprivileged local attacker could use these methods to gain access to private information, or launch a privilege escalation attack...

Moderate: Red Hat Security Advisory: subscription-manager security, bug fix, and enhancement update

An update for subscription-manager, subscription-manager-migration-data, and python-rhsm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...

subscription-manager: sensitive world readable files in /var/lib/rhsm/

It was found that subscription-manager set weak permissions on files in /var/lib/rhsm/, causing an information disclosure. A local, unprivileged user could use this flaw to access sensitive data that could potentially be used in a social engineering attack...

phplist 3.2.6 - SQL Injection Vulnerability

Exploit for php platform in category web applications 1. Introduction Affected Product: phplist 3.2.6 Fixed in: 3.3.1 Fixed Version Link: https://sourceforge.net/projects/phplist/files/phplist/3.3.1/phplist-3.3.1.zip/download Vendor Website: https://www.phplist.org/ Vulnerability Type: SQL...

Product update: Virtuozzo Automator 7 Update 1

The new packages for Virtuozzo Automator 7 introducing new features as well as usability and stability bug fixes. Vulnerability id: PVA-36535 Fixed collection of CPU statistics in VA MN. Vulnerability id: PVA-36516 Changing container's private area in the host settings in VA MN resulted in deleti...

Subscription Synchronization Does Not Work Among Multiple StoreFront Clusters

Subscription Synchronization does not work among multiple StoreFront clusters...

Video Subscription - SQL Injection

Video Subscription - SQL Injection Exploit Title: TV - Video Subscription - SQL Injection Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://codepaul.com/ Software Buy: https://codecanyon.net/item/tv-video-subscription/13966427 Demo: http://codepaul.com/tv/ Version: N/A Tested on: Win7 x64...