Dell Encryption Enterprise Information Disclosure Vulnerability

Dell Encryption Enterprise is a suite of data protection solutions from Dell USA. The product includes features such as compliance management, authentication, disk data encryption and port encryption. An information disclosure vulnerability exists in Dell Encryption Enterprise version 10.1.0 and...

CVE-2018-15773

Dell Encryption (formerly Dell Data Protection/Encryption) versions 10.1.0 and earlier contain an information disclosure vulnerability. A malicious user with physical access could access the unencrypted RegBack folder containing backups of sensitive system files. The impact is confidentiality los...

CVE-2018-15773 Dell Encryption Enterprise \ Dell Data Protection Encryption Information Disclosure Vulnerability

Dell Encryption formerly Dell Data Protection | Encryption v10.1.0 and earlier contain an information disclosure vulnerability. A malicious user with physical access to the machine could potentially exploit this vulnerability to access the unencrypted RegBack folder that contains back-ups of...

XML External Entity (XXE)

recurly-api-client is vulnerable to XML external entity XXE attacks. The XML parser did not restrict externa DTD parsing and allows for a remote attacker to perform XXE attacks, resulting in access to system files or possibly execution of arbitrary commands...

Information disclosure

An exploitable information disclosure vulnerability exists in the HTTP server functionality of the TP-Link TL-R600VPN. A specially crafted URL can cause a directory traversal, resulting in the disclosure of sensitive system files. An attacker can send either an unauthenticated or an authenticated...

CVE-2018-3949

An exploitable information disclosure vulnerability exists in the HTTP server functionality of the TP-Link TL-R600VPN. A specially crafted URL can cause a directory traversal, resulting in the disclosure of sensitive system files. An attacker can send either an unauthenticated or an authenticated...

Qibo CMS station system V7.0 backend file reading vulnerability

Qibo CMS station system is a Guangzhou Qibo Network Technology Co. Qibo CMS system V7.0 backend file reading vulnerability exists. The vulnerability is due to the failure of the user to submit a special string of processing , resulting in directory traversal , an attacker can use the vulnerabilit...

CVE-2018-3949

An exploitable information disclosure vulnerability exists in the HTTP server functionality of the TP-Link TL-R600VPN. A specially crafted URL can cause a directory traversal, resulting in the disclosure of sensitive system files. An attacker can send either an unauthenticated or an authenticated...

Design/Logic Flaw

LXCI for VMware versions prior to 5.5 and LXCI for Microsoft System Center versions prior to 3.5, allow an authenticated user to write to any system file due to insufficient sanitization during the upload of a certificate...

CVE-2018-9072 LXCI for VMware

In versions prior to 5.5, LXCI for VMware allows an authenticated user to download any system file due to insufficient input sanitization during file downloads...

Dream line business enterprise station building system exists arbitrary file download vulnerability

Dream line business enterprise station building system is to use PHP + MySQL way to run the open source station building system. Dream line enterprise building system there are arbitrary file download vulnerability, an attacker can use the vulnerability to download any system file...

CVE-2018-11062

Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named 'support' and 'admin' that are protected with default passwords. These accounts have limited privileges and can access certain system files only. A malicious user with the knowledge of the default...

Default credentials

Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named 'support' and 'admin' that are protected with default passwords. These accounts have limited privileges and can access certain system files only. A malicious user with the knowledge of the default...

CVE-2018-11062

Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named 'support' and 'admin' that are protected with default passwords. These accounts have limited privileges and can access certain system files only. A malicious user with the knowledge of the default...

CVE-2018-11062

Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, and 2.2 contain undocumented accounts named ‘support’ and ‘admin’ protected by default passwords. These accounts have limited privileges but can access certain system files, enabling a potential attacker with knowledge of the...

CVE-2018-11062 Dell EMC Integrated Data Protection Appliance Undocumented Accounts Vulnerability

Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named 'support' and 'admin' that are protected with default passwords. These accounts have limited privileges and can access certain system files only. A malicious user with the knowledge of the default...

CVE-2018-15321

CVE-2018-15321 affects BIG-IP products when Appliance mode is licensed and Admin/Resource Administrator roles have or are granted TMSH access. The issue allows high-privilege attackers to bypass Appliance mode restrictions and overwrite critical system files via TMSH, bypassing security controls....

Dell EMC Integrated Data Protection Appliance Unlogged Account Vulnerability

The Dell EMC Integrated Data Protection Appliance IDPA is a pre-integrated turnkey solution that is easy to deploy and scale, providing comprehensive protection for a wide range of application ecosystems. An undocumented account vulnerability exists in the Dell EMC Integrated Data Protection...

Hacker Discloses New Windows Zero-Day Exploit On Twitter

A security researcher with Twitter alias SandboxEscaper—who two months ago publicly dropped a zero-day exploit for Microsoft Windows Task Scheduler—has yesterday released another proof-of-concept exploit for a new Windows zero-day vulnerability. SandboxEscaper posted a link to a Github page hosti...

Chrome Debugger Extension API Is Too Powerful Vulnerability

The Chrome debugger extension API appears to have more power than necessary, including the ability to bypass the check for disabled natives. Chrome: debugger extension API is too powerful My understanding of Chrome's security model regarding extensions is as follows: Users can grant almost comple...