Security Bulletin: Log viewer vulnerability affects IBM Workload Deployer (CVE-2014-6190)

Summary Log viewer vulnerability affects IBM Workload Deployer. Vulnerability Details CVEID:CVE-2014-6190 DESCRIPTION: Defined system users without proper permissions can access the log viewer functionality by entering the log page URLs in their browser. CVSS Base Score: 5.0 CVSS Temporal Score:...

Security Bulletin: Log viewer vulnerability affects IBM PureApplication System (CVE-2014-6190)

Summary Log viewer vulnerability affects IBM PureApplication System. Vulnerability Details CVEID: CVE-2014-6190 DESCRIPTION: Defined system users without proper permissions can access the log viewer functionality by entering the log page URLs in their browser. CVSS Base Score: 5.0 CVSS Temporal...

BMC BladeLogic RSCD Agent 8.3.00.64 Windows Users Disclosure

Exploit Title: BMC BladeLogic RSCD agent get Windows users Filename: BMCwinUsers.py Github: https://github.com/bao7uo/bmcbladelogic Date: 2018-01-27 Exploit Author: Paul Taylor / Foregenix Ltd Website: http://www.foregenix.com/blog Version: BMC RSCD agent 8.3.00.64 CVE: CVE-2016-5063 Vendor...

BMC BladeLogic RSCD Agent 8.3.00.64 - Windows Users Disclosure

Exploit Title: BMC BladeLogic RSCD agent get Windows users Filename: BMCwinUsers.py Github: https://github.com/bao7uo/bmcbladelogic Date: 2018-01-27 Exploit Author: Paul Taylor / Foregenix Ltd Website: http://www.foregenix.com/blog Version: BMC RSCD agent 8.3.00.64 CVE: CVE-2016-5063 Vendor...

SUSE-SU-2017:1619-1 Security update for glibc

This update for glibc fixes the following issues: - CVE-2017-1000366: Fix a potential privilege escalation vulnerability that allowed unprivileged system users to manipulate the stack of setuid binaries to gain special privileges. bsc1039357 - A bug in glibc that could result in deadlocks between...

SUSE-SU-2017:1611-1 Security update for glibc

This update for glibc fixes the following issues: - CVE-2017-1000366: Fix a potential privilege escalation vulnerability that allowed unprivileged system users to manipulate the stack of setuid binaries to gain special privileges. bsc1039357 - The incorrectly defined constant OTMPFILE has been...

cPanel Cross Domain Scripting / Information Disclosure

=== Introduction === cPanel offers web hosting software that automates the intricate workings of web hosting servers. cPanel equips server administrators with the necessary tools to provide top-notch hosting to customers on tens of thousands of servers worldwide. === Description === I Cross Domai...

DSA-3567-1 libpam-sshauth - security update

Bulletin has no description...

TRS init_sysUsers.xml 信息泄漏漏洞

No description provided by source...

Reflected XSS within the username parameter of the /user/non-system/{username} rest resource

The confluence-rest-plugin has a rest resource to look up "non-system" users which takes in a username. If given username supplied is not found then it is included in an xml error message without being xml encoded and thus is a XSS vector. That is, and other such xml special characters are not...

Reflected XSS within the username parameter of the /user/non-system/{username} rest resource

The confluence-rest-plugin has a rest resource to look up "non-system" users which takes in a username. If given username supplied is not found then it is included in an xml error message without being xml encoded and thus is a XSS vector. That is, and other such xml special characters are not...

[PT-2011-43] Database information disclosure in Kayako Fusion

---------------------------------------------------------------------- PT-2011-43 Positive Technologies Security Advisory Database information disclosure in Kayako Fusion ---------------------------------------------------------------------- --- Vulnerable software Kayako Fusion Link:...

User Enumeration

Security auditing tests performed on a Jira Bug Issue and Project Tracking Software locally running instance shown that at least two vulnerabilities regarding User Enumeration were found within the software. Case 1: Logged In Whenever a logged user accesses the Url...

Vortex CMS - 'pageid' Blind SQL Injection

php '.$argv0.' http://www.site.com/cms/ 1 1 '; if $argc 1 printr' '; echo 'Searching for Admin: '; for$i=1; $i = 50; $i++ $temp1 = filegetcontents$argv1.'index.php?pageid='.$argv2.''and+lengthselect+username+from+systemuserslogins+where+id='.$argv3.'='.$i.'/'; if strpos$temp1,'Sorry, the page you...

openoffice -- document disclosure

OpenOffice creates a working directory in /tmp on startup, and uses this directory to temporarily store document content. However, the permissions of the created directory may allow other user on the system to read these files, potentially exposing information the user likely assumed was...

CVE-1999-0259

CVE-1999-0259 describes an information-disclosure vulnerability in cfingerd where a remote attacker can list system users by issuing a finger search (finger search.*@target). The affected component is cfingerd; the underlying root cause is a bug in the search handling that exposes user lists. Doc...