Curriculum Evaluation System 1.0 SQL Injection

Exploit Title: Curriculum Evaluation System 1.0 - SQL Injection Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/curriculumevaluationsystem0.zip...

Information Disclosure Vulnerability in NSG 9000-6G

The NSG™ 9000-6G high-density general purpose edgeQAM system is a highly integrated digital video solution for multiplexing request-based video content over IP networks. An information disclosure vulnerability exists in the NSG 9000-6G that could be exploited by an attacker to obtain sensitive...

Linux ext4: out-of-bounds memcpy via non-inline system.data xattr(CVE-2018-11412)

ext4 can store data for small regular files as "inline data", meaning that the data is stored inside the corresponding inode instead of in separate blocks. Inline data is stored in two places: The first 60 bytes go in the iblock field in the inode which normally contains a list of blocks instead,...

DEBIAN-CVE-2018-11412

In the Linux kernel 4.13 through 4.16.11, ext4readinlinedata in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode...

UBUNTU-CVE-2018-11412

In the Linux kernel 4.13 through 4.16.11, ext4readinlinedata in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode...

CVE-2018-0014

Juniper Networks ScreenOS devices do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from previous packets. This issue is often detected as CVE-2003-0001. The issue affects all versions of Juniper Networks ScreenOS prior to 6.3.0r25...

Inside the CCleaner Backdoor Attack

MADRID—As the investigation continues into the backdoor planted inside CCleaner, two members of parent company Avast’s threat intelligence team said today the desktop and cloud versions of the popular software contained different payloads. The revelation was made during a talk at Virus Bulletin...

CVE-2017-8040: Improper Restriction of XML External Entity Reference

In Single Sign-On for Pivotal Cloud Foundry PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE XML External Entity attack was discovered in the Single Sign-On service dashboard. Privileged users can in some cases upload malformed XML leading to exposure of data on the...

CVE-2017-8003

EMC Data Protection Advisor prior to 6.4 contains a path traversal vulnerability. A remote authenticated high privileged user may potentially exploit this vulnerability to access unauthorized information from the underlying OS server by supplying specially crafted strings in input parameters of t...

Schneider Electric U.motion Builder Information Disclosure Vulnerability

U.motion Builder is a builder product from Schneider Electric France. An information disclosure vulnerability exists in Schneider Electric U.motion Builder. Returns system information to an attacker containing sensitive data. Allowing an attacker to exploit the vulnerability to execute arbitrary...

Adobe Captivate Information Disclosure Vulnerability

Adobe Captivate is a screen recording software. An information disclosure vulnerability exists in Adobe Captivate. An attacker can use this vulnerability to obtain sensitive system information...

Eview EV-07S GPS Tracker Information Disclosure Vulnerability

The Eview EV-07S GPS Tracker is a GPS tracking device for personal safety and personal protection. A security vulnerability exists in the Eview EV-07S GPS Tracker. The vulnerability can be exploited by an attacker to obtain sensitive information GPS data, etc...

CVE-2016-7107

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequently affect system data integrity via unspecified vectors...

Code injection

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequently affect system data integrity via unspecified vectors...

Shopify: Unauthorized access to Zookeeper on http://locutus-zk3.ec2.shopify.com:2181

What is Zookeeper? ==================== Zookeeper is a coordination service for distributed applications. It allows common services such as naming, synchronisation, configuration management and group services to be managed by a simple interface and It uses a data model of File System on an...

[SECURITY] Fedora 23 Update: setroubleshoot-plugins-3.3.5.1-1.fc23

This package provides a set of analysis plugins for use with setroubleshoot. Each plugin has the capacity to analyze SELinux AVC data and system data to provide user friendly reports describing how to interpret SELinux AVC denials...

Libksba One Error Vulnerability

Libksba is a library that simplifies work tasks for X.509 certificates, CMS data and related objects in the GnuPG project developed by the GNU Project. A difference-one error vulnerability in Libksba's src/dn.c file can be exploited by an attacker to cause OOB read access in ksbadntostr...

Lenovo Hit With Criticism Over Second Rootkit-Like Utility

Lenovo is under fire again for installing a covert utility on laptops and desktops that some users have compared to a rootkit. The issue stems from a utility called the Lenovo Service Engine, that is designed to collect some system information and send it to Lenovo at the time the machine connect...

Microsoft Windows Hyper-V Remote Code Execution Vulnerability (3072000)

This host is missing a critical security update according to Microsoft Bulletin MS15-068. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

MS15-068: Vulnerabilities in Windows Hyper-V Could Allow Remote Code Execution (3072000)

The remote Windows host is affected by multiple remote code execution vulnerabilities in Hyper-V : - An error exists in how Hyper-V handles packet size memory initialization in guest virtual machines. An authenticated attacker with access to a guest virtual machine can exploit this by running a...