openstack-tripleo-heat-templates hard-coded credentials vulnerability

openstack-tripleo-heat-templates is a template for deploying the OpenStack platform. A security vulnerability exists in versions prior to openstack-tripleo-heat-templates 8.0.2-40, where Opendaylight in RHOSP13 is configured with default credentials that can be easily guessed when deploying with...

Uber: [experience.uber.com] Node.js source code disclosure & anonymous access to internal Uber documents, templates and tools

A configuration file on experience.uber.com exposed details for the server configuration as well as information about the content hosted on the site. The site itself did require authentication to log in, but this config file was publicly accessible. Other accessible URLs included slide deck...

Insecure Default Configuration

tripleoheattemplates is vulnerable to insecure default configuration. The vulnerabilty exists due to the default configuration set for the OpenDayLight ODL admin users' credentials, allowing malicious users to gain unauthorized access...

Default credentials

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials...

UBUNTU-CVE-2018-10898

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials...

PYSEC-2018-102

A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials...

CVE-2018-10898

CVE-2018-10898 affects openstack-tripleo-heat-templates prior to 8.0.2-40. When deploying with Director in RHOSP13, Opendaylight is configured with easily guessable default credentials, as described in multiple sources (Red Hat RHSA-2018:2214 and CNVD/OSV entries). The issue arises from default c...

SAQ Enables Users to Pick and Choose Questions for Custom Templates

Qualys Security Assessment Questionnaire SAQ has been enhanced with new features for questionnaire templates, which enable customers to choose questions that they want to include in their campaigns. The new Question Bank option in the SAQ Template Editor provides users with a repository of...

Important: Red Hat Security Advisory: openstack-tripleo-heat-templates security update

An update for openstack-tripleo-heat-templates is now available for Red Hat OpenStack Platform 13.0 Queens for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Spoof SSDP replies to phish for NTLM hashes: evil-ssdp

This tool responds to SSDP multicast discover requests, posing as a generic UPNP device on a local network. Your spoofed device will magically appear in Windows Explorer on machines in your local network. Users who are tempted to open the device are shown a configurable webpage. By default, this...

Joomla jsn gruve directory traversal vulnerability

JoomlaShine is the company that provides free joomla templates. A directory traversal vulnerability exists in joomla jsn gruve pro versions prior to 2.1.0, which can be exploited by attackers to obtain sensitive information...

Microsoft Windows: IE security prompt for Windows Installer scripts

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winieinstallerscripts.nasl 11363 2018-09-12 13:46:05Z emoss $ Check value for Prevent Internet Explorer security prompt for Windows Installer scripts Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Microsoft Windows: Event Log behavior when log file reaches its max size (App)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winappretention.nasl 10989 2018-08-15 14:57:51Z emoss $ Check value for Control Event Log behavior when the log file reaches its maximum size Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Microsoft Windows: Event Log behavior when log file reaches its max size (Setup)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winsetupretention.nasl 10989 2018-08-15 14:57:51Z emoss $ Check value for Setup: Control Event Log behavior when the log file reaches its maximum size Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

CVE-2018-11589

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the...

Microsoft Windows: Turn off the Order Prints picture task

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winorderprintpictask.nasl 11337 2018-09-11 14:23:53Z emoss $ Check value for Turn off the "Order Prints" picture task Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This...

Microsoft Windows: Configure registry policy processing (background processing)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winnogpolistchanges.nasl 11337 2018-09-11 14:23:53Z emoss $ Check value for Configure registry policy processing:Process even if the Group Policy objects have not changed Authors: Emanuel Moss Copyright: Copyright c 2018...

Microsoft Windows: Configure registry policy processing (background processing)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winnobackgroundpolicy.nasl 11337 2018-09-11 14:23:53Z emoss $ Check value for Configure registry policy processing:Do not apply during periodic background processing Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone...

Microsoft Windows: Turn off Internet Connection Wizard (if refers to Microsoft.com)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: wininetconnectionwizard.nasl 11337 2018-09-11 14:23:53Z emoss $ Check value for Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone...

CVE-2018-12588

The CVE concerns a cross-site scripting (XSS) vulnerability in PKP Open Monograph Press (OMP) templates/frontend/pages/searchResults.tpl. Affected versions are PKP OMP 1.2.0 through 3.1.1-2 (before 3.1.1-3). The issue allows remote attackers to inject arbitrary script/HTML via the catalog.noTitle...