DreamTV - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application DreamTV published at the 'play' market has multiple vulnerabilities...

Threat Outbreak Alert RuleID30667: Email Messages Distributing Malicious Software on September 22, 2017

Medium Alert ID: 55369 First Published: 2017 September 22 16:04 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30667 may contain the following files: Name ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 javascript: or 2 data: URLs...

CVE-2015-3296

Multiple cross-site scripting XSS vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 javascript: or 2 data: URLs...

Apache Wicket Cross-Site Request Forgery Vulnerability

Apache Wicket is the United States Apache Apache Software Foundation , a set of open source , lightweight , component-based framework , which provides an object-oriented way to develop Web-based dynamic UI applications . A security vulnerability exists in Apache Wicket. An attacker can exploit th...

Threat Outbreak Alert RuleID30630: Email Messages Distributing Malicious Software on September 18, 2017

Medium Alert ID: 55313 First Published: 2017 September 18 17:43 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30630 may contain the following files: Name ...

Netvisor ID - Customized SSL, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Netvisor ID published at the 'play' market has multiple vulnerabilities...

Insecure Cryptography

github.com/keybase/client uses insecure cryptographic measures when hiding URLs. If an attacker knows what the hash of a link is, they will be able to figure out the hidden data...

GLSA-201709-09 : Subversion: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201709-09 Subversion: Arbitrary code execution Specially crafted ssh://... URLs may allow the owner of the repository to execute arbitrary commands on clients machine if those commands are already installed on the clients system...

GLSA-201709-10 : Git: Command injection

The remote host is affected by the vulnerability described in GLSA-201709-10 Git: Command injection Specially crafted ssh://... URLs may allow the owner of the repository to execute arbitrary commands on clients machine if those commands are already installed on the clients system. This is...

CVE-2017-14244

An authentication bypass vulnerability on iBall Baton ADSL2+ Home Router FWiB-LR7011A1.0.2 devices potentially allows attackers to directly access administrative router settings by crafting URLs with a .cgi extension, as demonstrated by /info.cgi and /password.cgi...

Subversion: Arbitrary code execution

Background Subversion is a version control system intended to eventually replace CVS. Like CVS, it has an optional client-server architecture where the server can be an Apache server running modsvn, or an ssh program as in CVS’s :ext: method. In addition to supporting the features found in CVS,...

Open Redirect

python-fedora is vulnerable to open redirects. The library does not check if urls passed to it are remote urls, allowing a malicious user to pass a remote malicious url to the application to cause open redirects and possibly leak CSRF tokens...

The vulnerability of the svn:externals and svn:sync-from-url services in the centralized version control system Subversion allows a perpetrator to execute arbitrary shell commands.

The vulnerability of the svn:externals and svn:sync-from-url services in the centralized version control system Subversion exists due to insufficient checking of input data file://, http://, plain untunneled svn://. Exploiting this vulnerability allows a malicious actor to execute any shell comma...

Threat Outbreak Alert RuleID30556: Email Messages Distributing Malicious Software on September 13, 2017

Medium Alert ID: 55198 First Published: 2017 September 13 15:53 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30556 may contain the following files: Name ...

EulerOS 2.0 SP2 : mercurial (EulerOS-SA-2017-1218)

According to the versions of the mercurial package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in the way Mercurial handles path auditing and caches the results. An attacker could abuse a repository with a serie...

EulerOS 2.0 SP1 : mercurial (EulerOS-SA-2017-1217)

According to the versions of the mercurial package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in the way Mercurial handles path auditing and caches the results. An attacker could abuse a repository with a serie...

EulerOS 2.0 SP1 : git (EulerOS-SA-2017-1187)

According to the versions of the git package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that the git-prompt.sh script shipped with git failed to correctly handle branch names containing special characters. A specially craft...

Sql injection

A vulnerability in the SQL database interface for Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL queries that bypass protection filters. An attacker...

Cross site scripting

A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model DOM-based, environment or client-side cross-site scripting XSS attack. The vulnerability occurs because...