ABB Ellipse

CVSS v3 6.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: ABB Equipment: Ellipse Vulnerability: Unprotected Transport of Credentials AFFECTED PRODUCTS ABB reports that the vulnerability affects Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 including Ellipse...

Lantronix Devices Unprotected Access (Telnet)

The Lantronix device setup is accessible via an unprotected Telnet connection. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Lantronix Devices Unprotected Access (HTTP)

The Lantronix device web interface is accessible via an unprotected HTTP connection. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Progress Sitefinity 10.0 / 10.1 Broken Access Control / LINQ Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Broken access control & LINQ injection product: Progress Sitefinity vulnerable version: 10.0, 10.1 fixed version: =10.1.6527.0 internal build, 10.2 CVE number: - impact:...

The vulnerability of the FortiOS operating system arises from the lack of measures taken to protect the structure of web pages, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the FortiOS operating system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks by entering malicious code into the “Comments” field and saving the modified...

The vulnerability of the IBM Security Guardium information protection mechanism lies in its lack of protection for SQL query structures. This allows attackers to view, add, modify, or delete data.

The vulnerability of the IBM Security Guardium security tool relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to remotely access, view, add, modify, or delete data using specially crafted SQL statements...

Data Pours from Cloud—And ‘The Enemy is Us’

Accenture, Verizon, Dow Jones and Deep Root Analytics are just the tip of the iceberg when it comes to the millions of private records and sensitive enterprise data exposed on cloud backends this year. And the problem is getting worse not better. “The enemy is us,” said Chris Vickery, director of...

OpenJDK: use of unprotected sname in Kerberos client (Libraries, 8178794)

It was discovered that the Kerberos client implementation in the Libraries component of OpenJDK used the sname field from the plain text part rather than encrypted part of the KDC reply message. A man-in-the-middle attacker could possibly use this flaw to impersonate Kerberos services to Java...

The vulnerability of the reportId parameter in the getReportStatus method of the Kaspersky Anti-Virus for Linux File Server antivirus protection tool allows a hacker to access and read arbitrary files.

The vulnerability of the reportId parameter in the getReportStatus method of the Kaspersky Anti-Virus for Linux File Server antivirus tool is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to read arbitrary files wit...

Alaska Voter Database Exposed Online

By Waqas IT security researchers at Kromtech Security Center discovered an unprotected database This is a post from HackRead.com Read the original post: Alaska Voter Database Exposed Online...

Docker Daemon Unprotected TCP Socket

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Docker Daemon - Unprotected TCP Socket Exploit', 'Description' = %q Utilizing Docker via unprotected tcp socket 2375/tcp, maybe 2376/tcp with tls...

The vulnerability of the ScheduleQuery method in the scheduling class of the ZENworks Configuration Management information system allows a perpetrator to execute arbitrary SQL commands.

The vulnerability of the ScheduleQuery method in the ZENworks Configuration Management software framework relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands using undefined vectors...

glenatbd.com XSS vulnerability

Vulnerable URL: http://www.glenatbd.com/newsletter/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 01.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 370908 VIP website status:| No Check glenatbd.com SSL connection:| Grade: F...

Docker Daemon - Unprotected TCP Socket

Exploit Title: Docker Daemon - Unprotected TCP Socket Date: 20-07-2017 Exploit Author: Martin Pizala Vendor Homepage: https://www.docker.com Software Link: https://www.docker.com/get-docker Version: Since 0.4.7 2013-06-28 feature: mount host directories Tested on: Docker CE 17.06.0-ce and Docker...

Docker Daemon - Unprotected TCP Socket

Docker Daemon - Unprotected TCP Socket Exploit Title: Docker Daemon - Unprotected TCP Socket Date: 20-07-2017 Exploit Author: Martin Pizala Vendor Homepage: https://www.docker.com Software Link: https://www.docker.com/get-docker Version: Since 0.4.7 2013-06-28 feature: mount host directories Test...

Over 14 Million Verizon Customers' Data Exposed On Unprotected AWS Server

Verizon, the major telecommunications provider, has suffered a data security breach with over 14 million US customers' personal details exposed on the Internet after NICE Systems, a third-party vendor, mistakenly left the sensitive users’ details open on a server. Chris Vickery, researcher and...

DEBIAN-CVE-2016-5007

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space...

The vulnerability of the software system for managing enterprise assets in IBM Maximo Asset Management allows a perpetrator to gain access to another user’s session.

The vulnerability of the session identifier of the IBM Maximo Asset Management software management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to intercept a session or gain access to another user’s...

The vulnerability of the Cisco Unified Communications Manager system allows a perpetrator to circumvent access control rules.

The vulnerability of the Cisco Unified Communications Manager web interface relates to the lack of protection for the SQL query structure. Exploiting this vulnerability allows a malicious actor to bypass access controls by making arbitrary queries to the SQL database...

The vulnerability of the Telegram Messenger messaging app allows a hacker to gain access to messages in the secret chat.

The vulnerability of the cleartext component in the Telegram Messenger application is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to messages in the secret chat by reading the memory regions used...