CVE-2018-13010

WSTMall v1.9.1170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account...

CVE-2018-13010

WSTMall v1.9.1170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account...

CVE-2018-1073

CVE-2018-1073 affects the oVirt-engine web console login form, where versions before 4.2.3 reveal different errors for non-existent users vs. invalid passwords, enabling attacker user enumeration. The issue is documented in Red Hat RHSA-2018:1525 and related advisories, with remediation via the a...

Security Bulletin: IBM Tivoli Monitoring Remote Code Execution (CVE-2015-5003)

Summary An IBM Tivoli Monitoring portal client user account that has view authority for Take Action commands can provide specially crafted input to have additional commands executed on the remote IBM Tivoli Monitoring system.. Vulnerability Details CVEID: CVE-2015-5003 DESCRIPTION: An IBM Tivoli...

Security Bulletin: OpenSource Apache Tomcat Vulnerability affects IBM Algorithmics Counterparty Credit Risk

Summary Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by an error when accessing a protected directory. By redirecting to the URL, an attacker could exploit this vulnerability to determine the presence of a directory. OpenSource Apache Tomcat is used by IBM...

Redaxo CMS Mediapool Addon < 5.5.1 - Arbitrary File Upload

Exploit Title: Redaxo CMS Mediapool Addon 5.5.1 - Arbitrary File Upload Date: 2018-06-13 Exploit Author: mn@HackerWerkstatt Vendor Homepage: https://redaxo.org Software Link: https://redaxo.org/download/redaxo/5.5.1.zip Version: 5.5.1 and older Tested on: LinuxMint More: Login required PoC In the...

Redaxo CMS Mediapool Addon 5.5.1 - Arbitrary File Upload

Redaxo CMS Mediapool Addon 5.5.1 - Arbitrary File Upload Exploit Title: Redaxo CMS Mediapool Addon 5.5.1 - Arbitrary File Upload Date: 2018-06-13 Exploit Author: mn@HackerWerkstatt Vendor Homepage: https://redaxo.org Software Link: https://redaxo.org/download/redaxo/5.5.1.zip Version: 5.5.1 and...

Design/Logic Flaw

A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to exploit it via a Browser Refresh attack on vulnerable installations. An attacker must be using a AD logon user account in order to exploit this vulnerability...

CVE-2018-10509

A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to exploit it via a Browser Refresh attack on vulnerable installations. An attacker must be using a AD logon user account in order to exploit this vulnerability...

Microsoft Windows: User Account Control: Switch to the secure desktop when prompting for elevation

This policy setting determines whether the elevation request prompts on the interactive user desktop or on the secure desktop. The secure desktop presents the logon UI and restricts functionality and access to the system until the logon requirements are satisfied. The secure desktop...

Microsoft Windows: User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop

This security setting controls whether User Interface Accessibility UIAccess or UIA programs can automatically disable the secure desktop for elevation prompts that are used by a standard user. Note: This setting does not change the behavior of the UAC elevation prompt for administrators. C...

Microsoft Windows: User Account Control: Behavior of the elevation prompt for standard users

This policy setting determines the behavior of the elevation prompt for standard users. C Microsoft Corporation 2017. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Microsoft Windows: User Account Control: Run all administrators in Admin Approval Mode

This policy setting determines the behavior of all User Account Control UAC policies for the entire system. This is the setting that turns UAC on or off. C Microsoft Corporation 2017. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, an...

Microsoft Windows: User Account Control: Admin Approval Mode for the Built-in Administrator account

This policy setting determines the behavior of Admin Approval Mode for the built-in administrator account. When the Admin Approval Mode is enabled, the local administrator account functions like a standard user account, but it has the ability to elevate privileges without logging on by using a...

Microsoft Windows: User Account Control: Virtualize file and registry write failures to per-user locations

This policy setting enables or disables the redirection of the write failures of earlier applications to defined locations in the registry and the file system. This feature mitigates applications that historically ran as administrator and wrote runtime application data to %ProgramFiles%, %Windir%...

Microsoft Windows: User Account Control: Only elevate UIAccess applications that are installed in secure locations

This policy setting enforces the requirement that apps that request running with a UIAccess integrity level by means of a marking of UIAccess=true in their app manifest, must reside in a secure location on the file system. Relatively secure locations are limited to the following directories: -...

Microsoft Windows: User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

This policy setting determines the behavior of the elevation prompt for accounts that have administrative credentials. C Microsoft Corporation 2017. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

Input validation

A vulnerability in the Secure Copy Protocol SCP server of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to access the shell of the underlying Linux operating system on the affected device. The vulnerability is due to improper input validation of...

Foxconn FEMTO AP-FC4064-T Code Execution Vulnerability

The Foxconn FEMTO AP-FC4064-T is a home base station device from Foxconn. A code execution hole exists in the Web administration page in the Foxconn FEMTO AP-FC4064-T APGTB385.8.3lb15-W47 LTE Build 15 release. A remote attacker can exploit this vulnerability to execute arbitrary code in a user's...

CVE-2018-9111

Cross Site Scripting XSS exists on the Foxconn FEMTO AP-FC4064-T APGTB385.8.3lb15-W47 LTE Build 15 via the configuration of a user account. An attacker can execute arbitrary script on an unsuspecting user's browser...