Hefei Yingyun Information Technology Co., Ltd. ordering good APP there is a verification code leakage vulnerability

OrderGood APP is an omni-channel order platform, distribution platform APP. There is a verification code leakage vulnerability in the Ordering Good APP of Hefei Yingyun Information Technology Co. Attackers can log into other user accounts by grabbing packets to get the verification code...

CVE-2017-5260

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference DRO at...

CVE-2017-3185

ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's histor...

Description of the security update for Microsoft Exchange: December 12, 2017

None None...

CentOS Update for postgresql CESA-2017:3402 centos7

Check the version of postgresql SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882819";...

Read the config of the User Account Control feature over SMB

Read the config of the User Account Control feature over SMB from Registry SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PVS Console | Fails to load farm\site\server details with error 'Server communication timeout'

The PVS Console throws following error while expanding farm\site\server details: 'Server communication timeout' MMC Console timeouts may also be seen. Now consider a Large AD Environment, where there are multiple Domains and the PVS Administrator User account used to access the PVS Console is par...

macOS 10.13 Authentication Bypass Remote Check (CVE-2017-13872)

The remote host is affected by an authentication bypass vulnerability. A local attacker or a remote attacker with credentials for a standard user account has the ability to blank out the root account password. This can allow an authenticated attacker to escalate privileges to root and execute...

The vulnerability in the server component of the SAP POS software for automating accounting, sales, and production processes allows a perpetrator to read and delete files, shut down the Xpress Server, view the contents of the POS terminal, and attack user accounts.

The vulnerability in the server component of the SAP POS software for accounting, trading, and production automation lies in the absence of authentication procedures during file reading, operation completion, daemon shutdown, and terminal reading. Exploiting this vulnerability allows a malicious...

LXCA User Account Names Exposed To Unauthenticated Users Who Can Access the Web User Interface - lu

Lenovo Security Advisory: LEN-16335 Potential Impact: LXCA user account names may be exposed to unauthenticated users with access to the LXCA web user interface Severity: Medium Scope of Impact: Lenovo Specific CVE Identifier: CVE-2017-3764 Summary Description: A vulnerability was identified in...

Design/Logic Flaw

A vulnerability was identified in Lenovo XClarity Administrator LXCA before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with access to the LXCA web user interface. No password information of the user accounts is exposed...

CVE-2017-3764

A vulnerability was identified in Lenovo XClarity Administrator LXCA before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with access to the LXCA web user interface. No password information of the user accounts is exposed...

CVE-2017-3764

Lenovo XClarity Administrator (LXCA) prior to version 1.4.0 exposes LXCA user account names to unauthenticated users with access to the web UI. No password data is exposed. Impact is exposure of usernames via the LXCA web interface; remediation is to upgrade LXCA to 1.4.0 or later (Lenovo advisor...

Cross site request forgery (csrf)

Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaining account detail...

SAP HANA Database SAP HANA extended application services Information Disclosure Vulnerability

SAP HANA Database is an in-memory database based on rows and columns from SAP, which provides fast querying of multidimensional data, filtering of useless data, and synchronization of multiple queries. The database provides fast querying of multidimensional data, filtering of useless data,...

Foscam IP Video Camera Reset Factory Settings Vulnerability

Foscam C1 Indoor HD Camera is a wireless HD IP camera from Foscam China. A factory reset vulnerability exists in the Multi-Camera interface in the Foscam C1 Indoor HD Camera, which stems from the program's failure to perform false detection. An attacker could exploit the vulnerability by sending ...

Privilege escalation

Privilege Escalation on iBall iB-WRA300N3GT iB-WRA300N3GT1.1.1 devices allows remote authenticated users to obtain root privileges by leveraging a guest/user/normal account to submit a modified privilege parameter to /form2userconfig.cgi...

Oracle FCDB <= 10.5 Cross Site Scripting Vulnerability

Exploit for multiple platform in category remote exploits Title: Cross Site Scripting - Oracle Flex cube Direct Banking Application 10.5 Application: Oracle FCDB Versions Affected: Oracle Flex cube Direct Banking Software 10.5 Note: The payload will bypass the most of the WAFs running behind the...

Infoblox NetMRI 7.1.4 Shell Escape / Privilege Escalation Vulnerabilities

Exploit for hardware platform in category remote exploits Title: Infoblox NetMRI Administration Shell Escape and Privilege Escalation Advisory ID: KL-001-2017-017 Publication Date: 2017.10.24 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-017.txt 1. Vulnerability...

Tuleap < 9.7 Object Injection Vulnerability

Tuleap is prone to an object injection vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...