Information Disclosure

libcurl.so is vulnerable to information disclosure. HTTP headers are sent to both proxy and destination servers. This can lead to confidential information such as basic authorization headers containing user credentials being exposed to remote proxy servers...

Unidesk Appliance Backup Utility scheduled task must be run as the same user who ran the tool

When you make a scheduled appliance backup task with the utility, the task must specify the same Run As user as the one you're logged in with when you run the tool. Otherwise, your encrypted passwords for vCenter and the MA will be unavailable. You will see errors like this in the Appliance Backu...

CVE-2018-0375

A vulnerability in the Cluster Manager of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to log in to an affected system using the root account, which has default, static user credentials. The vulnerability is due to the presence of undocumented, static user...

Cisco Policy Suite Cluster Manager Default Password Vulnerability

A vulnerability in the Cluster Manager of Cisco Policy Suite could allow an unauthenticated, remote attacker to log in to an affected system using the root account, which has default, static user credentials. The vulnerability is due to the presence of undocumented, static user credentials for th...

Insecure Cache Storage

mediawiki stores cache files in /tmp directory and is vulnerable to cache poisoning attacks. A user on the same system will be able to insert an evil cache file and perform xss attacks to steal user credentials and information...

Cross-Site Scripting (XSS)

spark-core is vulnerable to cross-site scripting XSS. An attacker is able to inject arbitrary script into a user's browser by constructing a URL that points to a Spark cluster's job and stage information pages. When exploited, an attacker is able to steal the user's credentials or information fro...

CVE-2018-9185

An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions reveals user's web portal login credentials in a Javascript file sent to client-side when pages bookmarked in web portal use the Single Sign-On feature...

CVE-2017-0912

Ubiquiti UCRM versions 2.5.0 to 2.7.7 are vulnerable to Stored Cross-site Scripting. Due to the lack sanitization, it is possible to inject arbitrary HTML code by manipulating the uploaded filename. Successful exploitation requires valid credentials to an account with "Edit" access to "Scheduling...

Security Bulletin: Flex System V7000 systems are affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerabilit...

Design/Logic Flaw

The Spotfire server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contain multiple vulnerabilities that may allow for the disclosure of information, including user and data source credentials. Affected releases are TIBCO Softwa...

CVE-2018-12519

An issue was discovered in ShopNx through 2017-11-17. The vulnerability allows a remote attacker to upload any malicious file to a Node.js application. An attacker can upload a malicious HTML file that contains a JavaScript payload to steal a user's credentials...

Hardcoded credentials

An issue was discovered in ShopNx through 2017-11-17. The vulnerability allows a remote attacker to upload any malicious file to a Node.js application. An attacker can upload a malicious HTML file that contains a JavaScript payload to steal a user's credentials...

CVE-2018-12519

Summary of CVE-2018-12519 : ShopNx (AngularJS/Node.js/MongoDB-based single-page shopping app) up to 2017-11-17 is vulnerable to an arbitrary file upload in the server-side application. The vulnerability allows a remote attacker to upload a malicious HTML file containing JavaScript payloads, enabl...

Security Bulletin: IBM Flex System Manager (FSM) is affected by a Pluggable Authentication Module (PAM) vulnerability (CVE-2013-7041)

Summary A security vulnerability was discovered in PAM that is embedded in the IBM FSM. This bulletin addresses this vulnerabilities. Vulnerability Details CVEID: CVE-2013-7041 DESCRIPTION: pamuserdb module for Pam could provide weaker than expected security, caused by an error in the strncasecmp...

Security Bulletin: IBM Flex System Manager is affected by a vulnerability from FSM’s use of strongswan: (CVE-2015-4171)

Summary There is a security vulnerability in strongswan that is used by IBM Flex System Manager FSM. Vulnerability Details CVEID: CVE-2015-4171 DESCRIPTION: strongSwan could allow a remote authenticated attacker to obtain sensitive information, caused by an error in IKEv2 connections related to...

Security Bulletin: IBM SDN for Virtual Environments is affected by a vulnerability in OpenSSL (CVE-2014-0160)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability...

Security Bulletin: IBM N Series OnCommand Unified Manager Core Package is affected by a vulnerability in OpenSSL (CVE-2014-0160)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability...

Security Bulletin: IBM Storwize V7000 Unified systems are affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerabilit...

Security Bulletin: TS3310 is affected by a vulnerability in OpenSSL (CVE-2014-0160)

Summary A security vulnerability has been discovered in OpenSSL. Vulnerability Details DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerability to expose 64k of...

Security Bulletin: DS8870 Release 7.2 is affected by a vulnerability in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this vulnerabilit...