CVE-2018-5152

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firef...

zurerinnerung.at XSS vulnerability

Open Bug Bounty ID: OBB-609035 Description| Value ---|--- Affected Website:| zurerinnerung.at Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

DEBIAN-CVE-2017-0363

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites...

Microsoft Windows Kernel Information Disclosure Vulnerability (CNVD-2018-08801)

Microsoft Windows 10 and others are a series of operating systems released by Microsoft Corporation in the U.S. Windows kernel is one of the Windows system kernels. An information disclosure vulnerability exists in Microsoft Windows kernel. An attacker can exploit this vulnerability by logging on...

CVE-2018-9057

aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...

CVE-2018-9057

aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...

CVE-2017-0926

Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login...

Unable to Sign On to SecureHub

Enrolled User unable to login to Secure Hub, while 2 users in Active Directory have same UPNUserPrincipalName. The Active Directory Users and Computers MMC ADUC will enforce unique values, However, duplicate values for userPrincipalName can be assigned to the users via code. Consider In AD that 2...

Open redirect

F-Secure Radar on-premises before 2018-02-15 has an Unvalidated Redirect via the ReturnUrl parameter that triggers upon a user login...

TV - Video Subscription - Authentication Bypass SQL Injection

TV - Video Subscription - Authentication Bypass SQL Injection Exploit Title: TV - Video Subscription - Authentication Bypass Dork: N/A Date: 2018-02-14 Exploit Author: Borna nematzadeh L0RD or [email protected] Vendor Homepage:...

Failed to Publish Image to PVS server, Unidesk Agent error: "The specified service does not exist"

When publishing a Citrix App Layering image to PVS, you might get an error like this - Error: The operation being requested was not performed because the user has not logged on to the network. The specified service does not exist. You may also see 'Access is Denied'. This is recorded in the Unide...

Sangoma NetBorder / Vega Session Controller Remote Command Execution

Description Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote unauthenticated attackers to execute arbitrary commands via the web interface. Technical Details The ShellExec class implemented in api/ShellExec.class.php is extensively used by various PHP scripts in the...

Microsoft Windows Kernel Elevation of Privilege Vulnerability (CNVD-2018-00518)

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the United States. kernel is one of the kernels. An elevation of privilege vulnerability exists in the kernel in Microsoft Windows, which arises from a program's failure to properly handle objects in memory. T...

XML Signature Wrapping

Samlify and express-saml2 are vulnerable to XML signature wrapping attacks. Attackers who observe SAML responses are able to add NameID's to the response without breaking the signature check. This could allow them to login as any user...

replicawatchpro.com XSS vulnerability

Open Bug Bounty ID: OBB-481660 Description| Value ---|--- Affected Website:| replicawatchpro.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure...

CVE-2017-1000433

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password...

UBUNTU-CVE-2017-1000433

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password...

chennaimetrowater.in XSS vulnerability

Open Bug Bounty ID: OBB-458939 Description| Value ---|--- Affected Website:| chennaimetrowater.in Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

Smart Heat Temperature Control App for Android suffers from an override access vulnerability

Smart Heat Temperature Control APP a home temperature control software, users only need to add the home's Internet-accessible thermostat to the software, you can use your phone or tablet to control the temperature of your home's HVAC equipment. The Android version of Smart Heat Temperature Contro...

SYS.2.2.2 Clients unter Windows 8.1

Zielsetzung dieses Bausteins ist der Schutz von Informationen, die durch und auf Windows 8.1-Clients verarbeiten werden. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...