CVE-2017-6142

X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall Manager versions 13.0.0, 12.1.0-12.1.2, and 11.6.0-11.6.2, and thus did not properly validate the remote server's identity on certain versions of BIG-IP...

PT-2018-8293

Name of the Vulnerable Software and Affected Versions F5 BIG-IP Advanced Firewall Manager versions 11.6.0 through 11.6.2 F5 BIG-IP Advanced Firewall Manager versions 12.1.0 through 12.1.2 F5 BIG-IP Advanced Firewall Manager version 13.0.0 Description The issue concerns the incorrect implementatio...

CVE-2017-6142: Improper Certificate Validation

X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advanced Firewall Manager versions 13.0.0, 12.1.0-12.1.2, and 11.6.0-11.6.2, and thus did not properly validate the remote server's identity on certain versions of BIG-IP...

Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or from thin air.

Bugfixes Fixed a security issue discovered by @hernandev that enabled an attacker to impersonate any registered user in a Firebase application...

PT-2018-16087

Name of the Vulnerable Software and Affected Versions Trend Micro Control Manager version 6.0 Description A SQL injection remote code execution issue in the CGGIServlet component could allow a remote attacker to execute arbitrary code on vulnerable installations. This issue is related to the ID...

CVE-2018-3813

getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0 4.1.53.166 has Incorrect Access Control, as demonstrated by reading the AVIUSERID and AVIUSERPASSWORD fields via a direct request...

PT-2018-16208

Name of the Vulnerable Software and Affected Versions FLIR Brickstream 2300 devices versions 2.0 through 4.1.53.166 Description The issue concerns incorrect access control, allowing unauthorized reading of sensitive fields via a direct request. Specifically, the AVI USER ID and AVI USER PASSWORD...

CVE-2017-17776

Paid To Read Script 2.0.5 has full path disclosure via an invalid admin/userview.php uid parameter...

UBUNTU-CVE-2017-16997

elf/dl-load.c in the GNU C Library aka glibc or libc6 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged setuid or ATSECURE program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillinrpath...

DEBIAN-CVE-2017-17091

wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string...

PT-2017-14706

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.9.1 Description The issue allows remote attackers to bypass intended access restrictions. This is due to the newbloguser key being set to a string that can be directly derived from the user ID. Recommendations For...

CVE-2017-16821

b3log Symphony aka Sym 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated by a crafted X-Forwarded-For HTTP header that is mishandled during display of a client IP address in /admin/user/userid...

Unauthorized Access Vulnerability in Goodbody Knowledge Android APP of Tongfang Co.

Good Body Knowledge Android App is a software to detect the health data in your body. There is an override access vulnerability in the Good Body Knowledge Android APP of Tongfang Co. The attacker registers and logs into the system while grabbing packets and modifying the user ID to query any user...

kernel: load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary

A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was built as Position Independent Executable PIE, the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory...

kernel: load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary

A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was built as Position Independent Executable PIE, the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory...

kernel: load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary

A flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was built as Position Independent Executable PIE, the loader could allow part of that application's data segment to map over the memory area reserved for its stack, potentially resulting in memory...

DigiAffiliate 1.4 - Cross-Site Request Forgery (Update Admin)

!/usr/local/bin/python Exploit Title: DigiAffiliate 1.4 - Cross-Site Request Forgery Update Admin Dork: N/A Date: 18.09.2017 Vendor Homepage: http://www.digiappz.com/ Software Link: http://www.digiappz.com/digiaffiliate.asp?id=7 Demo: http://www.digiappz.com/digiaffiliate/login.asp Version: 1.4...

PT-2017-13321

Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.1-0 Description A SQL Injection issue exists in the EyesOfNetwork web interface, allowing exploitation via the user id cookie in the header.php file. Recommendations For version 5.1-0, consider restricting access to the...

DEBIAN-CVE-2017-14140

The movepages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable despite ASLR...

E-Charge APP for Android suffers from an override access vulnerability

E-Charge APP is a car charging service application, providing users with convenient electric vehicle charging functions, so that users can automatically check the nearest charging piles through the navigation, fast charging, and experience a green traveling life. E-Charge APP Android version of t...