CVE-2018-20572: Improper Neutralization of Special Elements used in an SQL Command

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893...

PT-2018-15442

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue allows SQL injection via the keywords parameter in the "index.php?m=promote&f=index&v=search" endpoint. Recommendations For WUZHI CMS version 4.1.0, avoid using the keywords parameter in the affect...

Restored UEFI-based Windows 2008 R2 SP1 cannot be booted in Hyper-V environment

Challenge After successfully restoring a UEFI-based machine running Server 2008 R2 SP1 to a Hyper-V host, the VM fails to boot. Cause The machine fails to boot due to a machine configuration that conflicts with Hyper-V. For Hyper-V guest Virtual Machines, Server 2008 R2 is only support for use wi...

PT-2018-2673

Name of the Vulnerable Software and Affected Versions PEAR Archive Tar versions 1.4.3 and earlier Description The issue is related to the Archive Tar class, where several file operations use the $v header'filename' parameter. This can be exploited by crafting a tar file with a malicious path,...

Transcend Wi-Fi SD Card Cross Site Request Forgery / Traversal Vulnerabilities

Transcend Wi-Fi SD Card 16GB with firmware 1.8 suffers from cross site request forgery and directory traversal vulnerabilities. There are Directory Traversal and Cross-Site Request Forgery vulnerabilities in Transcend Wi-Fi SD Card. ------------------------- Affected products:...

Transcend Wi-Fi SD Card Cross Site Request Forgery / Traversal

Hello list! There are Directory Traversal and Cross-Site Request Forgery vulnerabilities in Transcend Wi-Fi SD Card. ------------------------- Affected products: ------------------------- Vulnerable is the next model: Transcend Wi-Fi SD Card 16 GB, Firmware v.1.8. This model with other firmware...

First Steps in Hyper-V Research

Microsoft has put a lot of effort in Hyper-V security. Hyper-V, and the whole virtualization stack, runs at the core of many of our products: cloud computing, Windows Defender Application Guard, and technology built on top of Virtualization Based Security VBS. Because Hyper-V is critical to so mu...

First Steps in Hyper-V Research

Microsoft has put a lot of effort in Hyper-V security. Hyper-V, and the whole virtualization stack, runs at the core of many of our products: cloud computing, Windows Defender Application Guard, and technology built on top of Virtualization Based Security VBS. Because Hyper-V is critical to so mu...

P2V of server targeting original server now re-imaged as a Hyper V host causing network disconnects due to MAC conflict

Challenge Instant Recovery of a Veeam Agent for Microsoft Windows Backup to Hyper V causes network disconnection on Hyper V host when the VM powers on. Cause The Instant Recovery VM will be assigned the original server's MAC address and the NIC will be set to static. If the original server is now...

How to Collect Logs for Veeam Management Pack for Microsoft System Center

Purpose This article documents how to collect logs for Veeam Management Pack for Microsoft System Center. Solution For VMware Infrastructure To investigate issues associated with a VMware Infrastructure, logs should be collected from both Veeam Management Pack for Microsoft System Center and the...

Security Bulletin: Information Disclosure in IBM WebSphere Application Server Liberty affects IBM Spectrum Protect for Virtual Environments (CVE-2018-1553)

Summary Information disclosure vulnerability in IBM WebSphere Application Server Liberty affects IBM Spectrum Protect formerly Tivoli Storage Mangaer for Virtual Environments. Vulnerability Details CVEID: CVE-2018-1553 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect for Virtual Environments (CVE-2018-1656, CVE-2018-12539)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ that is used by IBM Spectrum Protect formerly Tivoli Storage Manager for Virtual Environments: Data Protection for VMware and Data Protection for Hyper-V. These issues were disclosed as part of the IBM Java SDK updates i...

Microsoft Hyper-V Hardware Virtualization Code Execution

The vulnerability of Microsoft Hyper-V hardware virtualization technology for Windows operating systems exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code on the host operating system through a specially created...

SQL injection vulnerability in the V***.php file of Yunyu CMS enterprise website management system (CNVD-2018-24728)

YUNUCMS enterprise website management system YUNUCMS is a set of professional marketing enterprise building system based on PHP + MYSQL as the core development. SQL injection vulnerability exists in the V.php file of YUNUCMS enterprise website management system. An attacker can exploit the...

SQL injection vulnerability in the V***.php file of Yunyu CMS enterprise website management system (CNVD-2018-24729)

YUNUCMS enterprise website management system YUNUCMS is a set of professional marketing enterprise building system based on PHP + MYSQL as the core development. SQL injection vulnerability exists in the V.php file of YUNUCMS enterprise website management system. An attacker can exploit the...

openvswitch: Buffer over-read in lib/ofp-actions.c:decode_bundle()

An issue was discovered in Open vSwitch OvS 2.5.x through 2.5.5, 2.6.x through 2.6.3, 2.7.x through 2.7.6, 2.8.x through 2.8.4, and 2.9.x through 2.9.2 where the decodebundle function inside lib/ofp-actions.c is affected by a buffer over-read issue during BUNDLE action decoding. A specially craft...

openvswitch: Mishandle of group mods in lib/ofp-util.c:parse_group_prop_ntr_selection_method() allows for assertion failure

An issue was discovered in Open vSwitch OvS, 2.4.x through 2.4.1, 2.5.x through 2.5.5, 2.6.x through 2.6.3, 2.7.x through 2.7.6, 2.8.x through 2.8.4, and2.9.x through 2.9.2, affecting the parsegrouppropntrselectionmethod in lib/ofp-util.c. On controllers with the OpenFlow 1.5 decoder enabled, a...

'Fortnite' Scams Are Even Worse Than You Thought

YouTube videos with millions of views. Nearly 5,000 bogus websites. V-Bucks scammers have gotten out of control...

CVE-2018-18711: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=editinfo...

PT-2018-14590

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue allows changing the super administrator's username via the "index.php?m=member&f=index&v=edit&uid=1" endpoint, specifically targeting the uid variable set to 1, which corresponds to the super...