Security Bulletin: Vulnerabilities in Expat affect Intel (R) Manycore Platform Software Stack (MPSS) for Linux and Windows

Summary Intel R Manycore Platform Software Stack MPSS for Linux and Windows have addressed the following vulnerabilities in Expat. Vulnerability Details Summary Intel® Manycore Platform Software Stack MPSS for Linux and Windows have addressed the following vulnerabilities in Expat. Vulnerability...

Google Chrome Insufficient Policy Enforcement Vulnerability

Chrome is a web browsing tool developed by Google. A policy enforcement insufficiency vulnerability exists in Canvas in versions of Google Chrome prior to 72.0.3626.81. An attacker can exploit this vulnerability to leak cross-origin data via a crafted HTML page...

The vulnerability of the Enterprise Manager Base Platform (EM Console) software platform of Oracle Enterprise Manager allows a perpetrator to gain unauthorized access to protected data.

The vulnerability of the Enterprise Manager Base Platform EM Console software platform of Oracle Enterprise Manager is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected data using the...

The vulnerability of the Outside In Filters component within the Oracle Outside In Technology SDK allows a malicious actor to gain unauthorized access to data or cause service failures.

The vulnerability of the Outside In Filters component within the Oracle Outside In Technology SDK is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to data or cause service failures using the HTTP protocol...

The vulnerability of the Fluid Core component in the Oracle PeopleSoft Enterprise PeopleTools business application suite allows a hacker to gain unauthorized access to protected data.

The vulnerability of the Fluid Core component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data using the...

Rukovoditel Project Management CRM 2.4.1 - lists_id SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Rukovoditel Project Management CRM 2.4.1 - 'listsid' SQL Injection Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.rukovoditel.net/ Software Link: https://sourceforge.net/projects/rukovoditel/ Version: 2.4.1 Categor...

What is a vulnerability and what is not?

It looks like a pretty simple question. I used it to started my MIPT lecture. But actually the answer is not so obvious. There are lots of formal definitions of a vulnerability. For example in NIST Glossary there are 17 different definitions. The most popular one used in 13 documents is:...

The vulnerability of the Access and Security component of the data management application in the Oracle Hyperion Data Relationship Management environment allows a perpetrator to gain unauthorized access to protected data.

The vulnerability of the Access and Security component of the Oracle Hyperion Data Relationship Management data management application relates to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected dat...

The vulnerability of the Object Store component in the Sun ZFS Storage Appliance Kit (AK) allows a hacker to gain full control over the application.

The vulnerability of the Object Store component in the Sun ZFS Storage Appliance Kit is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain full control over the application...

The vulnerability of the “Outside In” component in Oracle’s software development kit (SDK) allows a hacker to trigger a service failure.

The vulnerability of the Outside component in Oracle’s software development kit SDK is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to cause a service failure using the HTTP protocol...

Command Execution Vulnerability in HDCMS v2.0

HDCMS is a content management system software package developed in PHP+Mysql. It provides customers with powerful and complete functionality to accomplish rapid website development. A command execution vulnerability exists in HDCMS v2.0, which can be exploited by an attacker to gain control of a...

Bomb Threat, Sextortion Spammers Abused Weakness at GoDaddy.com

Two of the most disruptive and widely-received spam email campaigns over the past few months -- including an ongoing sextortion email scam and a bomb threat hoax that shut down dozens of schools, businesses and government buildings late last year -- were made possible thanks to an authentication...

ManageEngine OpManager 12.3 Privilege Escalation

ManageEngine OpManager Privilege Escalation Vendor: Zoho Corporation Pvt. Ltd. Product web page: https://www.manageengine.com Affected version: 12.3 Summary: OpManager offers comprehensive network monitoring capabilities that help you monitor network performance, detect network faults in real tim...

The vulnerability of the MailConnect function in the software controller allows for an SSRF attack by the intruder, enabling them to carry out a malicious action. This vulnerability is present in the D-Link Central WiFi Manager, a device used for centralized control of wireless networks.

The vulnerability of the MailConnect function in the D-Link Central WiFi Manager software control panel exists due to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

Streamworks Job Scheduler Release 7 Authentication Weakness

Affected Products Streamworks Job Scheduler Release 7 older/newer releases have not been tested References Secuvera-SA-2016-01 https://www.secuvera.de/advisories/secuvera-SA-2016-01.txt used for updates No CVE number could be assigned vendor not listed under...

The vulnerability of the Microsoft Foundation Classes (MFC) in the Microsoft Exchange Server mail server allows a hacker to execute arbitrary code.

The vulnerability of the Microsoft Foundation Classes MFC in the Microsoft Exchange Server mail server is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the Exchange Outlook Web Access (OWA) component of the Microsoft Exchange Server allows a hacker to disclose protected information.

The vulnerability of the Exchange Outlook Web Access OWA component of the Microsoft Exchange Server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to disclose sensitive information by sending a specially crafted email message to the user,...

CVE-2018-2499

A security weakness in SAP Financial Consolidation Cube Designer BOBJEADES fixed in versions 8.0, 10.1 may allow an attacker to discover the password hash of an admin user...

Design/Logic Flaw

A security weakness in SAP Financial Consolidation Cube Designer BOBJEADES fixed in versions 8.0, 10.1 may allow an attacker to discover the password hash of an admin user...

CVE-2018-2499

A security weakness in SAP Financial Consolidation Cube Designer BOBJEADES fixed in versions 8.0, 10.1 may allow an attacker to discover the password hash of an admin user...