RHEL 7 : jasper (RHSA-2018:3253)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3253 advisory. - jasper: reachable assertion in JPCNOMINALGAIN CVE-2016-9396 - jasper: NULL pointer exception in jp2encode CVE-2017-1000050 Note that Nessu...

samba: Weak authentication protocol regression

A flaw was found in the way samba allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client...

OrientDB Server Community Edition uses insufficiently random values to generate session IDs

OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values in the server/network/protocol/http/OHttpSessionManager.java, which makes it easier for remote attackers to predict a value by...

NUUO CMS Code Execution Vulnerability (CNVD-2018-21168)

NUUO CMS is a set of centralized software management platform from NUUO. The platform is used to centrally manage devices such as NVRs hard disk recorders and IP cameras, and provides functions such as user management and alarm management. A security vulnerability exists in NUUO CMS 3.1 and earli...

VMware Workstation SVGA Heap-based Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the guest system in order to exploit this vulnerability. The specific flaw exists within the handling ...

The vulnerability of microprogrammed software in Schneider Electric Modicon M221 programmable logic controllers arises from deficiencies in the authentication process, which allows attackers to bypass the authentication procedures.

The vulnerability of the microprogrammed software in Schneider Electric Modicon M221 programmable logic controllers is due to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to bypass the authentication process remotely...

The vulnerability of the encryption module for internal data in Philips e-Alert Unit software solutions allows a intruder to gain full access to the device’s data.

The vulnerability of the encryption module for internal data in Philips e-Alert Unit medical visualization systems arises from the rigid encoding of the cryptographic key used for encrypting internal data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full...

The vulnerability of microprogrammed software in Schneider Electric Modicon M221 programmable logic controllers is caused by deficiencies in the authentication process, allowing attackers to re-enter passwords.

The vulnerability of the microprogrammed software in Schneider Electric Modicon M221 programmable logic controllers is due to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to remotely reassign passwords...

chromium-browser: Script injection in New Tab Page

Insufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension...

CVE-2018-10936

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by...

ICSMA-18-240-01_Qualcomm Life Capsule

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Qualcomm Life Equipment: Capsule Datacaptor Terminal Server DTS Vulnerability: Code Weakness 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute...

The vulnerability of the microprogramming software of the 4G LTE Light Industrial M2M Router (NWL-25) arises from the lack of measures taken to protect the website structure. This allows attackers to execute arbitrary JavaScript code in the user’s browser.

The vulnerability of the microprogrammed software of the 4G LTE Light Industrial M2M Router NWL-25 is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code in the user’s browser remotely...

CVE-2017-13108

DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

Email Phishers Using New Way to Bypass Microsoft Office 365 Protections

Phishing works no matter how hard a company tries to protect its customers or employees. Security researchers have been warning of a new phishing attack that cybercriminals and email scammers are using in the wild to bypass the Advanced Threat Protection ATP mechanism implemented by widely used...

ASUSTOR NAS ADM 3.1.0 Remote Command Execution / SQL Injection

Product - ASUSTOR ADM - 3.1.0.RFQ3 and all previous builds Vendor - https://www.asustor.com/ Patch Notes - http://download.asustor.com/download/docs/releasenotes/RNADM3.1.3.RHU2.pdf Issue: The Asustor NAS appliance on ADM 3.1.0 and before suffer from multiple critical vulnerabilities. The...

The vulnerability of the Print Server component in the business application for managing and distributing information to customers, known as One-to-One Fulfillment, allows a malicious actor to gain unauthorized access to protected data.

The vulnerability of the Print Server component in the business application for managing and distributing information to customers, known as One-to-One Fulfillment, is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to ga...

The vulnerability of the Script Author component in the scripting software for creating and processing scripts allows a perpetrator to gain unauthorized access to protected data.

The vulnerability of the Script Author component in the scripting software for creating and processing scripts is related to lack of access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data using the HTTP protocol...

CVE-2017-17708

Because of insufficient authorization checks it is possible for any authenticated user to change profile data of other users in Pleasant Password Server before 7.8.3...

shop.bastuck2.de XSS vulnerability

Open Bug Bounty ID: OBB-655081 Description| Value ---|--- Affected Website:| shop.bastuck2.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Code injection

The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property IP, as well as the management of access rights for such IP, including improperly specified HDL syntax allows use of an EDA tool as a decryption oracle. The methods are flawed and, in the most...