4581 matches found
CVE-2015-7596
SafeNet Authentication Service End User Software Tools for Windows uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module...
The vulnerability of the quickTemplateSelect.xhtml component of the HPE Intelligent Management Center PLAT software platform allows a perpetrator to execute arbitrary code.
The vulnerability of the quickTemplateSelect.xhtml component in the HPE Intelligent Management Center PLAT software platform is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code using the beanName parameter...
OpenJDK: insufficient strength of key agreement (JCE, 8185292)
It was discovered that the key agreement implementations in the JCE component of OpenJDK did not guarantee sufficient strength of used keys to adequately protect generated shared secret. This could make it easier to break data encryption by attacking key agreement rather than the encryption using...
foreman: models with a 'belongs_to' association to an Organization do not verify association belongs to that Organization
It was found that foreman in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations...
The vulnerability of the MembersApp component of the SAP NetWeaver software integration platform allows a hacker to disclose user information.
The vulnerability of the MembersApp component of the SAP NetWeaver software integration platform is related to insufficient data protection. Exploiting this vulnerability allows a malicious actor to obtain user information such as listing user names by taking advantage of the temporary difference...
The vulnerability of Phoenix Contact FL SWITCH router microprogramming software, related to deficiencies in authentication procedures, allows a intruder to access diagnostic information.
The vulnerability of Phoenix Contact FL SWITCH router microprogramming software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to remotely access diagnostic information by using the device’s monitoring mode...
The vulnerability of Phoenix Contact FL SWITCH router microprogramming software, related to deficiencies in authentication procedures, allows a malicious actor to gain access to the device with administrator privileges.
The vulnerability of Phoenix Contact FL SWITCH router microprogramming software is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain administrator privileges through specially crafted HTTP requests...
Microsoft Intune App PIN Bypass
COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: Microsoft Intune 1 Vendor: Microsoft CSNC ID: CSNC-2017-027 Subject: App PIN Bypass Risk: Medium Effect: Locally exploitable Author: Stephan Sekula Date: 31.08.2017 Introduction: ------------- Define a mobile...
LogicalDOC Enterprise 7.7.4 - User Enumeration
LogicalDOC Enterprise 7.7.4 - User Enumeration LogicalDOC Enterprise 7.7.4 Username Enumeration Weakness Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary: LogicalDOC is a free document management...
LogicalDOC Enterprise 7.7.4 - User Enumeration
LogicalDOC Enterprise 7.7.4 Username Enumeration Weakness Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary: LogicalDOC is a free document management system that is designed to handle and share...
LogicalDOC Enterprise 7.7.4 Username Enumeration Weakness
Summary LogicalDOC is a free document management system that is designed to handle and share documents within an organization. LogicalDOC is a content repository, with Lucene indexing, Activiti workflow, and a set of automatic import procedures. Description The weakness is caused due to the...
CVE-2018-1000048
NASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval functionality of RtRetrieval framework that can result in remote code execution. This attack appear to be exploitable via Victim tries to retrieve and process a weather data file...
Banknotes Misproduction security & biometric weakness
Document Title: =============== Banknotes Misproduction security & biometric weakness References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2105 Download: https://www.vulnerability-lab.com/resources/documents/7692342363856723534.rar Release Date: ============= 2018-01-29...
Banknotes Misproduction security & biometric weakness
Document Title: =============== Banknotes Misproduction security & biometric weakness References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2106 Video: https://www.youtube.com/watch?v=ORbU8fyhkgY Advisory: https://www.vulnerability-lab.com/getcontent.php?id=2105 Vulnerabilit...
Banknotes Misproduction security & biometric weakness
Document Title: =============== Banknotes Misproduction security & biometric weakness References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2106 Video: https://www.youtube.com/watch?v=ORbU8fyhkgY Advisory: https://www.vulnerability-lab.com/getcontent.php?id=2105 Vulnerabilit...
Unbound < 1.6.8 Wildcard Synthesized NSEC Records Handling Remote Validation Weakness
According to its self-reported version number, the remote Unbound DNS resolver is affected by a validation weakness when handling wildcard synthesized NSEC records. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106384; scriptversion"1.5"; scriptcvsdate"Date:...
Telerik UI for ASP.NET AJAX 2012.3.1308 2017.1.118 - Encryption Keys Disclosure
Telerik UI for ASP.NET AJAX 2012.3.1308 2017.1.118 - Encryption Keys Disclosure Exploit Title: Telerik UI for ASP.NET AJAX DialogHandler Dialog cracker Filename: dpcrypto.py Github: https://github.com/bao7uo/dpcrypto Date: 2018-01-23 Exploit Author: Paul Taylor / Foregenix Ltd Website:...
Telerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Encryption Keys Disclosure
Exploit Title: Telerik UI for ASP.NET AJAX DialogHandler Dialog cracker Filename: dpcrypto.py Github: https://github.com/bao7uo/dpcrypto Date: 2018-01-23 Exploit Author: Paul Taylor / Foregenix Ltd Website: http://www.foregenix.com/blog Version: Telerik UI for ASP.NET AJAX CVE: CVE-2017-9248 Vend...
OpenJDK: insufficient strength of key agreement (JCE, 8185292)
It was discovered that the key agreement implementations in the JCE component of OpenJDK did not guarantee sufficient strength of used keys to adequately protect generated shared secret. This could make it easier to break data encryption by attacking key agreement rather than the encryption using...
PT-2018-3325
Name of the Vulnerable Software and Affected Versions jackson-databind affected versions not specified Description The issue is related to weaknesses in the deserialization mechanism of the jackson-databind library. Exploitation of this issue may allow a remote attacker to execute arbitrary code...