98 matches found
CVE-2018-18562
An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Weak access credentials may enable attackers in the adjacent network to gain unauthorized service access via a service interface...
CVE-2018-18562
CVE-2018-18562 is an OS command injection vulnerability in Roche Accu-Chek Inform II Base Unit / Base Unit Hub and CoaguChek / cobas h232 Handheld Base Unit, before 03.01.04. The root cause is insecure operation allowing authenticated attackers in the adjacent network to execute arbitrary command...
Server side request forgery (ssrf)
The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery SSRF by creating an OAut...
Intimate Partner Threat
Princeton's Karen Levy has a good article computer security and the intimate partner threat: When you learn that your privacy has been compromised, the common advice is to prevent additional access -- delete your insecure account, open a new one, change your password. This advice is such standard...
Server Side Request Forgery(SSRF) in the Jira Trello importer - CVE-2017-16865
The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery SSRF. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access...
Server Side Request Forgery(SSRF) in the Jira Trello importer - CVE-2017-16865
The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery SSRF. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access...
The bundled Atlassian OAuth plugin allows arbitrary HTTP requests to be proxied - CVE-2017-9506
The version of the bundled Atlassian OAuth plugin was vulnerable to Server Side Request Forgery SSRF. This allowed a XSS and or a SSRF attack to be performed. More information about the Atlassian OAuth plugin issue see https://ecosystem.atlassian.net/browse/OAUTH-344 . When running in an...
Information disclosure
IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a privileged user to cause a memory dump that could contain highly sensitive information including access credentials. IBM X-Force ID: 128693...
CVE-2017-1495
IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a privileged user to cause a memory dump that could contain highly sensitive information including access credentials. IBM X-Force ID: 128693...
CVE-2017-1495
CVE-2017-1495 affects IBM InfoSphere Information Server and Information Server on Cloud. IBM’s Security Bulletin describes that a highly privileged user could cause the application to generate a memory dump containing highly sensitive information, including access credentials. Affected products/v...
Bellini/Supercook Wi-Fi Yumi SC200 Information Disclosure / Code Execution
Bellini/Supercook Wi-Fi Yumi SC200 - Multiple vulnerabilities Reported By: ================================== James McLean - Primary: james dot mclean at gmail dot com Secondary: labs at juicedigital dot net Device Overview: ================================== From...
ICS-CERT Alert on Easily Hackable Road Signs
A new, remotely exploitable vulnerability in Daktronics’ Vanguard software could make it even easier for attackers to hack electronic road signs, a task that was reportedly never very difficult to begin with. Daktronics’ Vanguard dynamic highway message sign configuration software was initially...
BlogEngine.NET <= 2.8.0.0 Information Disclosure Vulnerability - Active Check
BlogEngine.NET is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Cisco Prime Collaboration Assurance Cross-Site Scripting Vulnerability
A vulnerability in the Assurance component of Cisco Prime Collaboration could allow an unauthenticated, remote attacker to conduct several cross-site scripting XSS attacks against the user of the web interface of the affected system. The vulnerability is due to insufficient validation of user...
PT-2013-91: Hard-Coded Access Credentials in Emerson DeltaV
The specialists of the Positive Research center have detected a Hard-Coded Access Credentials vulnerability in Emerson DeltaV. An attacker can connect to the application using Telnet and run commands or change settings. How to fix Update your sofware up to the latest version Advisory status...
NEXTWEB (i)Site - 'login.asp' SQL Injection
source: https://www.securityfocus.com/bid/13834/info NEXTWEB iSite is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the...
