CVE-2013-4211

CVE-2013-4211 concerns OpenX Ad Server 2.8.10 which ships with a backdoor in flowplayer-3.1.1.min.js enabling remote code execution. The vulnerability allows a remote attacker to execute arbitrary PHP code on the server, with web server privileges, via a single crafted request (payload ROT13’d an...

500 Chrome Extensions Caught Stealing Private Data of 1.7 Million Users

Google removed 500 malicious Chrome extensions from its Web Store after they found to inject malicious ads and siphon off user browsing data to servers under the control of attackers. These extensions were part of a malvertising and ad-fraud campaign that's been operating at least since January...

SQL Injection Vulnerability in the ad***.php page of the Shipping 100 Virtual Goods Autoship system

Shipping 100 Virtual Goods Autoship System is a virtual goods autoship system/article pay to read system. SQL injection vulnerability exists in the ad.php page of the Shipment 100 virtual goods autoship system, which can be exploited by attackers to obtain sensitive information from the database...

PT-2020-7483

Name of the Vulnerable Software and Affected Versions: OpenX Ad Server version 2.8.10 Description: A code execution issue exists due to a backdoor in the flowplayer-3.1.1.min.js library, potentially allowing a remote malicious user to execute arbitrary PHP code. Recommendations: For OpenX Ad Serv...

CVE-2013-4211: Improper Control of Generation of Code

A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbitrary PHP code...

CVE-2014-4198

A Two-Factor Authentication Bypass Vulnerability exists in BS-Client Private Client 2.4 and 2.5 via an XML request that neglects the use of ADPswID and AD parameters, which could let a malicious user access privileged function...

Authentication flaw

A Two-Factor Authentication Bypass Vulnerability exists in BS-Client Private Client 2.4 and 2.5 via an XML request that neglects the use of ADPswID and AD parameters, which could let a malicious user access privileged function...

CVE-2014-4198

The vulnerability CVE-2014-4198 affects BS-Client Private Client, versions 2.4 and 2.5. A flaw in the authentication flow allows a two-factor bypass via an XML request that omits ADPswID and AD parameters, enabling a malicious user to access privileged functions. Root cause stated as improper han...

PT-2020-7674

Name of the Vulnerable Software and Affected Versions BS-Client Private Client versions 2.4 through 2.5 Description A Two-Factor Authentication Bypass issue exists, allowing a malicious user to access privileged functions via an XML request. This request neglects the use of ADPswID and AD...

CVE-2014-4198: Improper Authentication

A Two-Factor Authentication Bypass Vulnerability exists in BS-Client Private Client 2.4 and 2.5 via an XML request that neglects the use of ADPswID and AD parameters, which could let a malicious user access privileged function...

CVE-2020-2119

Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2119

Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

Design/Logic Flaw

Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2119

Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2119

Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

CVE-2020-2119

CVE-2020-2119 affects the Jenkins Azure AD Plugin (versions 1.1.2 and earlier). The issue: the plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially exposing client secrets (e.g., via browser extensions or XSS). Root cause is clear: cr...

PT-2020-15326 · Jenkins · Jenkins Azure Ad Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Azure AD Plugin versions 1.1.2 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure. Specificall...

Client secret transmitted in plain text by azure-ad

azure-ad stores a client secret in its global configuration. While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by azure-ad 1.1.2 and earlier. This can result in exposure of the credential through browser extensions, cross-site...

CVE-2020-2119: Insufficiently Protected Credentials

Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

Security fix for the ALT Linux 8 package samba-DC version 4.9.18-alt1

4.9.18-alt1 built Feb. 12, 2020 Evgeny Sinelnikov in task 245130 Jan. 24, 2020 Evgeny Sinelnikov - Update to latest security release of the Samba 4.9 - Security fixes: + CVE-2019-14902: Replication of ACLs set to inherit down a subtree on AD Directory not automatic + CVE-2019-14907: Crash after...