CVE-2018-3140: Undefined Security Weakness

Vulnerability in the Hyperion Essbase Administration Services component of Oracle Hyperion subcomponent: EAS Console. The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Essbase...

CVE-2018-3242: Undefined Security Weakness

Vulnerability in the Oracle Marketing component of Oracle E-Business Suite subcomponent: Marketing Administration. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2018-3142: Undefined Security Weakness

Vulnerability in the Hyperion Essbase Administration Services component of Oracle Hyperion subcomponent: EAS Console. The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Hyperion Essbase...

Privacy Regulation Could Be a Test for States’ Rights

When the California Consumer Privacy Act CCPA passed in June, security experts applauded the state legislation as a win for consumers. The ruling gave residents certain rights around how their personal data can be stored, accessed, sold and deleted. But months later in September, the U.S. Chamber...

PT-2018-2232

Name of the Vulnerable Software and Affected Versions Oracle iLearning versions 6.1 through 6.2 Description The issue is related to inadequate access control in the Learner Administration component of Oracle iLearning, allowing an unauthenticated attacker with network access via HTTP to compromis...

PT-2018-2251

Name of the Vulnerable Software and Affected Versions Oracle GlassFish Server version 3.1.2 Description The issue is related to insufficient access control in the Administration component of Oracle GlassFish Server, allowing a remote attacker to cause a denial of service using the HTTP protocol...

Google Releases Security Update for Chrome

Google has released Chrome version 70.0.3538.67 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system. NCCIC encourages users and administrators to review the Chrome Releases page and apply the necessary update. Th...

PT-2018-2356

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Essbase Administration Services version 11.1.2.4 Description The issue is related to insufficient access control in the EAS Console component of Oracle Hyperion Essbase Administration Services. This can be exploited by a remote...

PT-2018-2244

Name of the Vulnerable Software and Affected Versions Oracle Sun Systems Products Suite versions 11.3 Description The issue is related to a vulnerability in the Remote Administration Daemon RAD component of the Solaris operating system, which is part of the Oracle Sun Systems Products Suite. This...

PT-2018-2246

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Essbase Administration Services version 11.1.2.4 Description The issue is related to inadequate access control in the EAS Console component of Oracle Hyperion Essbase Administration Services. This can be exploited by a remote...

PT-2018-2239

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1 through 12.1.3 Oracle E-Business Suite versions 12.2.3 through 12.2.7 Description The issue is related to inadequate access control in the Oracle Marketing component, specifically the Marketing...

Null pointer dereference

Incorrect handling of an invalid value for an HTTP request parameter by Directory Server aka Enterprise Server Administration web UI in Micro Focus Enterprise Developer and Enterprise Server 2.3 Update 2 and earlier, 3.0 before Patch Update 12, and 4.0 before Patch Update 2 causes a null pointer...

PT-2018-11200

Name of the Vulnerable Software and Affected Versions Micro Focus Enterprise Developer and Enterprise Server versions 2.3 Update 2 and earlier, 3.0 before Patch Update 12, 4.0 before Patch Update 2 Description The issue arises from the incorrect handling of an invalid value for an HTTP request...

HaPe PKH 1.1 Cross Site Request Forgery

Exploit Title: HaPe PKH 1.1 - Cross-Site Request Forgery Update Admin Dork: N/A Date: 2018-10-12 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.sitejo.id Software Link: https://sourceforge.net/projects/hape-pkh/files/latest/download Version: 1.1 Category: Webapps Tested on:...

DELL EMC OneFS Storage Administration 8.1.2.0 .zshrc Overwrite

!/usr/bin/env python Exploit name : isilon-onefs-brute.py Created date : 9/21/18 Submit Date : 10/10/18 Author : wetw0rk Python version : 2.7 Brute Force Script:...

CVE-2018-0059

A persistent cross-site scripting vulnerability in the graphical user interface of ScreenOS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

Cross site scripting

A persistent cross-site scripting vulnerability in the graphical user interface of ScreenOS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform...

Junos Space Security Director: XSS vulnerability in web administration

A persistent cross-site scripting vulnerability in the UI framework used by Junos Space Security Director may allow authenticated users to inject persistent and malicious scripts. This may allow stealing of information or performing actions as a different user when other users access the Security...

CVE-2018-8006

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter...

CVE-2018-8006

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter...