PT-2017-13563

Name of the Vulnerable Software and Affected Versions Atlassian Fisheye and Crucible versions prior to 4.4.2 Description The administration user deletion resource in Atlassian Fisheye and Crucible contains a cross site scripting XSS vulnerability in the uname parameter, allowing remote attackers ...

CVE-2017-15214

Flyspray 1.0-rc4 through 1.0-rc6 contains a stored XSS vulnerability. An authenticated user can inject JavaScript via the name, title, or id parameter in plugins/dokuwiki/lib/plugins/changelinks/syntax.php to execute code with administrator privileges or to target other users (including unauthent...

WebBreaker - Dynamic Application Security Test Orchestration (DASTO)

Build functional security testing, into your software development and release cycles! WebBreaker provides the capabilities to automate and centrally manage Dynamic Application Security Testing DAST as part of your DevOps pipeline. WebBreaker truly enables all members of the Software Security...

Some WEMs Agent are failing to check in with WEM Broker

Many WEM Agents do not check in with the WEM Broker Server and they are missing from the Agent List inside of the WEM Administration Console. For example, this screenshot shows only 4 Agents checking in but dozens more WEM Agents are configured and should be present in this list: The Debug logs o...

Mouse and Keyboard functions become unresponsive when launching or refreshing agent if it is not bound to a WEM Configuration Set.

If the WEM agent, vuemUIAgent.exe, is launched or refreshed when it is not bound to a "Configuration Set" inside the WEM Administration Console, the keyboard and mouse functions lock. The WEM Agent in question is in the following screenshot: This is a known issue where keyboard/mouse hooks are no...

[SECURITY] Fedora 26 Update: perl-5.24.3-395.fc26

Perl is a high-level programming language with roots in C, sed, awk and she ll scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common...

[SECURITY] Fedora 27 Update: perl-5.26.1-401.fc27

Perl is a high-level programming language with roots in C, sed, awk and she ll scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common...

NPM-V (Network Power Manager) 2.4.1 - Password Reset Vulnerability

Exploit for hardware platform in category web applications NPM-VNetwork Power Manager = 2.4.1 Reset Password Vulnerability Author: Saeed reza Zamanian penetrationtest @ Linkedin Product: NPM-V Affected Version : 2.4.1 and below Vendor : http://www.china-clever.com Product Link :...

CVE-2017-12230

A vulnerability in the web-based user interface web UI of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incorrect default permission settings for new users who are created by using the web UI of the...

OWASP AntiSamy CVE-2017-14735 Cross Site Scripting Vulnerability

Description OWASP AntiSamy is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the...

Code injection

Vulnerability issues with the web service inspection of input parameters in Trend Micro Web Security Virtual Appliance 6.5 may allow potential attackers who already have administration rights to the console to implement remote code injections...

Command injection

Command injection vulnerability in Trend Micro Smart Protection Server Standalone 3.1 and 3.2 server administration UI allows attackers with authenticated access to execute arbitrary code on vulnerable installations...

CVE-2017-11396

Vulnerability issues with the web service inspection of input parameters in Trend Micro Web Security Virtual Appliance 6.5 may allow potential attackers who already have administration rights to the console to implement remote code injections...

CVE-2017-11396

Vulnerability issues with the web service inspection of input parameters in Trend Micro Web Security Virtual Appliance 6.5 may allow potential attackers who already have administration rights to the console to implement remote code injections...

PT-2017-11980

Name of the Vulnerable Software and Affected Versions Trend Micro Web Security Virtual Appliance version 6.5 Description The issue concerns the web service inspection of input parameters, potentially allowing attackers with administration rights to the console to implement remote code injections...

CVE-2017-11396: Undefined Security Weakness

Vulnerability issues with the web service inspection of input parameters in Trend Micro Web Security Virtual Appliance 6.5 may allow potential attackers who already have administration rights to the console to implement remote code injections...

CVE-2017-11395: Improper Neutralization of Special Elements used in an OS Command

Command injection vulnerability in Trend Micro Smart Protection Server Standalone 3.1 and 3.2 server administration UI allows attackers with authenticated access to execute arbitrary code on vulnerable installations...

PT-2017-11979

Name of the Vulnerable Software and Affected Versions Trend Micro Smart Protection Server Standalone versions 3.1 through 3.2 Description A command injection issue exists in the server administration UI, allowing attackers with authenticated access to execute arbitrary code on vulnerable...

Fake IRS notice delivers customized spying tool

While macro-based documents and scripts make up for the majority of malspam attacks these days, we also see some campaigns that leverage documents embedded with exploits. Case in point, we came across a malicious Microsoft Office file disguised as a CP2000 notice. The Internal Revenue Service IRS...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 first name or 2 last name user details, or the 3 repository, 4 repository group, or 5 user group description...