The vulnerability of the AMD Secure Processor implementation in EPYC Server processors allows for writing to the secure memory region of the processor.

The vulnerability of the AMD Secure Processor implementation in EPYC Server processors lies in the deficiencies in the implementation of the loader responsible for verifying the functionality of the hardware, as well as for initiating the AMD Secure Processor module. Exploiting this vulnerability...

The vulnerability affects the implementation of the AMD Secure Processor technology in CPUs such as Ryzen, Ryzen Pro, Ryzen Mobile, and EPYC Server. This allows malicious code to be injected into a computer’s BIOS.

The vulnerability of AMD Secure Processor-based processors, such as Ryzen, Ryzen Pro, Ryzen Mobile, and EPYC Server, stems from the absence of a mechanism for detecting damage to flash memory contents. Exploiting this vulnerability allows an attacker who has access to the targeted computer and...

CVE-2017-4028

Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate products allows an administrator to inject arbitrary code into a debugged McAfee process via manipulation of registry parameters...

SQL Code Injection

textpattern/lock is vulnerable to SQL injection. The attacker can launch the attack via the "qty" on the page index.php with authentication as administrator...

Code injection

Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard...

CVE-2016-0235

CVE-2016-0235 affects IBM Security Guardium Database Activity Monitor V10, where a hard-coded password available to an administrator or root user enables potential access across GRUB-based systems. The root cause is use of a hard-coded credential within the Guardium component, allowing local acce...

CVE-2018-7228

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote attacker to bypass authentication and get the administrator privileges...

CVE-2017-17323

Huawei iBMC on V200R002C10/C20/C30 contains an improper authorization vulnerability where a normal user can access information intended for admins due to inadequate authorization checks, potentially leading to information disclosure. A Huawei security advisory confirms a fix in iBMC and notes pat...

CVE-2018-5313

A vulnerability allows local attackers to escalate privilege on Rapid Scada 5.5.0 because of weak C:\SCADA permissions. The specific flaw exists within the access control that is set and modified during the installation of the product. The product sets weak access control restrictions. An attacke...

CVE-2018-6926

In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems where rhshellfix was enabled, and consequently allowed site admins to inject arbitrary OS commands. The impact is limited by th...

Cozy Cross-Site Scripting Vulnerability

Cozy is a personal cloud platform. The platform features file storage and management, application backup, and schedule management. A cross-site scripting vulnerability exists in Cozy. A remote attacker can exploit this vulnerability to gain administrator access via JavaScript code in the 'url'...

Enable Alt-Tab Hotkey Within A Citrix Desktop Session - Citrix Workspace App

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Executing ALT+TAB keys, toggles opened applications on endpoint machine instead of Citrix Desktop...

Asus asuswrt session token predictability vulnerability

ASUSWRT, the unified firmware used by ASUS in its latest routers, is a web-based graphical user interface for ASUS routers. A highly predictable session token vulnerability exists in the HTTPd server in Asus asuswrt versions 3.0.0.4.380.7743 and earlier. An attacker could exploit this vulnerabili...

CVE-2017-16605

This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

CVE-2017-16604

This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

CVE-2017-16590

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 1001. User interaction is required to exploit this vulnerability. The specific flaw exists within the MainFilter servlet. The issue results from the...

Design/Logic Flaw

This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

Design/Logic Flaw

This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

CVE-2017-16604

This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

CVE-2018-5706

An issue was discovered in Octopus Deploy before 4.1.9. Any user with user editing permissions can modify teams to give themselves Administer System permissions even if they didn't have them, as demonstrated by use of the RoleEdit or TeamEdit permission...