CVE-2017-2613

jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records SECURITY-406. Accessing these URLs now n...

CVE-2017-2613

CVE-2017-2613 concerns Jenkins where certain admin GET actions can trigger CSRF to create users. Affected products/versions: Jenkins core vulnerable before 2.44 and 2.32.x before 2.32.2 (also affecting related Jenkins products in advisories). Root cause: possible CSRF via HTTP GET that enables cr...

FAQ: Citrix Secure Mail APNS for IT Admins

This article provides answers to frequently asked questions onCitrix Secure Mail APNS forIT Admins.For more information on Push Notifications for Secure Mail, refer to Citrix Documentation - Rich Push Notifications for Secure Mail for iOS. General Overview Q1: Why does Secure Mail for iOS require...

Third Critical Drupal Flaw Discovered—Patch Your Sites Immediately

Damn! You have to update your Drupal websites. Yes, of course once again—literally it's the third time in last 30 days. As notified in advance two days back, Drupal has now released new versions of its software to patch yet another critical remote code execution RCE vulnerability, affecting its...

Police Shut Down World's Biggest 'DDoS-for-Hire' Service–Admins Arrested

In a major hit against international cybercriminals, the Dutch police have taken down the world's biggest DDoS-for-hire service that helped cyber criminals launch over 4 million attacks and arrested its administrators. An operation led by the UK's National Crime Agency NCA and the Dutch Police,...

Confluence error pages should remove stack trace from being output to the UI

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. panel h3. Problem Definition The Confluence error page typically displays "Oops - an error has occurred", it displays System error, the cause, then the stack trace that deals with that error. This is not desirable for all...

CVE-2018-9010

Intelbras TELEFONE IP TIP200/200 LITE 60.0.75.29 devices allow remote authenticated admins to read arbitrary files via the /cgi-bin/cgiServer.exx page parameter, aka absolute path traversal. In some cases, authentication can be achieved via the admin account with its default admin password...

Exponent CMS 2.4.1 Patch 5 - Privilege Escalation Vulnerability

Exponent CMS allows rogue admins to elevate their privileges. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

CVE-2018-7567

In the Admin Package Manager in Open Ticket Request System OTRS 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blind Remote Code Execution vulnerability by loading a crafted opm file with an embedded CodeInstall element to execute a command on the server...

CVE-2017-15613

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in the cmxddns.lua file...

CVE-2017-15617

TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the iface variable in the interfacewan.lua file...

CVE-2017-15631

CVE-2017-15631 affects TP-Link WVR, WAR and ER devices. A vulnerability in the pptp_client.lua module allows a remote authenticated administrator to execute arbitrary commands via the new-workmode variable (command injection). According to the provided metrics, the CVSSv3 base score is 7.2 (HIGH)...

CVE-2018-5244

In Xen 4.10, new infrastructure was introduced as part of an overhaul to how MSR emulation happens for guests. Unfortunately, one tracking structure isn't freed when a vcpu is destroyed. This allows guest OS administrators to cause a denial of service host OS memory consumption by rebooting many...

CVE-2017-17561

SeaCMS 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/adminping.php, which interacts with data/admin/ping.php...

SSL VPN Web Portal user credentials may be leaked to super_admins

An admin user with superadmin privileges i.e. with a superadmin profile may view the current sslvpn web portal session info, using the fnsysctl CLI command. This info includes user credentials...

CVE-2017-17383

Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form, as demonstrated by the JDK tool in Jenkins core and the Ant tool in the Ant plugin, aka SECURITY-624...

Jenkins cross-site scripting vulnerability (CNVD-2018-00230)

Jenkins is an open source continuous integration tool written in Java. A stored cross-site scripting vulnerability exists in 2.93 and earlier versions of Jenkins. A remote authenticated administrator can exploit this vulnerability via a specially crafted tool name in a job configuration form to...

CVE-2017-14585

A Server Side Request Forgery SSRF vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hipchat Server starting with 2.2.0 and before 2.2.6 are affecte...

Adobe Patches Flash Player, 56 Bugs in Reader and Acrobat

Adobe kicked off today’s Patch Tuesday barrage with a monster update for Acrobat and Reader patching dozens of remote code execution vulnerabilities, along with the near-customary Flash Player update addressing a handful of critical flaws. None of the vulnerabilities patched today are under activ...

DEBIAN-CVE-2017-16660

Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remoteagent.php request containing PHP code in a Client-ip header...