CVE-2016-9489

ManageEngine Applications Manager (product family) versions 12 and 13 before build 13200 are affected. An authenticated user can modify their own properties (including group) to gain higher privileges (e.g., ADMIN) and can alter properties of other users, such as changing another user’s password....

CVE-2016-6567

The CVE-2016-6567 entry describes SHDesigns’ Resident Download Manager for Rabbit 2000/3000 CPU boards as not authenticating firmware updates before executing code. A remote attacker able to send UDP traffic could potentially execute arbitrary code on the device. Public details indicate the Resid...

CVE-2016-9491 ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entity

ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page most likely limited to administrator, to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By...

CVE-2016-9489 ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypass

In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change...

CVE-2016-6549 Zizai Tech Nut allows for unauthenticated Bluetooth pairing

The Zizai Tech Nut device allows unauthenticated Bluetooth pairing, which enables unauthenticated connected applications to write data to the device name attribute...

CVE-2016-6567 SHDesigns' Resident Download Manager (as well as the Ethernet Download Manager) does not authenticate firmware downloads before executing code and deploying them to devices

SHDesigns' Resident Download Manager provides firmware update capabilities for Rabbit 2000/3000 CPU boards, which according to the reporter may be used in some industrial control and embedded applications. The Resident Download Manager does not verify that the firmware is authentic before executi...

CVE-2016-9491

The CVE-2016-9491 entry applies to ManageEngine Applications Manager 12 and 13 prior to build 13690. An authenticated user able to access the /register.do page (likely an administrator) could browse the filesystem and read system files, including Applications Manager configuration and stored priv...

CVE-2016-9498

CVE-2016-9498 affects ManageEngine Applications Manager 12 and 13 before build 13200. An insecure deserialization flaw in the included Apache Commons Collections library enables a remote, unauthenticated attacker to craft messages to the RMI service (port 11099/TCP) and execute arbitrary code, po...

Zero-Day Coverage Update – Week of July 9, 2018

Earlier this week, I wrote a blog covering a couple of the statistics from the Zero Day Initiative’s ZDI first half of 2018. One of the stats that I didn’t cover is the increasing focus on enterprise applications. The team is seeing consistent growth in submissions of Microsoft and Apple...

CVE-2018-14054: LibMP4v2 MP4StringProperty Handling Double Free Vulnerability

LibMP4v2 is an open source MP4 processing library, designed to create and modify MP4 files as defined by ISO-IEC:14496-1:2001 MPEG-4 Systems. Originally discovered by Ruikai Liu, a double free vulnerability was found in the MP4StringProperty code. While parsing MP4 atoms, it is possible to cause ...

Important: Red Hat Enhancement Advisory: Red Hat JBoss Web Server 5.0.0 enhancement update

Updated Red Hat JBoss Web Server 5.0.0 packages are now available for Red Hat Enterprise Linux 6. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apach...

Important: Red Hat Enhancement Advisory: Red Hat JBoss Web Server 5.0.0 enhancement update

Updated Red Hat JBoss Web Server 5.0.0 packages are now available for Red Hat Enterprise Linux 7. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apach...

Free High-Tech Bridge ImmuniWeb Application Discovery service

Today I would like to talk about another service for application security analysis by High-Tech Bridge. It's called ImmuniWeb Application Discovery. This service can get information about your web and mobile applications available from the Internet. Believe me, this is not so obvious for a large...

CVE-2018-5884

Improper Access Control in Multimedia in Snapdragon Mobile and Snapdragon Wear, Non-standard applications without permission may acquire permission of Qualcomm-specific proprietary intents...

CVE-2018-5884

Improper Access Control in Multimedia in Snapdragon Mobile and Snapdragon Wear, Non-standard applications without permission may acquire permission of Qualcomm-specific proprietary intents...

CVE-2017-1237

IBM Jazz based applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124355...

CVE-2017-1237

CVE-2017-1237 concerns a cross-site scripting vulnerability in IBM Jazz-based applications. The issue affects IBM Jazz Team Server and CLM-related products (CLM, RDNG, RELM, RTC, RQM, Rhapsody Design Manager, RSA Design Manager) across multiple versions (notably 5.0.x to 6.0.x). The underlying ri...

CVE-2017-1237

IBM Jazz based applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124355...

[SECURITY] Fedora 27 Update: ant-1.10.1-10.fc27

Apache Ant is a Java library and command-line tool whose mission is to drive processes described in build files as targets and extension points dependent upon each other. The main known usage of Ant is the build of Java applications. Ant supplies a number of built-in tasks allowing to compile,...

[SECURITY] Fedora 27 Update: libgit2-0.26.4-1.fc27

libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language with bindings...