CVE-2018-1000610

The CVE-2018-1000610 entry concerns the Jenkins Configuration as Code Plugin (0.7-alpha and earlier). The vulnerability arises from insecure handling of passwords configured via the plugin, specifically in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, and ExtensionConfigurato...

Hikvision hik-connect.com Authentication Vulnerability

Hikvision is a provider of video-centric IoT solutions. An authentication vulnerability exists in Hikvision hik-connect.com. An attacker can exploit the vulnerability to change a cookie value to another person's user ID will result in logging in as that user...

Sql injection

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped. This...

softwaretoolbox.com XSS vulnerability

Open Bug Bounty ID: OBB-621505 Description| Value ---|--- Affected Website:| softwaretoolbox.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

Cross site scripting

PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the 1 department field in the printer configuration, 2 description field in the print server configuration, and 3 username field for authentication to print as guest...

jboss: jbossas writable config files allow privilege escalation

It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas configuration files. The file is writable to jboss group root:jboss, 664. On systems using classic /etc/init.d init scripts i.e. on Red Hat Enterprise Linux 6 a...

Russian hackers sent death threats to US army wives posing as ISIS: Report

By Uzair Amir Reportedly, US military wives were threatened with death threats by This is a post from HackRead.com Read the original post: Russian hackers sent death threats to US army wives posing as ISIS: Report...

kjottprodukter.no XSS vulnerability

Open Bug Bounty ID: OBB-614147 Description| Value ---|--- Affected Website:| kjottprodukter.no Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Critical: Red Hat Security Advisory: OpenShift Container Platform 3.6 security and bug fix update

An update is now available for Red Hat OpenShift Container Platform 3.6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Microsoft Windows 10: Deny log on as a service

This policy setting determines which users are prevented from logging on to the service applications on a device. A service is an application type that runs in the system background without a user interface. It provides core operating system features, such as web serving, event logging, file...

Microsoft Windows 10: Log on as a service

This policy setting determines which service accounts can register a process as a service. Running a process under a service account circumvents the need for human intervention. OpenVAS Vulnerability Test $Id: win10logonasservice.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Log on a...

Critical: Red Hat Security Advisory: OpenShift Container Platform 3.7 security and bug fix update

An update is now available for Red Hat OpenShift Container Platform 3.7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CVE-2017-15691

In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion XXE capability of various XML parsers. UIMA as part of its...

CVE-2017-15691

In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion XXE capability of various XML parsers. UIMA as part of its...

CVE-2017-15691

In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion XXE capability of various XML parsers. UIMA as part of its...

CVE-2017-15691

In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion XXE capability of various XML parsers. UIMA as part of its...

chromium-browser: Incorrect handling of files by FileAPI

readAsText can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page...

chromium-browser: Incorrect handling of plaintext files via file://

Parsing documents as HTML in Downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to cause Chrome to execute scripts via a local non-HTML page...

London Trust Media Private Internet Access VPN Client for Windows Elevation of Privilege Vulnerability

London Trust Media Private Internet Access PIA VPN Client for Windows is a Windows-based VPN client for anonymous Internet access. A security vulnerability exists in version 77 of the London Trust Media PIA VPN Client for Windows based platforms, which stems from the program's failure to adequate...

Cisco IOS XE Software Override Access Vulnerability

Cisco IOS XE Software is an operating system developed by Cisco for its network devices. A security vulnerability exists in Cisco IOS XE Software version 16.x, which arises from the use of a default username and password for an account with level 15 privileges. A remote attacker could use this...