OpenStack Neutron Information Disclosure Vulnerability

OpenStack is a cloud platform management project. neutron is one of the networking components that provides network-as-a-service, enabling the creation of networks between OpenStack services, access to network devices into the mesh, and more. A remote information disclosure vulnerability exists i...

Vulnerability of Qingdao Governmental Affairs App Android Version with Ultra-rights Access Vulnerability

Qingdao Government APP is a government service assistant that facilitates citizens to learn the latest news and information anytime and anywhere, grasp the latest government decision-making information, and facilitate direct dialogue and communication between citizens and the government. The...

jenkins-plugin-script-security: Unsafe methods in the default whitelist (SECURITY-538)

The jenkins-plugin-script-security improperly whitelisted "DefaultGroovyMethods.putAtObject, String, Object" and "DefaultGroovyMethods.getAtObject, String" which allows attackers to bypass many restrictions and potentially trigger builds or access data they should not have access to. Exploitation...

CVE-2017-11134

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The login credentials are written into a log file on the device. Hence, an attacker with access to the logs can read them...

UBUNTU-CVE-2017-2835

An exploitable code execution vulnerability exists in the RDP receive functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can cause an out-of-bounds write resulting in an exploitable condition. An attacker can compromise the server or use a man in the middle to...

sosreport information disclosure vulnerability

sosreport is a set of tools for collecting log information on all systems. The tool supports automatic zipping of the collected information into a compressed package and provides MD5 checksums. A security vulnerability exists in sosreport version 3.2, which stems from the program assigning weak...

Unspecified Information Disclosure Vulnerability in IBM TRIRIGA Application Platform

The IBM TRIRIGA Application Platform is a set of technology platforms for deploying TRIRIGA applications from IBM in the United States. The platform provides a set of design-time and run-time components for building and running its enterprise applications, respectively, and supports...

Code injection

A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...

HP SiteScope Monitors Local Bypass Security Restrictions Vulnerability

HP SiteScope Monitors is a platform-level management software. A local bypass security restriction vulnerability exists in HP SiteScope Monitors. This allows an attacker to exploit the vulnerability to gain access to sensitive information...

HP SiteScope Monitors Information Disclosure Vulnerability

HP SiteScope Monitors is a platform-level management software. An information disclosure vulnerability exists in HP SiteScope Monitors. The vulnerability can be exploited by an attacker to obtain sensitive information...

Beetel BCM96338 Router DNS Change Vulnerability

The Beetel BCM96338 is a router. A DNS change vulnerability exists in the Beetel BCM96338 router. An attacker can exploit the vulnerability to access sites and devices on vulnerable systems, redirecting to malicious sites...

PT-2017-10496 · Microsoft · Windows Uniscribe +2

Name of the Vulnerable Software and Affected Versions: Windows Uniscribe affected versions not specified Description: The issue allows attackers to obtain sensitive information and affect the system. It is an information disclosure vulnerability that exists when Windows Uniscribe improperly...

Tongfang Mybody Smart Scale Android App Has Design Flaw Vulnerability

Tongfang Mybody Smart Scale Android app is a full-featured health management device. A design flaw vulnerability exists in the cell phone number verification login function of Tongfang Mybody Smart Scale Android app. An attacker can exploit the vulnerability to log into any user's account...

PT-2018-30: XXE Injection in Cisco Secure ACS

The specialists of the Positive Research center have detected an XXE Injection vulnerability in Cisco Secure ACS. A vulnerability in the web-based user interface of the Cisco Secure Access Control Server, due to improper handling of XML External Entities XXEs when parsing an XML file, could allow...

Server: Share tokens for public calendars disclosed

A logical error caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

MGASA-2017-0145 Updated samba packages fix security vulnerability

A flaw was found in the way Samba handled PAC Privilege Attribute Certificate checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process CVE-2016-2126. Jann Horn discovered that Samba incorrectly handled symlinks. An authenticated remote attacker could use this...

Samsung Account Information Disclosure Vulnerability

Samsung account is a mobile client from Samsung South Korea that allows users to experience Samsung services. With Samsung account mobile, you can enjoy more functional features such as cell phone location, cell phone tracking and so on. Samsung Account suffers from an information disclosure...

CVE-2017-0894

Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...

Share tokens for public calendars disclosed (NC-SA-2017-011)

A logical error caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...

CVE-2017-5042

Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary URLs and observe any plaintext cookies sent...