HP SiteScope Monitors Local Bypass Security Restrictions Vulnerability

HP SiteScope Monitors is a platform-level management software. A local bypass security restriction vulnerability exists in HP SiteScope Monitors. This allows an attacker to exploit the vulnerability to gain access to sensitive information...

HP SiteScope Monitors Information Disclosure Vulnerability

HP SiteScope Monitors is a platform-level management software. An information disclosure vulnerability exists in HP SiteScope Monitors. The vulnerability can be exploited by an attacker to obtain sensitive information...

Beetel BCM96338 Router DNS Change Vulnerability

The Beetel BCM96338 is a router. A DNS change vulnerability exists in the Beetel BCM96338 router. An attacker can exploit the vulnerability to access sites and devices on vulnerable systems, redirecting to malicious sites...

PT-2017-10496 · Microsoft · Windows Uniscribe +2

Name of the Vulnerable Software and Affected Versions: Windows Uniscribe affected versions not specified Description: The issue allows attackers to obtain sensitive information and affect the system. It is an information disclosure vulnerability that exists when Windows Uniscribe improperly...

Tongfang Mybody Smart Scale Android App Has Design Flaw Vulnerability

Tongfang Mybody Smart Scale Android app is a full-featured health management device. A design flaw vulnerability exists in the cell phone number verification login function of Tongfang Mybody Smart Scale Android app. An attacker can exploit the vulnerability to log into any user's account...

PT-2018-30: XXE Injection in Cisco Secure ACS

The specialists of the Positive Research center have detected an XXE Injection vulnerability in Cisco Secure ACS. A vulnerability in the web-based user interface of the Cisco Secure Access Control Server, due to improper handling of XML External Entities XXEs when parsing an XML file, could allow...

Server: Share tokens for public calendars disclosed

A logical error caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...

MGASA-2017-0145 Updated samba packages fix security vulnerability

A flaw was found in the way Samba handled PAC Privilege Attribute Certificate checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process CVE-2016-2126. Jann Horn discovered that Samba incorrectly handled symlinks. An authenticated remote attacker could use this...

Samsung Account Information Disclosure Vulnerability

Samsung account is a mobile client from Samsung South Korea that allows users to experience Samsung services. With Samsung account mobile, you can enjoy more functional features such as cell phone location, cell phone tracking and so on. Samsung Account suffers from an information disclosure...

CVE-2017-0894

Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...

Share tokens for public calendars disclosed (NC-SA-2017-011)

A logical error caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token...

CVE-2017-5042

Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary URLs and observe any plaintext cookies sent...

Foreman Information Disclosure Vulnerability (CNVD-2017-05519)

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. An information disclosure vulnerability exists in Foreman. An attacker could exploit this vulnerability ...

CVE-2016-9461

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to...

sane-backends information disclosure vulnerability

sane-backends is a source package that contains the SANE library, which is the backend and network scanning part. A remote information disclosure vulnerability exists in sane-backends. An attacker can exploit the vulnerability to obtain sensitive information or launch other attacks...

CloudFlare Information Disclosure Vulnerability

CloudFlare is an American multinational technology company that provides security services to help websites stop hacking, spamming, etc. from the web and improve the speed of web browsing. CloudFlare has an information disclosure vulnerability. An attacker can exploit this vulnerability to gain...

CVE-2017-0531

An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10,...

Grails PDF Plugin XML External Entity Information Disclosure Vulnerability

Grails PDF Plugin XML External Entity Information Disclosure vulnerability. An attacker can exploit the vulnerability to obtain sensitive information, which could lead to further attacks...

CVE-2017-5161

An issue was discovered in Sielco Sistemi Winlog Lite SCADA Software, versions prior to Version 3.02.01, and Winlog Pro SCADA Software, versions prior to Version 3.02.01. An uncontrolled search path element DLL Hijacking vulnerability has been identified. Exploitation of this vulnerability could...

St. Jude Patches Additional Cardiac Device

St. Jude Medical has patched a vulnerability in another Merlin@home Transmitter medical device vulnerable to a man-in-the-middle attack. The medical device maker issued an update on Monday for its Merlin@home Transmitter “inductive” models, expanding the number of devices impacted by a...