CVE-2018-15613

Affected software: Avaya Aura Orchestration Designer (Runtime Config component). Vulnerability: Cross-site scripting (XSS) that could cause malicious content to be returned to the user. Root cause / affected version range: Any affected versions up to 7.2.1. Impact (as stated): Potential exposure ...

CVE-2018-15613 Orchestration Designer Runtime Config XSS

A cross-site scripting XSS vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1...

CVE-2018-15612

CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions include all up to 7.2.1. Available references corroborate the CSRF issue across multiple sources; no explicit mitiga...

CVE-2018-15612

A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1...

CVE-2018-15613

A cross-site scripting XSS vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1...

CVE-2018-15613

A cross-site scripting XSS vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1...

Cross site scripting

A cross-site scripting XSS vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1...

Cross site request forgery (csrf)

A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1...

New ownerAnyone Bug Allows For Anyone to ''Own'' Certain ERC20-Based Smart Contracts (CVE-2018-10705)

This morning, our vulnerability-scanning system at PeckShield identified a new vulnerability named ownerAnyone in certain ERC20-based smart contracts such as AURA, which is deployed by a decentralized banking and finance platform – AURORA. This bug, if successfully exploited, might introduce the...

CVE-2018-10705

CVE-2018-10705 affects Aurora DAO (AURA) Ethereum ERC20 token. The Owned contract’s setOwner() is public and unprotected, allowing an attacker to acquire contract ownership. Once ownership is changed, privileged functions like lockBalances() can be called, enabling a Denial-of-Service (DoS) by pr...

aura-astronomy.org XSS vulnerability

Open Bug Bounty ID: OBB-576391 Description| Value ---|--- Affected Website:| aura-astronomy.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-6635

System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation RMI restrictions, aka SMGR-26896...

CVE-2018-6635

System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation RMI restrictions, aka SMGR-26896...

Authentication flaw

System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation RMI restrictions, aka SMGR-26896...

CVE-2018-6635

Avaya Aura System Manager (SMGR) before 7.1.2 is affected. The vulnerability arises from improper use of SSL in conjunction with authentication, enabling remote attackers to bypass the intended Remote Method Invocation (RMI) restrictions (SMGR-26896). Impact is exposure of remote access controls,...

CVE-2018-6635

System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation RMI restrictions, aka SMGR-26896...

reserve.auraworkout.com XSS vulnerability

Open Bug Bounty ID: OBB-511993 Description| Value ---|--- Affected Website:| reserve.auraworkout.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Avaya Patches Remote Code Execution Flaw in Aura

Internet telephony company Avaya has patched a high-severity vulnerability in its Aura Application Enablement Services product that put phone call and API data running through the server at risk for interception. Researchers at Digital Defense found a vulnerability where an attacker could, withou...

Updated calibre packages fix security vulnerability

Newer devices like Kobo Aura HD requires newer versions of calibre for their new firmwares. Current calibre package does not support them. Also, our current calibre packages in both core and backports repositories have a security issue CVE-2016-10187. Newer versions of calibre 2.75.0 + fixes this...

Uber: lert.uber.com: Few default folders/files of AURA Framework are accessible

There were a few default folders/files of the AURA Framework accessible on lert.uber.com. The specified files/folders in the AURA framework were supposed to be accessible, so we did not make any changes here. However, we do appreciate the time taken to submit this report and are disclosing per th...