Shopify: H1514 Ability to Edit Packaging Slip Templates and View Product & Shipping Information by a low privileged staff in a Sandbox Store

Hello, It was observed that it is possible to edit packaging slip templates and then view the product and shipping information in the packaging slip by a low privileged staff in a sandbox store by simply navigating to the URL https://.myshopify.com/admin/settings/packingsliptemplate. It appears...

Security Bulletin: Authentication Bypass vulnerability found in IBM Sterling B2B Integrator (CVE-2015-5019)

Summary IBM Sterling B2B Integrator could allow a local mailbox user under specific circumstances to upload or download files without proper authorization. Vulnerability Details CVEID: CVE-2015-5019 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow a local mailbox user with...

Cambium Networks ePMP 1000 Multiple Vulnerabilities

Cambium Networks ePMP1000 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Nagios Log Server < 1.4.2 Multiple Vulnerabilities - Active Check

Nagios Log Server is prone to multiple vulnerabilities, including authentication bypass, stored cross-site scripting XSS, inconsistent authorization controls and privilege escalation vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenc...

Cisco Unified Intelligence Center (CUIC) Software Unauthenticated User Account Creation Vulnerability

A vulnerability in the jspringsecurityswitchuser function of Cisco Unified Intelligence Center CUIC Software could allow an unauthenticated, remote attacker to make certain changes to the system. The vulnerability is due to improper implementation of authorization controls when accessing certain...

Nagios Log Server 1.4.1 - Multiple Vulnerabilities

Nagios Log Server 1.4.1 - Multiple Vulnerabilities , , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. Nagios Log Server Multiple Vulnerabilities Affected versions: Nagios Log Server = 1.4.1 PDF:...

Nagios Log Server 1.4.1 - Multiple Vulnerabilities

, , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. Nagios Log Server Multiple Vulnerabilities Affected versions: Nagios Log Server = 1.4.1 PDF:...

Nagios Log Server 1.4.1 XSS / Authentication Bypass

, , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. Nagios Log Server Multiple Vulnerabilities Affected versions: Nagios Log Server = 1.4.1 PDF:...

Cisco Spark Representational State Transfer Interface Unauthorized Access Vulnerability

A vulnerability in the Representational State Transfer REST interface of Cisco Spark could allow an unauthenticated, remote attacker to make changes to an affected system system. The vulnerability is due to improper implementation of authorization controls when accessing certain web pages of the...

ZTE ADSL ZXV10 W300 Authorization / Disclosure / Backdoor

Exploit Title: ZTE ADSL ZXV10 W300 modems - Multiple vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: www.zte.com.cn Versions Reported: W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 CVE-ID: CVE-2015-7257 CVE-2015-7258 CVE-2015-7259 Note: Large deployment size, primarily in Peru, used b...

ZTE ADSL ZXV10 W300 Modems - Multiple Vulnerabilities

ZTE ADSL ZXV10 W300 Modems - Multiple Vulnerabilities Exploit Title: ZTE ADSL ZXV10 W300 modems - Multiple vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: www.zte.com.cn Versions Reported: W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 CVE-ID: CVE-2015-7257 CVE-2015-7258 CVE-2015-7259...

ZTE ADSL Authorization Bypass / Information Disclosure

ZTE ADSL modems - Multiple vulnerabilities Confirmed on 2 of multiple software versions - W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 1 Insufficient authorization controls CVE-ID: CVE-2015-7257 Observed in Password Change functionality. Other functions may be vulnerable as well. Expected behavior...

Cisco Connected Grid Network Management System Privilege Escalation Vulnerability

A vulnerability in the web GUI of Cisco Connected Grid Network Management System could allow an authenticated, remote attacker to perform limited configuration changes while logged in as a user having the Monitor-Only role. The vulnerability is due to insufficient authorization controls. An...

Atlassian JIRA < 5.0.7 Privilege Escalation

According to its self-reported version number, the version of Atlassian JIRA hosted on the remote web server is prior to 5.0.7. It is, therefore, potentially affected by a privilege escalation vulnerability. A remote attacker, using a crafted URL, can exploit this to bypass administrator-only...

X (Formerly Twitter): Creating Unauthorized Audience Lists

While creating a new audience list at the URL https://ads.twitter.com/accounts//audiencemanager/createlistaudience, under Data security and privacy it is clearly mentioned that When creating a list audience, the information in your data file is always hashed before it is sent to Twitter, and...

Cisco Transport Gateway for Smart Call Home Unauthorized Configuration Change Vulnerability

A vulnerability in the web framework code of Cisco Transport Gateway for Smart Call Home TG-SCH could allow an unauthenticated, remote attacker to make certain changes to the system. The vulnerability is due to improper implementation of authorization controls when accessing certain administrativ...

Cisco MediaSense Search and Play Authorization Vulnerability

A vulnerability in the Search and Play interface of Cisco MediaSense could allow an authenticated, remote attacker to access recordings in the Search and Play interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by accessing the...

Important: Red Hat Security Advisory: tomcat5 security update

An update for the Apache Tomcat 5 component for JBoss Enterprise Web Server 1.0.2 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CV...

Important: Red Hat Security Advisory: tomcat5 security update

Updated tomcat5 packages that fix one security issue are now available for JBoss Enterprise Web Server 1.0.2 for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score,...

Important: Red Hat Security Advisory: jbossweb security update

Updated jbossweb packages that fix one security issue are now available for JBoss Enterprise Application Platform 6.0.1 for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS ba...