CVE-2017-5527

TIBCO Spotfire Server 7.0.X before 7.0.2, 7.5.x before 7.5.1, 7.6.x before 7.6.1, 7.7.x before 7.7.1, and 7.8.x before 7.8.1 and Spotfire Analytics Platform for AWS Marketplace 7.8.0 and earlier contain multiple vulnerabilities which may allow authorized users to perform SQL injection attacks...

Information Disclosure in the Management Web Interface

A vulnerability exists in the Management Web Interface of PAN-OS, that could allow for Information Disclosure. The Management Web Interface does not properly validate certain permissions which could allow for Information Disclosure. Ref PAN-70541 / CVE-2017-7644 Successfully exploiting this issue...

CVE-2016-8923

IBM Curam Social Program Management 5.2, 6.0, and 7.0 contains a vulnerability that would allow an authorized user to obtain sensitive information from the profile of a higher privileged user that they should not have access to. IBM X-Force ID: 118536...

CVE-2016-8926

IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to read system files or data that is restricted to authorized users. IBM X-Force ID: 118539...

JCL to Escalate Privileges

Elevate privileges for user. Adds SYSTEM SPECIAL and BPX.SUPERUSER to user profile. Does this by using an unsecured/updateable APF authorized library APFLIB and updating the user's ACEE using this program/library. Note: This privesc only works with z/OS systems using RACF, no other ESM is...

Information Disclosure in the Management Web Interface

A vulnerability exists in the Management Web Interface that could allow for Information Disclosure. The Management Web Interface does not properly validate specific request parameters which can potentially allow for Information Disclosure. Ref PAN-70434 / CVE-2017-7216 Successfully exploiting thi...

Local Privilege Escalation in the Management Web Interface

A vulnerability exists in the Management Web Interface that could allow for local privilege escalation. The Management Web Interface does not properly validate specific request parameters which can potentially allow executing code with higher privileges. Ref PAN-70426/ CVE-2017-7218 Successfully...

Local Privilege Escalation in the Management Web Interface

A vulnerability exists in the Management Web Interface that could allow for local privilege escalation. The Management Web Interface does not properly validate specific request parameters which can potentially allow executing code with higher privileges. Ref PAN-70426/ CVE-2017-7218 Successfully...

Tenable Nessus Agent Mode Local Elevation of Privilege Vulnerability

Tenable Network Security Tenable Nessus is an open source vulnerability scanner developed by Tenable Network Security in the United States. A local elevation of privilege vulnerability exists in Tenable Nessus Agent mode, which can be exploited to elevate a local authorized user to administrator...

Wireless IP Camera (P2P) WIFICAM Pre-Authorized Remote Command Execution Vulnerability

Wireless IP Camera P2P WIFICAM is a wireless IP camera. Wireless IP Camera P2P WIFICAM pre-authorized remote command execution vulnerability. By accessing a URL link with special parameters, an attacker can root user privileges to bypass the authentication process and execute various code on the...

The CIS Critical Security Controls Explained - Control 2: Inventory of Authorized and Unauthorized Software

As I mentioned in our last post, the 20 critical controls are divided into System, Network, and Application families in order to simplify analysis and implementation. This also allows partial implementation of the controls by security program developers who aren't building a program from scratch,...

Sage XRT Treasury database fails to properly restrict access to authorized users

Overview Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions. Description CWE-639: Authorization Bypass Through User-Controlled Key - CVE-2017-3183Sage XRT...

Tenable Nessus Remote Command Execution Vulnerability

Tenable Network Security Tenable Nessus is an open source vulnerability scanner from Tenable Network Security, USA. A remote command execution vulnerability exists in multiple versions of Tenable Network Security Tenable Nessus. A remote authorized user can exploit this vulnerability to execute...

Design/Logic Flaw

Vulnerability in the MySQL Cluster component of Oracle MySQL subcomponent: Cluster: General. Supported versions that are affected are 7.2.19 and earlier, 7.3.8 and earlier and 7.4.5 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple...

CVE-2017-3286

Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite subcomponent: Patching. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where...

Nagios Core < 4.2.2 Curl Command Injection/Code Execution （CVE-2016-9565）

Author: p0wd3r, dawu know Chong Yu 404 security lab Date: 2016-12-15 0x00 vulnerability overview 1. Vulnerability description Nagios is a monitoring of the IT infrastructure program, recently security researchers Dawid Golunski discovered in Nagios Core there is a code execution vulnerability: an...

Google Android libziparchive library remote code execution vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handset Alliance OHA. libziparchive Library is one of the compression and decompression libraries. A remote code execution vulnerability exists in the libziparchive library in Android. An attacker can...

Google Android Wi-Fi Elevation of Privilege Vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA, with Wi-Fi as one of the wireless connectivity components. Wi-Fi in Android is vulnerable to a power lifting vulnerability. An attacker can exploit this vulnerability to execute...

CVE-2016-6623

An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service DoS attack on a server by passing large values to a loop. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

DEBIAN-CVE-2016-6623

An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service DoS attack on a server by passing large values to a loop. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...