UBUNTU-CVE-2017-16667

backintime aka Back in Time before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft...

DEBIAN-CVE-2017-16667

backintime aka Back in Time before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft...

[SECURITY] Fedora 25 Update: sssd-1.15.3-5.fc25

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a plug-gable back-end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

October 26, 2017 – Morning Cyber Coffee Headlines – “Continental Congress” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! October 26, 2017 - Headlines Carbon Black in the News: Protecting elections fro...

[SECURITY] Fedora 27 Update: sssd-1.15.3-5.fc27

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a plug-gable back-end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

HDW Player,4.0.0, RCE

HDW Player,4.0.0 and all other versions, remote code execution Note that this vulnerabilitiy was supposedly fixed by the developer in version 3.2.2, the fact that this issue has arisen again suggests that the developer is aware of it and has created a deliberate back door. The VEL believe that th...

October 21, 2017 – Morning Cyber Coffee Headlines – “British Parliament” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! October 21, 2017 - Headlines Carbon Black in the News: Not good: Ransomware is...

Hacking Back

Hacking back is a terrible idea that just will not die. Josephine Wolff takes apart the new hacking back bill that was introduced in the House recently...

Unspecified Vulnerability in Oracle Retail Applications Retail Back Office Component (CNVD-2017-31065)

Oracle Retail Applications is a suite of retail applications store solutions from Oracle Corporation, of which Oracle Retail Back Office is a retail back office component that provides retailers with real-time access to storage management and reporting capabilities. An unspecified vulnerability...

[SECURITY] Fedora 26 Update: sssd-1.15.3-5.fc26

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a plug-gable back-end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

CVE-2017-10423

Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications subcomponent: Security. Supported versions that are affected are 13.2, 13.3, 13.4, 14.0 and 14.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

CVE-2017-10423

Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications subcomponent: Security. Supported versions that are affected are 13.2, 13.3, 13.4, 14.0 and 14.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

CVE-2017-10423

Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications subcomponent: Security. Supported versions that are affected are 13.2, 13.3, 13.4, 14.0 and 14.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

CVE-2017-10423

CVE-2017-10423 affects Oracle Retail Back Office (a subcomponent of Oracle Retail Applications). Affected versions are 13.2, 13.3, 13.4, 14.0 and 14.1. The vulnerability is exploitable over HTTP with network access by a low-privileged attacker and requires user interaction. It can allow unauthori...

Sql injection

IBM Insights Foundation for Energy 2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 125719...

CVE-2017-1311

IBM Insights Foundation for Energy 2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 125719...

CVE-2017-14703

SQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute arbitrary SQL commands via the PATHINFO to search/...

CVE-2017-14703

SQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute arbitrary SQL commands via the PATHINFO to search/...

Sql injection

SQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute arbitrary SQL commands via the PATHINFO to search/...

CVE-2017-14703

CVE-2017-14703 describes a SQL injection vulnerability in the Cash Back Comparison Script 1.0. The vulnerability allows an unauthenticated attacker to exploit the application by crafting requests via the PATH_INFO to the search/ endpoint, enabling arbitrary SQL execution. Public references includ...