CVE-2019-18830: Improper Neutralization of Special Elements used in an OS Command

Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection. The embedded 'donglebridge' program used to expose the functionalities of the ClickShare Button to a USB host, is vulnerable to OS command injection vulnerabilities. These vulnerabilities could lead to code...

CVE-2019-18831: Use of Hard-coded Credentials

Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information Exposure. The encrypted ClickShare Button firmware contains the private key of a test device-certificate...

CVE-2019-18826: Improper Certificate Validation

Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate's Chain of Trust. The embedded 'donglebridge' program used to expose the functionalities of the ClickShare Button to a USB host, does not properly validate the whole certificate chain...

CVE-2019-18827: Improper Authorization

On Barco ClickShare Button R9861500D01 devices before firmware version 1.9.0 JTAG access is disabled after ROM code execution. This means that JTAG access is possible when the system is running code from ROM before handing control over to embedded firmware...

PT-2019-15684

Name of the Vulnerable Software and Affected Versions Barco ClickShare Button R9861500D01 versions prior to 1.9.0 Description The issue concerns JTAG access on Barco ClickShare Button devices. Specifically, JTAG access is disabled after ROM code execution, but it is possible when the system is...

CVE-2012-2238

trytond 2.4: ModelView.button fails to validate authorization...

CVE-2012-2238

CVE-2012-2238 affects trytond 2.4: ModelView.button fails to validate authorization. Root cause is lack of proper authorization checks on that component. CVSS2 base score 5.0 (I:P) and CVSS3.1 base score 7.5 (I:H) indicate partial integrity impact under a network attack with low complexity and no...

Custom Header - Automatic Add New Header To Entire BurpSuite HTTP Requests

This Burp Suite extension allows you to customize header with put a new header into HTTP REQUEST BurpSuite Scanner, Intruder, Repeater, Proxy History and also you can choose whatever HTTP VERB what do you want to customize. Usage Easy to use ! : Don't forget to click save button ! Changelog 24...

Floating Button Menu - Critical - Unsupported - SA-CONTRIB-2019-091

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466procedure---own-project---unsupported...

Tor Browser v9.0 - Everything you Need to Safely Browse the Internet

Tor Browser 9.0 is the first stable release based on Firefox 68 ESR and contains a number of updates to other components as well including Tor to 0.4.1.6 and OpenSSL to 1.1.1d for desktop versions and Tor to 0.4.1.5 for Android. In addition to all the needed patch rebasing and toolchain updates, ...

The vulnerability of the powerdevil utility in the Astra Linux operating system, which allows a hacker to trigger a service failure.

The vulnerability of the powerdevil utility in the Astra Linux operating system is related to errors in processing the power button press after the monitor exits sleep mode, resulting in incorrect positioning of interface elements. Exploiting this vulnerability can allow an intruder to cause a...

Phish Uses Google's URL Decoding to Swim Past Defenses

A phishing campaign that takes advantage of Google’s ability to decode non-ASCII URL data on the fly is making the rounds – looking to fool the unsavvy by effectively hiding the website address of the campaign’s phishing page. The campaign makes use of what’s called percentage-based URL encoding ...

A Secure “Smart” Kettle?

We haven’t looked at smart kettles for a long time, mostly as the UK market leader, Smarter, fixed their security with the iKettle 3.0. So I got quite excited when a colleague pointed out the Xiaomi ‘smart’ kettle a few weeks back. It’s the first kettle with a mobile app that we’ve seen for a...

WordPress feed-them-social plugin cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Facebook Feeds Load More button in versions of the WordPress...

CVE-2015-9350: Improper Neutralization of Input During Web Page Generation

The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button...

CVE-2015-9351: Improper Input Validation

The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button...

PT-2019-20319

Уязвимость утилиты powerdevil операционной системы Astra Linux связана с ошибками при обработке нажатия кнопки питания после выхода монитора из состояния сна и дальнейшим неправильным позиционированием элементов интерфейса. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в...

Cross site scripting

XSS exists in WEB STUDIO Ultimate Loan Manager 2.0 by adding a branch under the Branches button that sets the notes parameter with crafted JavaScript code...

Cross site scripting

SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI...

CVE-2019-14427: Improper Neutralization of Input During Web Page Generation

XSS exists in WEB STUDIO Ultimate Loan Manager 2.0 by adding a branch under the Branches button that sets the notes parameter with crafted JavaScript code...