Information disclosure

An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version...

CVE-2018-13412

An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version...

CVE-2018-13412

The CVE-2018-13412 issue affects Zoho ManageEngine Desktop Central’s Self Service Portal prior to 10.0.282. A clickable company logo in a window running with SYSTEM privileges can be abused to escalate privileges. Cloud deployments are fixed in 10.0.470 agent version. Other references corroborate...

CVE-2018-13411

An issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version...

CVE-2018-13411

CVE-2018-13411 affects Zoho ManageEngine Desktop Central prior to 10.0.282. A clickable company logo in a window running as SYSTEM allows privilege escalation. In cloud, the issue is fixed in 10.0.470 agent version; on-prem mitigation is upgrade/build 100282 (as referenced by the Nessus plugin). ...

centralindiacollegeoflaw.com XSS vulnerability

Open Bug Bounty ID: OBB-673806 Description| Value ---|--- Affected Website:| centralindiacollegeoflaw.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

centralindiacollegeoflaw.com XSS vulnerability

Open Bug Bounty ID: OBB-668194 Description| Value ---|--- Affected Website:| centralindiacollegeoflaw.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Microsoft Windows: Audit Authorization Policy Change

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winauthorizationpolicychange.nasl 11068 2018-08-21 11:51:41Z emoss $ Check value for Audit Authorization Policy Change Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This...

Microsoft Windows Firewall: Public: Logging: Log successful connections

This setting specifies logging when Windows Firewall with Advanced Security allows an inbound connection. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CentralManagement Software 1.4.13 - Denial of Service Exploit

Exploit for windows platform in category dos / poc Exploit Title: Central Management Software v1.4.13 - Denial of Service PoC Author: Gionathan "John" Reale Homepage: https://www.ambientweather.com Software Link:...

Central Management Software 1.4.13 - Denial of Service (PoC)

Exploit Title: Central Management Software v1.4.13 - Denial of Service PoC Author: Gionathan "John" Reale Discovey Date: 2018-08-16 Homepage: https://www.ambientweather.com Software Link:...

Central Management Software 1.4.13 Denial Of Service

Exploit Title: Central Management Software v1.4.13 - Denial of Service PoC Author: Gionathan "John" Reale Discovey Date: 2018-08-16 Homepage: https://www.ambientweather.com Software Link:...

Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to obtain sensitive information from the WhoAmI API (CVE-2018-1528)

Summary IBM Maximo Asset Management could allow an authenticated user to obtain sensitive information from the WhoAmI API. Vulnerability Details CVEID: CVE-2018-1528 DESCRIPTION: IBM Maximo Asset Management could allow an authenticated user to obtain sensitive information from the WhoAmI API. CVS...

Security Bulletin: Ceilometer database access unrestricted in PowerVC (CVE-2015-1937)

Summary IBM PowerVC is using a ceilometer database that does not have authentication enabled. Vulnerability Details CVEID: CVE-2015-1937 DESCRIPTION: IBM PowerVC NoSQL database used by ceilometer is listening on the remote port and is configured to allow connections without any authentication. A...

PT-2018-2192 · D Link · D-Link Central Wifimanager Cwm-100

Name of the Vulnerable Software and Affected Versions: D-Link Central WiFiManager CWM-100 version 1.03 r0098 Description: The issue is related to the FTP service, which allows remote attackers to conduct a PORT command bounce scan via port 8000, resulting in a Server-Side Request Forgery SSRF...

Security Bulletin: Vulnerabilities in IPv6 and MQ affect the IBM FlashSystem model V840

Summary There are vulnerabilities in the IPv6 and MQ components which affect the IBM FlashSystem™ V840. An exploit of these vulnerabilities CVE-2016-10142 and CVE-2017-11176 could make the system susceptible to attacks which could allow an attacker to trigger a kernel panic or denial of service...

FreeBSD CPU Resource Consumption Vulnerability

FreeBSD is a set of Unix-like free operating systems in the FreeBSD project, headed by the Core Team team, and is an important branch of Unix-like systems that have evolved through BSD, 386BSD, and 4.4BSD. A security vulnerability exists in FreeBSD versions prior to 11.2-RELEASE-p1,...

Node.js third-party modules: Prototype Pollution Vulnerability in noble Package

I would like to report prototype pollution vulnerability in noble. It allows attackers to pollute the Object.prototype object of an application running noble, possibly through Bluetooth. Module module name: noble version: 1.9.1 npm page: https://www.npmjs.com/package/noble Module Description A...

Security Bulletin: XML Entity Expansion vulnerability (CVE-2018-1702) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary XML Entity Expansion vulnerability CVE-2018-1702 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1702 DESCRIPTION: IBM Spectrum Symphony is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could...

Security Bulletin: Vulnerability in IBM Java Runtime affect Rational Host On-Demand (CVE-2016-0603)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 1.6 , 1.7 and 1.8 that is used by Rational Host On Demand .JRE installation executables on the Windows platform are affected by this vulnerability. Vulnerability Details CVE-ID: CVE-2016-0603 Descriptio...