6607 matches found
PYSEC-2017-106
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script...
PYSEC-2017-106
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script...
CVE-2017-3150
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script...
CVE-2017-3150
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script...
PT-2017-15686
Name of the Vulnerable Software and Affected Versions Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating Description The issue concerns the use of cookies in a way that makes them accessible to client-side scripts. Recommendations For Apache Atlas versions 0.6.0-incubating and...
SUSE-SU-2017:2250-1 Security update for mercurial
This update for mercurial fixes the following issues: - CVE-2017-1000115: path traversal via symlink could lead to unauthorized access bsc1053344 - CVE-2017-1000116: argument injection in SSH URLs could lead to client-side code execution bsc1052696...
Fedora 25 : subversion (2017-1d1a38bdd1)
This update includes the latest stable release of Apache Subversion, version 1.9.7. Client-side bugfixes : - Fix arbitrary code execution vulnerability CVE-2017-9800 See for details. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...
WebClientPrint Processor 2.0.15.109 TLS Validation Vulnerability
RedTeam Pentesting discovered that WebClientPrint Processor WCPP does not validate TLS certificates when initiating HTTPS connections. Thus, a man-in-the-middle attacker may intercept and/or modify HTTPS traffic in transit. This may result in a disclosure of sensitive information and the integrit...
WebClientPrint Processor 2.0.15.109 Unauthorized Proxy Modification
Advisory: WebClientPrint Processor 2.0: Unauthorised Proxy Modification RedTeam Pentesting discovered that attackers can configure a proxy host and port to be used when fetching print jobs with WebClientPrint Processor WCPP. This proxy setting may be distributed via specially crafted websites and...
SUSE-SU-2017:2225-1 Security update for git
This update for git fixes the following issues: - CVE-2017-1000117: an argument injection in SSH URLs could lead to client-side code execution bsc1052481...
WpJobBoard v4.5.1 - Multiple Cross Site Web Vulnerabilities
Document Title: =============== WpJobBoard v4.5.1 - Multiple Cross Site Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1941 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15375 CVE-ID: ======= CVE-2017-15375 Release Date:...
WpJobBoard v4.5.1 - Multiple Cross Site Web Vulnerabilities
Document Title: =============== WpJobBoard v4.5.1 - Multiple Cross Site Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1941 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15375 CVE-ID: ======= CVE-2017-15375 Release Date:...
Arachni v1.5.1 - Web Application Security Scanner Framework
Arachni is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications. It is smart, it trains itself by monitoring and learning from the web application's behavior during the scan process and is...
Cross site scripting
services/systemio/actionprocessor/Contact.rails in ConnectWise Manage 2017.5 allows arbitrary client-side JavaScript code execution involving a ContactCommon field on victims who click on a crafted link, aka XSS...
CVE-2017-11727: Improper Neutralization of Input During Web Page Generation
services/systemio/actionprocessor/Contact.rails in ConnectWise Manage 2017.5 allows arbitrary client-side JavaScript code execution involving a ContactCommon field on victims who click on a crafted link, aka XSS...
Televes COAXDATA GATEWAY 1Gbps Device Arbitrary Password Change Vulnerability
The Televes COAXDATA GATEWAY 1Gbps devices is a wireless router device from the Spanish company Televes. A security vulnerability exists in the Televes COAXDATA GATEWAY 1Gbps device that stems from a lack of access control and detection on the client side. An attacker could exploit the...
AhMyth Android RAT - Android Remote Administration Tool
AhMyth Android RAT is an Android Remote Administration Tool Beta Version It consists of two parts: Server side: desktop application based on electron framework control panel Client side: Android application backdoor Getting Started From source code Prerequisite : Electron to start the app Java to...
e107 v2 Bootstrap CMS - CSRF Web Vulnerability
Document Title: =============== e107 v2 Bootstrap CMS - CSRF Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2083 Release Date: ============= 2017-07-06 Vulnerability Laboratory ID VL-ID: ==================================== 2083 Commo...
Grab: CSV Injection https://hub.grab.com
@Poison had pointed out that it was possible to perform CSV Injection on hub.grab.com which was tested on Microsoft Excel 2016. Injection occurred by adding the payload in customer name field in Grab mobile application. The payload used was =cmd|' /C calc'!A0. We fixed this issue by properly...
Stellar.org: HTTP - Basic Authentication on https://www.stellar.org/wp-login.php
Greetings, noticed https://www.stellar.org/wp-login.php using basic authentication. PoC: YWRtaW46YWRtaW4= is base64 encode of admin:admin Impact: Vulnerable to client side attacks. Vulnerable to MITM attack. Vulenrable to Eavesdropping attack. Vulnerable to Brute force attacks. Fix: HTTP-Basic...