Security Bulletin: WebSphere eXtreme Scale and WebSphere DataPower XC10 Appliance client vulnerability (CVE-2013-6734)

Summary In certain configurations, a security vulnerability exists in WebSphere eXtreme Scale Client, the client that is used with WebSphere eXtreme Scale and WebSphere DataPower XC10 Appliance. WebSphere eXtreme Scale Client might allow cached HTTP session data of one user to be accessed by a...

Microsoft Windows CVE-2018-8210 Arbitrary Code Execution Vulnerability

Description Microsoft Windows is prone to an arbitrary code-execution vulnerability. A local attacker can exploit this issue to execute arbitrary code in the context of the user running the affected application. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft...

Prowli Malware Targeting Servers, Routers, and IoT Devices

After the discovery of massive VPNFilter malware botnet, security researchers have now uncovered another giant botnet that has already compromised more than 40,000 servers, modems and internet-connected devices belonging to a wide number of organizations across the world. Dubbed Operation Prowli,...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1516-1)

This update for the Linux Kernel 4.4.90-9250 fixes several issues. The following security issues were fixed : - CVE-2017-13166: An elevation of privilege vulnerability in the kernel v4l2 video driver was fixed. bsc1085447. - CVE-2018-8897: A statement in the System Programming Guide of the Intel ...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1513-1)

This update for the Linux Kernel 3.12.74-606485 fixes several issues. The following security issues were fixed : - CVE-2018-8897: A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual SDM was mishandled in the development of some or all...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1526-1)

This update for the Linux Kernel 3.12.61-52122 fixes several issues. The following security issues were fixed : - CVE-2017-13166: An elevation of privilege vulnerability in the kernel v4l2 video driver was fixed. bsc1085447. - CVE-2018-8897: A statement in the System Programming Guide of the Inte...

Design/Logic Flaw

Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GE...

CVE-2015-9236

Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden. If the connection has CORS enabled but one route has it off, and the route is not GE...

CVE-2015-9243

When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions like origin, a higher level config that included security restrictions like origin would have those restrictions...

CVE-2015-9243

When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions like origin, a higher level config that included security restrictions like origin would have those restrictions...

Qualys Cloud Platform 2.33 New Features

This release of the Qualys Cloud Platform version 2.33 includes the release for CertView, plus updates and new features for AssetView, Cloud Agent, EC2 Connector, Security Assessment Questionnaire, Web Application Scanning, and Web Application Firewall, highlights as follows. This posting has bee...

CVE-2018-11332

Stored cross-site scripting XSS vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted site name to the manager/processors/savesettings.processor.php file...

CVE-2018-11332

Stored cross-site scripting XSS vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted site name to the manager/processors/savesettings.processor.php file...

CVE-2018-8898

A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 A1WI20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT77616E6771696F6E67" allows unauthenticated attackers to perform arbitrary modification read, write to passwords and configurations meanwhile an...

CVE-2018-8898

A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 A1WI20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT77616E6771696F6E67" allows unauthenticated attackers to perform arbitrary modification read, write to passwords and configurations meanwhile an...

CVE-2018-8898

A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 A1WI20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT77616E6771696F6E67" allows unauthenticated attackers to perform arbitrary modification read, write to passwords and configurations meanwhile an...

Powerlogic / Schneider Electric IONXXXX Series - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: Powerlogic Schneider Electric IONXXXX Series - Cross-Site Request Forgery Exploit Author: t4rkd3vilz Vendor Homepage: http://www.schneider-electric.com/ Version: ION73XX series, ION75XX series, ION76XX series, ION8650 series,...

Intelbras NCLOUD 300 1.0 Authentication Bypass

coding: utf-8 Exploit Title: Intelbras NCloud Authentication bypass Date: 16/05/2018 Exploit Author: Pedro Aguiar - [email protected] Vendor Homepage: http://www.intelbras.com.br/ Software Link: http://www.intelbras.com.br/empresarial/wi-fi/para-sua-casa/roteadores/ncloud Version: 1.0 Test...

EulerOS 2.0 SP3 : kernel (EulerOS-SA-2018-1121)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual SDM was mishandled in the...

[SECURITY] Fedora 27 Update: mysql-mmm-2.2.1-20.fc27

MMM MySQL Master-Master Replication Manager is a set of flexible scripts to perform monitoring/failover and management of MySQL Master-Master replication configurations with only one node writable at any time. The toolset also has the ability to read balance standard master/slave configurations...