ClipBucket < 4.0.0 - Release 4902 - Command Injection / File Upload / SQL Injection Vulnerabiliti

Exploit for php platform in category web applications ======================================================================= title: OS command injection, arbitrary file upload & SQL injection product: ClipBucket vulnerable version: 4.0.0 - Release 4902 fixed version: 4.0.0 - Release 4902 CVE...

TestLink Open Source Test Management Insecure Direct Object Reference Vulnerability

Exploit for php platform in category web applications ======================================================================= title: Insecure Direct Object Reference product: TestLink Open Source Test Management vulnerable version: 1.9.17 fixed version: 1.9.17 after November 2017, and the current...

WAGO PFC200 Series

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Public exploits are available. Vendor: WAGO Equipment: PFC200 Series Vulnerability: Improper Authentication UPDATE INFORMATION This advisory is a follow-up to the alert titled ICS-ALERT-17-341-01 WAGO PFC200 that was publishe...

CVE-2018-1000061

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Sprecher Automation SPRECON-E-C / PU-2433 Traversal / DoS

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: Sprecher Automation SPRECON-E-C, PU-2433 vulnerable version: 8.49 most vulnerabilities, see "Vulnerable version" for details fixed...

CVE-2018-1000017

CVE-2018-1000017 is a rejected/unused entry and does not represent an active vulnerability.

CVE-2017-1000500

CVE-2017-1000500 is a rejected candidate and should reference CVE-2017-12161.

CVE-2017-1000447

CVE-2017-1000447 is a reservation duplicate of CVE-2017-15955. Connected references describe bchunk (BinChunker) vulnerabilities in versions 1.2.0–1.2.1: heap-based buffer overflow and an access-violation crash when processing malformed CUE files, enabling potential denial of service. The issue i...

CVE-2017-1000384

CVE-2017-1000384 is a reservation duplicate of CVE-2017-16355. The connected sources describe a vulnerability in Phusion Passenger (notably the agent/Core/SpawningKit/Spawner.h path) that allows an arbitrary file read by a local user through symlinking the REVISION file to a target file and query...

Fortinet FortiClient VPN Credential Disclosure Vulnerability

FortiClient stores the VPN authentication credentials in a configuration file on Linux or Mac OSX or in registry on Windows. The credentials are encrypted but can still be recovered since the decryption key is hardcoded in the program and the same on all installations. Above all, the aforemention...

Siemens SICAM RTUs SM-2556 COM Modules XSS / Bypass / Code Execution Vulnerabilities

Siemens SICAM RTUs SM-2556 COM modules firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00 suffer from authentication bypass, code execution, and cross site scripting vulnerabilities. ======================================================================= title: Authentication...

Micro Focus VisiBroker C++ 8.5 SP2 Memory Corruption Vulnerability

Micro Focus VisiBroker C++ version 8.5 SP2 suffers from multiple memory corruption vulnerabilities. title: Multiple vulnerabilities product: Micro Focus VisiBroker C++ vulnerable version: 8.5 SP2 fixed version: 8.5 SP4 HF3 CVE number: CVE-2017-9281, CVE-2017-9282, CVE-2017-9283 impact: High...

Buggy Microsoft Outlook Sending Encrypted S/MIME Emails With Plaintext Copy For Months

Beware, If you are using S/MIME protocol over Microsoft Outlook to encrypt your email communication, you need to watch out. From at least last 6 months, your messages were being sent in both encrypted and unencrypted forms, exposing all your secret and sensitive communications to potential...

Microsoft’s October Patch Batch Fixes 62 Flaws

Microsoft on Tuesday released software updates to fix at least 62 security vulnerabilities in Windows, Office and other software. Two of those flaws were detailed publicly before yesterday's patches were released, and one of them is already being exploited in active attacks, so attackers already...

SilverStrip CMS 3.5.3 Cross Site Scripting Vulnerability

SilverStripe CMS versions 3.5.3 and below suffer from a persistent cross site scripting vulnerability. title: Persistent Cross-Site Scripting product: SilverStripe CMS vulnerable version: =3.5.3 fixed version: 3.6.1 impact: Medium homepage: https://www.silverstripe.org/ found: 2017-03-15 by: S...

Ubiquiti Networks UniFi Cloud Key Command Injection Vulnerability

Ubiquiti Networks UniFi Cloud Key wwith firmware versions 0.6.4 and below suffer from an authenticated command injection vulnerability. title: Authenticated Command Injection product: Ubiquiti Networks UniFi Cloud Key vulnerable version: Firmware version =0.6.9 CVE number: - impact: High homepage...

VLC Media Player iOS App 2.7.8 File Disclosure Vulnerability

VLC Media Player iOS application version 2.7.8 suffers from a file disclosure vulnerability. title: Local File Disclosure product: VLC media player iOS app vulnerable version: 2.7.8 fixed version: 2.8.1 CVE number: - impact: Medium homepage:...

Progress Sitefinity 9.1 XSS / Session Management / Open Redirect

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Progress Sitefinity vulnerable version: 9.1 fixed version: 10.1 CVE number: - impact: High homepage: http://www.sitefinity.com |...

Ubiquiti Networks UniFi Cloud Key Firmware 0.6.1 Command Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Authenticated Command Injection product: Ubiquiti Networks UniFi Cloud Key vulnerable version: Firmware v0.6.1 fixed version: Firmware v0.6.4 CVE number: impact: High...

phpBB 3.2.0 Server Side Request Forgery

phpBB version 3.2.0 suffers from a server-side request forgery vulnerability. ======================================================================= title: Server Side Request Forgery Vulnerability product: phpBB vulnerable version: 3.2.0 fixed version: 3.2.1 CVE number: impact: Medium homepage:...