8419 matches found
PT-2018-10744 · Abb · Abb Microscada
Name of the Vulnerable Software and Affected Versions: ABB MicroSCADA versions 9.3 with FP 1-2-3 Description: This issue allows local attackers to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in orde...
CVE-2014-9503
CVE-2014-9503 affects the Open Atrium 7.x-2.x Discussions sub module (pre-7.x-2.26). The vulnerability allows remote authenticated users with "access content" permissions to modify arbitrary nodes due to improper access checks on unspecified AJAX callbacks. Impact is limited to Drupal/Open Atrium...
The vulnerability in the Splunk Web platform for operational analysis of Splunk Enterprise’s web interface allows a perpetrator to bypass existing access restrictions or perform arbitrary actions on behalf of legitimate users.
The vulnerability of the Splunk Web platform for operational analysis in Splunk Enterprise is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to circumvent existing access restrictions or perform arbitrary actions on behalf of legitimate syst...
Semrush: CORS (Cross-Origin Resource Sharing)
Affected URL: https://ta.semrush.com/version/ Description: The application implements an HTML5 cross-origin resource sharing CORS policy for this request which allows access from any domain. Allowing access from all domains means that any domain can perform two-way interaction with the applicatio...
Cloud Migration Checklist for Application and Data Security
In the final post of our series on cloud migration, we’ve put together a list of strategic and immediate considerations as you plan to migrate your business to the cloud. From a high-altitude viewpoint, cloud security is based on a model of “shared responsibility” in which the concern for securit...
(0Day) ZyXEL P-870H-51 DSL Router Multiple Remote Code Execution Vulnerabilities
This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router. Authentication is not required to exploit this vulnerability. The specific flaw exists within numerous exposed CGI endpoints. The vulnerability is caused by...
Getting Back on the Field
Growing up as a foreign service brat, I was obsessed with security. Living in Guatemala in the 80s you had to adapt and become resilient as child. As there was no TV in our household, 10-year-old Tom began to tinker with my father’s computer and soon it became my oasis from the stress of living i...
Gone Phishing For The Holidays
Written by Or Katz and Amiram Cohen Overview: While our team, Akamai's Enterprise Threat Protector Security Research Team, monitored internet traffic throughout the 2017 holiday season, we spotted a wide-spread phishing campaign targeting users through an advertising tactic. During the six week...
WordPress Admin Menu Tree Page View 2.6.9 Plugin - Cross-Site Request Forgery / Privilege Escalation
Exploit for php platform in category web applications Exploit Title: Admin Menu Tree Page View CSRF, Privilege Escalation Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://eskapism.se/ Software Link:...
Chromium, Google Chrome: Multiple vulnerabilities
Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices Description Multiple vulnerabilities have been discovered in Chromium and...
CVE-2017-5263
Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which are most typically implemented as randomized per-session tokens associated with any web application function, especially destructive ones...
Cross site request forgery (csrf)
Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which are most typically implemented as randomized per-session tokens associated with any web application function, especially destructive ones...
CVE-2017-17747
Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a denial of service condition...
Race condition
Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a denial of service condition...
CVE-2017-17747
Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a denial of service condition...
CVE-2017-17747
CVE-2017-17747 affects the TP-Link TL-SG108E, firmware 1.0.0, where the Logout.htm function has weak access control and can be called from any IP address. This allows an attacker to terminate an authenticated session on a target device, potentially triggering a denial-of-service condition and mak...
EAP: Sensitive data can be exposed at the server level in domain mode
It was discovered that when configuring RBAC and marking information as sensitive, users with a Monitor role are able to view the sensitive information...
Protecting Your Children with Parental Controls
Chances are, your kids have never known a world when the internet wasn’t there—which is both good and bad news. On the one hand, it means these digital natives take to the online world much quicker than you or I ever did. On the other, it also means they’re less likely to question what they see o...