ZEIT Next.js Directory Traversal Vulnerability (CNVD-2018-03103)

ZEIT Next.js is an open source general-purpose webapps development framework . A directory traversal vulnerability exists in ZEIT Next.js version 4 prior to 4.2.3. An attacker can exploit this vulnerability to access front-end JavaScript components or possibly obtain sensitive data...

Security Flaws in GPS Trackers Puts Millions of Devices’ Data at Risk

By Waqas Trackmadeddon attack puts millions of vulnerable GPS trackers at risk This is a post from HackRead.com Read the original post: Security Flaws in GPS Trackers Puts Millions of Devices Data at Risk...

openstack-tripleo-heat-templates package information disclosure vulnerability

The openstack-triple-heat-templates package is a set of generic template packages that support installation, upgrades, and other operations on the Openstack platform using the Openstack Cloud Facility. A security vulnerability exists in the openstack-tripleo-heat-templates package that stems from...

CVE-2017-1226

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 generates an error message in error logs that includes sensitive information about its environment which could be used in further attacks against the system. IBM X-Force ID: 123905...

The vulnerability of the microprogramming software of Siemens SIMATIC STEP 7 (TIA Portal) arises from the improper storage of common keys in TIA project files. This allows attackers to gain access to confidential information.

The vulnerability of the microprogramming software of Siemens SIMATIC STEP 7 TIA Portal is related to the improper storage of common keys in TIA project files. Exploiting this vulnerability can allow an intruder, operating locally, to gain access to confidential information...

Oracle Hospitality Cruise AffairWhere Unauthorized Access Vulnerability

Oracle Hospitality Applications is a suite of business applications, servers, and storage solutions for hospitality management from Oracle. The solution provides human resources cost management, provide customer service throughout the journey tracking management to improve customer satisfaction a...

CVE-2017-10100

Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub component of Oracle PeopleSoft Products subcomponent: HTML Area. The supported version that is affected is 9.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

Siemens SIMATIC WinCC Sm@rtClient for Android Man-in-the-Middle Attack Vulnerability

Siemens SIMATIC WinCC Sm@rtClient for Android is a client program on Android systems.Siemens SIMATIC is an automation software with a single engineering environment. A man-in-the-middle attack vulnerability exists in Siemens SIMATIC WinCC Sm@rtClient for Android, where an existing implementation ...

Design flaws at fast breakfast app login

Fast Breakfast APP is a mobile service software. There is a design vulnerability in the login of Fast Breakfast App, which uses a timestamp to verify whether a user is logged in, and takes the MD5 value of the first 10 digits of the timestamp to mark whether the user is logged in or not; and ther...

DVFolderContent Module 'download.php' local file inclusion vulnerability in Joomla!

Joomla! is an open source content management system CMS. A local file inclusion vulnerability exists in the Joomla! DVFolderContent Module 'download.php' due to a failure to adequately clean user input data. An attacker could exploit this vulnerability to obtain sensitive information or execute...

Huawei UMA suffers from command line injection vulnerability (CNVD-2016-06968)

Huawei UMA Unified Maintenance Audit is a unified audit system. It provides a unified O&M operation portal, controls and records O&M operations performed by users, and supports auditing by command view and video playback. A command execution vulnerability exists in Huawei UMA. As the system does...

Console: CORS headers set to allow all in Red Hat AMQ

It was found that the Hawtio console setting for the Access-Control-Allow-Origin header permits unrestricted sharing allow all. An attacker could use this flaw to access sensitive information or perform other attacks...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the linux-headers-2.6.26-1-versatile package of the Debian GNU/Linux operating system can be exploited, resulting in a violation of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

Symantec Endpoint Protection Client Competitive Conditions Vulnerability

Symantec Endpoint Protection SEP is a suite of antivirus software from Symantec Corporation. It provides security across physical and virtual systems, and SEP Client is the client software. A competitive condition vulnerability exists in SEP Client version 12.1. An attacker with local access coul...

Apache Tomcat Security Manager Security Restriction Bypass Vulnerability

Apache Tomcat is a popular open source JSP application server program. Apache Tomcat Security Manager in the ResourceLinkFactory.setGlobalContext public method implementation of a security restriction bypass vulnerability, an attacker through a malicious web application to inject the global...

SQL Injection Vulnerability in Website Building System of Shenyang Woodman Culture Communication Co.

Shenyang Woodman Culture Communication Co., Ltd. is a high-tech company dedicated to website construction, mobile client app, customized system application software, e-commerce development and operation. The website building system developed by Shenyang Woodman suffers from SQL injection...

iOS sandboxing vulnerabilities increase the enterprise data risk level-vulnerability warning-the black bar safety net

Appthority researchers found a present in the iOS sandboxed application vulnerabilities in the iOS 8.4.1 the following version of the system will be affected, anyone can use this vulnerability to access the System Management Application Configuration. Sandbox vulnerability-QuickSand Due to this...

LinkedIn Private Bug Bounty Program Goes Public

Public-facing bug bounties are the shiny new bauble of computer security. And with good reason since in most cases, companies that start their own bounties or go through a third-party platform provider are able to take advantage of a pool of skilled contributors, patch products, and improve...

Oracle PeopleSoft Security Vulnerabilities Elevate ERP Security

Enterprise resource planning systems are the unexplored continent of vulnerability research, in spite of the fact that these massive, critical business systems support the inner workings of many large corporations and IT organizations. A recent run of bugs in SAP, and a presentation at this week’...

The vulnerability of the OpenSUSE operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the dbus-1-x11 package in the OpenSUSE operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. Exploiting this vulnerability can be carried out locally...