4542 matches found
CVE-2017-6620
A vulnerability in the remote management access control list ACL feature of the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, remote attacker to bypass the remote management ACL. The vulnerability is due to incorrect implementation of the ACL decision made during the ingress...
Cisco CVR100W Wireless-N VPN Router Remote Management Security Bypass Vulnerability
A vulnerability in the remote management access control list ACL feature of the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, remote attacker to bypass the remote management ACL. The vulnerability is due to incorrect implementation of the ACL decision made during the ingress...
The vulnerability of the QEMU hardware emulation software, which allows a hacker to trigger a service failure
The vulnerability of the hw/watchdog/wdti6300esb.c component of the QEMU hardware emulation software is related to a memory leak. Exploiting this vulnerability could allow an attacker, operating locally, to trigger a service failure memory consumption through a large number of operations on devic...
About the security content of Safari 10.1
About the security content of Safari 10.1 This document describes the security content of Safari 10.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
Cybozu KUNAI for Android information management vulnerability
Overview Cybozu KUNAI for Android is a mobile client software for using Cybozu from an Android device. Cybozu KUNAI for Android provides a function to output log information when synchronizing data with Cybozu, however the function is disabled by default. Cybozu KUNAI for Android contains an issu...
Privilege escalation
An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the locked bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disabledmverity' command. Having dm-verity disabled, the kernel will not verify the system...
Events and disabled form fields
I've been working on the web since I was a small child all the way through to the haggard old man I am to day. However, the web still continues to surprise me. Turns out, mouse events don't fire when the pointer is over disabled form elements, except in Firefox. Serious? Serious. Give it a go. Mo...
BINOM3 Electric Power Quality Meter Hard-Coded Vulnerability
BINOM3 Electric Power Quality Meter is an electrical power quality monitor for SCADA systems from the Russian company BINOM3. A hard-coded vulnerability exists in BINOM3 Electric Power Quality Meter, where users do not have permission to change their passwords...
OpenSSH < 7.4 - 'UsePrivilegeSeparation Disabled' Forwarded Unix Domain Sockets Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1010 This issue affects OpenSSH if privilege separation is disabled config option UsePrivilegeSeparation=no. While privilege separation is enabled by default, it is documented as a hardening option, and therefore disabling it shoul...
Stored Cross-Site Scripting Vulnerability in SS-Panel
SS-Panel is a front-end program that works with Shadowsocks-Manyuser. A stored cross-site scripting vulnerability exists in SS-Panel version 3.3.9. Since HttpOnly is not enabled by default, an attacker can exploit the vulnerability to obtain an administrator cookie and use the cookie to log in to...
Microsoft Internet Explorer 9 - IEFRAME CView::EnsureSize Use-After-Free (MS13-021)
Microsoft Internet Explorer 9 - IEFRAME CView::EnsureSize Use-After-Free MS13-021 var oElement = document.getElementById"ruby"; var oElement = oElement.parentNode.removeChildoElement; document.write""; document.documentElement.offsetTop; setTimeout"location.reload", 100; !-- Time-lin...
XenMobile user shows as "Anonymous" in XenMobile Admin Console
Within the XenMobile console, under the user column, few users started showning as anonymous. In zdm.logs we might see:User '[email protected]' not found or is disabled. Switching to anonymous mode...
Extreme ExtremeXOS OpenSSL Vulnerability (VN-2016-002)
Extreme ExtremeXOS is prone to an OpenSSL vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:extremenetworks:exos"; i...
VulnCheck KEV: CVE-2016-8870
The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting...
Account creation vulnerability in Joomla!
Joomla! is a PHP-based open source content management system CMS. Can be used to build commercial Web sites , personal blogs , information management systems , Web services , etc. , but also for secondary development to expand the scope of use . An account creation vulnerability exists in Joomla!...
MGASA-2016-0359 Updated java-1.8.0-openjdk packages fix security vulnerability
It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy function in certain cases. An untrusted Java application or applet could use this flaw to corrupt virtual machine's memory and completely bypass Java sandbox restrictions CVE-2016-5582...
UBUNTU-CVE-2016-5288
Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox 49.0.2...
[20161001] - Core - Account Creation
Inadequate checks allows for users to register on a site when registration has been disabled...
Atlassian Confluence Server 5.8.x < 5.8.6 Multiple Vulnerabilities
Binary data 9645.prm...
Debian DLA-598-1 : suckless-tools security update
It was discovered that the slock screen locking tool would segfault when the user's account had been disabled. slock called crypt3 and used the return value for strcmp3 without checking to see if the return value of crypt3 was a NULL pointer. If the hash returned by getspnam-sppwdp was invalid,...