February 2018 Preview of the Quality Rollups for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 for Windows 8.1, RT 8.1 and Server 2012 R2 (KB 4074807)

February 2018 Preview of the Quality Rollups for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 for Windows 8.1, RT 8.1 and Server 2012 R2 KB 4074807 Notice Update KB 4074807 has been released as part of the Preview of Quality Rollups for .NET Framework for February 2018. Parts ...

ozkent.com.tr XSS vulnerability

Open Bug Bounty ID: OBB-550166 Description| Value ---|--- Affected Website:| ozkent.com.tr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-5328

ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows access to various /UserManagement/ privileged modules without authenticating the user; an attacker can misuse these functionalities to perform unauthorized actions, as demonstrated by Edit User Details...

Canadian Police Charge Operator of Hacked Password Service Leakedsource.com

Canadian authorities have arrested and charged a 27-year-old Ontario man for allegedly selling billions of stolen passwords online through the now-defunct service Leakedsource.com. The now-defunct Leakedsource service. On Dec. 22, 2017, the Royal Canadian Mounted Police RCMP charged Jordan Evan...

Microsoft .NET Framework and .NET Core Denial of Service Vulnerability

NET Framework and .NET Core are both products of Microsoft Corporation.Microsoft .NET Framework is a comprehensive and consistent programming model and development platform for building applications for Windows, Windows Store, Windows Server, and Microsoft Azure. NET Framework is a comprehensive...

CVE-2017-1671

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 133638...

QuickApps CMS Cross-Site Scripting Vulnerability

QuickApps CMS is a PHP-based, open source, modular content management system. A cross-site scripting vulnerability exists in the user's real name field in QuickApps CMS version 2.0.0. A remote attacker can exploit this vulnerability to cause a denial of service and perform unauthorized operations...

CVE-2017-1548

IBM Sterling File Gateway 2.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 131288...

CVE-2017-15607

Inedo Otter before 1.7.4 has directory traversal in filesystem-based rafts via vectors involving '/' characters or initial '.' characters, aka OT-181...

November 27, 2017—KB4050946 (Preview of Monthly Rollup)

None None...

November 27, 2017—KB4051034 (Preview of Monthly Rollup)

None None...

November 22, 2017—KB4055254 (OS Build 15063.729)

None None...

November 21, 2017—KB4055038

None None...

CVE-2017-11879

ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability"...

expatriates.com XSS vulnerability

Open Bug Bounty ID: OBB-413939 Description| Value ---|--- Affected Website:| expatriates.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

PyAnyAPI Command Execution Vulnerability

PyAnyAPI is a Python-based tool for creating interfaces on multiple types of data using a declarative approach. A security vulnerability exists in the YAML parsing functionality of the Interfaces.py file in versions of PyAnyAPI prior to 0.6.1. An attacker can exploit this vulnerability by injecti...

ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2017-35597)

ZOHO ManageEngine Applications Manager is a set of IT operations management solutions from ZOHO. A SQL injection vulnerability exists in Zoho ManageEngine Applications Manager version 13. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands via the GraphicalView.do...

Apache Storm Directory Traversal Vulnerability

Apache Storm is the United States Apache Apache Software Foundation of a set of Clojure Concurrent Programming Language development of free open-source distributed real-time computing system. log viewer is one of the log viewer tool. A directory traversal vulnerability exists in the log viewer in...

UBUNTU-CVE-2017-16248

The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character...

Online Exam Test Application SQL Injection Vulnerability

Online Exam Test Application is an online exam management system. A SQL injection vulnerability exists in Online Exam Test Application. An attacker can perform SQL injection via the resources.php sort parameter in a category operation to obtain sensitive database information...