275 matches found
A logged in back end user can include arbitrary existing PHP files by manipulating an URL parameter
More info at https://contao.org/en/news/contao-441.html...
A logged in back end user can include arbitrary existing PHP files by manipulating an URL parameter
More info at https://contao.org/en/news/contao-3528.html...
Hardcoded credentials
A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Master, A520 Slave, A530, A542, A571, Check Bin Grader, FlowlineQC T376, IPM3 Dual Cam v132, IPM3 Dual Cam v139, IPM3 Single Cam v132, P520,...
Honeypots and the Internet of Things
There were a number of incidents in 2016 that triggered increased interest in the security of so-called IoT or 'smart' devices. They included, among others, the record-breaking DDoS attacks against the French hosting provider OVH and the US DNS provider Dyn. These attacks are known to have been...
End of support for Office 2013
End of support for Office 2013 Support for Office 2013 ended on April 11, 2023 and there will be no extension and no extended security updates. All of your Office 2013 apps will continue to function. However, you could expose yourself to serious and potentially harmful security risks.Buy or try...
May 26, 2017—KB4023680 (OS Build 14393.1230)
None None...
Strengthening Network Access Security with Multi-Factor Authentication
As technology continues to develop, more and more applications become not just convenient, but necessary. It was less than a decade ago that it was inconceivable we would 'need' to carry a consumer device to access the internet in our pockets. Today, it is essential. The same is true with the...
Cross site scripting
Cross Site Scripting Vulnerability in core-eMLi in AuroMeera Technometrix Pvt. Ltd. eMLi V1.0 allows an Attacker to send malicious code, generally in the form of a browser-side script, to a different end user via the page parameter to code/studentportal/home.php. The affected versions are eMLi...
Deploying enterprise MDX enabled apps from App Store via Volume Purchase
The CEM/XenMobile Server is currently optimized for Volume Purchase distribution of Public App Store apps that are not MDX enabled. While it is possible to distribute MDX enabled apps from App Store via volume purchase, some considerations must be taken into account for optimal performance. This...
Cisco UCS Director Privilege Escalation Vulnerability
A vulnerability in the web-based GUI of Cisco UCS Director could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyrig...
CVE-2017-3801
A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile, a Privilege Escalation Vulnerability. The vulnerability is due to improper role-based access control RBAC...
Cisco UCS Director Privilege Escalation Vulnerability
A vulnerability in the web-based GUI of Cisco UCS Director could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile. The vulnerability is due to improper role-based access control RBAC after the Developer Menu is enabled in Cisco UCS Director...
NetsCaler: Smart Card Authentication with EULA using nfactor
We need to do Smart Card Authentication on the NetScaler virtual server NetScaler Gateway or Load balancing and also we need the users to accept the End User License Agreement EULA before they could access the backend resource...
SUSE-SU-2016:3148-1 Security update for flash-player
This update for flash-player fixes the following issues: - Security update to 24.0.0.186 bsc1015379 APSB16-39: These updates resolve use-after-free vulnerabilities that could have lead to code execution CVE-2016-7872, CVE-2016-7877, CVE-2016-7878, CVE-2016-7879, CVE-2016-7880, CVE-2016-7881,...
CVE-2016-9212
Cisco Web Security Appliance (WSA) Drop Decrypt Policy Bypass (CVE-2016-9212) is caused by incomplete HTTP header input validation in the Decrypt for End-User Notification configuration. Under HTTPS decryption, an unauthenticated remote attacker could connect to a blocked HTTPS website despite po...
CVE-2016-5495
Unspecified vulnerability in the Oracle Discoverer component in Oracle Fusion Middleware 11.1.1.7.0 allows remote attackers to affect confidentiality via vectors related to EUL Code & Schema...
SUSE-SU-2016:2512-1 Security update for flash-playerqemu
flash-player was updated to version 11.2.202.637 to fix the following issues bsc1004019: CVE-2016-6992: A type confusion vulnerability that could lead to code execution. CVE-2016-6981, CVE-2016-6987: use-after-free vulnerabilities that could lead to code execution CVE-2016-4286: Security bypass...
ArcServe UDP 6.0.3792 Update 2 Build 516 - Unquoted Service Path Privilege Escalation
Exploit for windows platform in category local exploits Title: ArcServe UDP - Unquoted Service Path Privilege Escalation CWE Class: CWE-427: Uncontrolled Search Path Element Date: 04/09/2016 Vendor: ArcServe Product: ArcServe UDP Standard Edition for Windows, TRIAL Type: Backup Software Version:...
ArcServe UDP 6.0.3792 Update 2 Build 516 - Unquoted Service Path Privilege Escalation
ArcServe UDP 6.0.3792 Update 2 Build 516 - Unquoted Service Path Privilege Escalation Title: ArcServe UDP - Unquoted Service Path Privilege Escalation CWE Class: CWE-427: Uncontrolled Search Path Element Date: 04/09/2016 Vendor: ArcServe Product: ArcServe UDP Standard Edition for Windows, TRIAL...