3355 matches found
PT-2018-1519 · Containous · Traefik
Name of the Vulnerable Software and Affected Versions: Containous Traefik versions 1.6.x through 1.6.5 Description: The issue is related to errors in the implementation of the API in the Containous Traefik reverse proxy server. If the --api option is used and authentication is missing, the...
Exposed API
Apache's spark contains an exposed API due to the default value of spark.master.rest.enabled being set to true. This allows remote attackers to connect to the API without authentication and run driver programs but not launch executors...
GHSA-J49G-MP79-5VM5 coffe-script is malware
The coffe-script package is a piece of malware that steals sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation If you have found coffe-script installed in your...
SQL Injection Vulnerability in Beijing Yizaitong Information Technology Co.
Beijing Yizaitong Information Technology Co., Ltd. has been committed to enterprise procurement information technology, procurement consulting field, oriented to procurement management, group intensive procurement management, lean supply chain, strategic procurement, project supply chain,...
Samsung SmartThings Hub video-core credentials Parsing SQL Injection Vulnerability(CVE-2018-3879)
Summary An exploitable JSON injection vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub. The video-core process incorrectly parses the user-controlled JSON payload, leading to a JSON injection which in turn leads to a SQL injection in the...
CVE-2017-7543
A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0:...
sqlite.js is malware
The sqlite.js package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security conce...
GHSA-F7JG-MCVW-9GWV Directory Traversal in reecerver
Affected versions of reecerver resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system. Example...
rails_admin ruby cross-site request forgery vulnerability
railsadmin ruby is a Rails engine that supports the use of interfaces to manage data. A cross-site request forgery vulnerability exists in versions of railsadmin ruby prior to 1.1.1, which stems from a failure of the Non-GET method to validate a cross-site request forgery token. An attacker could...
CVE-2018-11717
An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain depending on the modules configured the Base64 encoded Password/Username of AD accounts, the cleartext Password/Username and mail settings of the...
Apache LDAP API Information Disclosure Vulnerability
Apache LDAP API is a U.S. Apache Apache Software Foundation API for accessing LDAP servers. A security vulnerability exists in Apache LDAP API versions prior to 1.0.2. An attacker can exploit the vulnerability to disclose information including: credentials contained in a request...
CVE-2018-0025 Junos OS: SRX Series: Credentials exposed when using HTTP and HTTPS Firewall Pass-through User Authentication
When an SRX Series device is configured to use HTTP/HTTPS pass-through authentication services, a client sending authentication credentials in the initial HTTP/HTTPS session is at risk that these credentials may be captured during follow-on HTTP/HTTPS requests by a malicious actor through a...
CVE-2018-2440
Under certain circumstances SAP Dynamic Authorization Management DAM by NextLabs Java Policy Controller versions 7.7 and 8.5 exposes sensitive information in the application logs...
Ansible Information Disclosure Vulnerability (CNVD-2018-12556)
Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage and orchestrate computer systems. A security vulnerability exists in Ansible version 2.5 before 2.5.5 and version 2.4 before 2.4.5. An attacker can exploit the vulnerability to expose sensiti...
CVE-2018-7782
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, authenticated users can view passwords in clear text...
CVE-2018-10855
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the nolog task flag for failed tasks. When the nolog flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on th...
Medtronic MyCareLink Patient Monitor Exposes Dangerous Method or Function Vulnerability
MyCareLink Patient Monitor is a patient monitor product developed by Medtronic, Inc. The Medtronic MyCareLink Patient Monitor has an Exposed Danger Method or Function vulnerability that can be exploited by an attacker with physical access to the device to access debugging functions of the monitor...
CVE-2018-10662
An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface...
