Arbitrary File Read Vulnerability in Zhiyuan A8-V5

Zhiyuan A8-V5 is a collaborative office platform that realizes efficient business management of enterprises. Zhiyuan A8-V5 has an arbitrary file read vulnerability that can be exploited by attackers to obtain sensitive information...

USN-3907-1 walinuxagent vulnerability

It was discovered that WALinuxAgent created swap files with incorrect permissions. A local attacker could possibly use this issue to obtain sensitive information from the swap file...

Security feature bypass

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, Exposing the hashed content in /etc/passwd may lead to security issue...

GHSA-23XP-J737-282V Path Traversal in takeapeek

All versions of takeapeek are vulnerable to path traversal exposing files and directories. Recommendation As no fix is currently available for this vulnerability is it is our recommendation to use another static file server...

Phabricator: Exposing voting results on the Slowvote application without actually voting

Description There is a feature on the Phabricator Slowvote application which allows creating polls and asking questions. The poll creator can choose to only allow people who voted to actually see the poll results. However, it seems that by sending an illegal vote a user can still see the poll's...

Delta Electronics Delta Industrial Automation PMSoft Out-of-Bounds Read Vulnerability

Delta Electronics Delta Industrial Automation PMSoft is a suite of HMI applications from Delta Electronics. An out-of-bounds read vulnerability exists in Delta Electronics Delta Industrial Automation PMSoft version 2.11 or earlier, which can be exploited by an attacker to read confidential...

PCI DSS v3.2 & Exposing Session ID in URL

Passing the session ID in the URL such as QID 150068 “Session ID in URL” will be marked as a Fail for PCI as of April 15, 2018 in accordance with PCI DSS v3.2. QID 150068 is a PCI Fail according to PCI DSS v3.2 Requirement 6.5.10: 6.5.10 Examine software development policies and procedures and...

CVE-2017-7375

A flaw in libxml2 allows remote XML entity inclusion with default parser flags i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes. Depending on the context, this may expose a higher-risk attack surface in libxml2 not...

Cisco Unified Communications Manager SQL Injection Vulnerability

Cisco Unified Communications Manager CUCM, Unified CM, CallManager is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. sql database interface is one of...

Feds Charge NSA Contractor Accused of Exposing Russian Hacking

The arrest of an alleged source of a classified leak to the Intercept offers a lesson in the risks of spilling secrets. The post Feds Charge NSA Contractor Accused of Exposing Russian Hacking appeared first on WIRED...

Spark: Directory traversal vulnerability in version 2.5

A path traversal issue was found in Spark version 2.5 and potentially earlier versions. The vulnerability resides in the functionality to serve static files where there's no protection against directory traversal attacks. This could allow attackers access to private files including sensitive data...

CVE-2016-4645

CFNetwork in Apple OS X before 10.11.6 uses weak permissions for web-browser cookies, which allows local users to obtain sensitive information via unspecified vectors...

Gratipay: Getting Error Message and in use python version 2.7 is exposed.

Getting Error Message and in use python version 2.7 is exposed. Application is unnecessarily exposing the following response headers and message which divulge its choice of web platform: Request is undecodable. /app/.heroku/python/lib/python2.7/encodings/utf8.py:16...

Vulnerabilities in the Online Direct Marketing Platform of Guangzhou Askway Information Technology Co.

Ltd. is a set of hotel online direct marketing technology and operation service system, focusing on building their own online direct marketing platform and system for hotels, providing consulting, advisory, training and other services to help hotels to improve the operation and revenue capacity...

Specify logging level to Prevent Root DEBUG from Exposing Login

h3. Summary Setting root level DEBUG can expose login information username/pw when JIRA is connected to Crowd for user management, as it outputs the REST POST contents that are transmitted through the HttpClient. h3. Environment Crowd integrated with JIRA for user management. h3. Steps to Reprodu...

Mail.ru: tp-demo1.corp.mail.ru: SVN наружу торчит

http://188.93.56.43:3690 svn://188.93.56.43 success 2 2 edit-pipeline svndiff1 absent-entries commit-revprops depth log-revprops partial-replay Непорядок :...

Anonymous hack 30000 accounts and Social Security Numbers from 'Telecom Italy'

"Please don't mind, its 5th of November" slogan for today ! Anonymous Hackers hacked into "Telecom Italy" www.telecomitalia.it and dump Social Security Number, Social Insurance Number, 30000 credentials and lots of vulnerabilities exposed. In a blog post hackers said,"Telecom Italy boasts 3000 XS...

Apple Supplier Foxconn's Servers Hacked, Exposing Vendor Usernames and Passwords

Apple Supplier Foxconn's Servers Hacked, Exposing Vendor Usernames and Passwords Apple supplier Foxconn has reportedly been hacked, exposing the usernames and passwords of the company's clients and employees. Hacker group SwaggSec just released a dump of Foxconn internal information, including a...