CVE-2018-5403

Imperva SecureSphere gateway GW running v13, for both pre-First Time Login or post-First Time Login FTL, if the attacker knows the basic authentication passwords, the GW may be vulnerable to RCE through specially crafted requests, from the web access management interface...

RADIUS/TACACS+ users fail to change the default admin password when running the First Time Wizard

...

CVE-2018-19598

Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request...

CVE-2018-19598

Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request...

SEMCMS cross-site scripting vulnerability (CNVD-2019-05836)

SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox, google, 360 and other mainstream browsers. SEMCMS 3.5 cross-site scripting vulnerability , attackers can use the vulnerability through the...

How to properly bind WEM agent machines with WEM broker server on a first time setup

This article explains how to properly bind the WEM agent machines to the WEM broker server on a first time setup of the Citrix Workspace Environment Management product...

Olympic Destroyer Wiper Changes Up Infection Routine

Olympic Destroyer, the wiper malware that briefly disrupted the Winter Olympic Games in South Korea earlier this year, appears to be back with a new first-stage dropper variant. It contains a few significant changes that indicate an evolution for the APT group behind it, according to researchers...

kernel: race condition in snd_seq_write() may lead to UAF or OOB-access

ALSA sequencer core initializes the event pool on demand by invoking sndseqpoolinit when the first write happens and the pool is empty. A user can reset the pool size manually via ioctl concurrently, and this may lead to UAF or out-of-bound access...

DEBIAN-CVE-2018-18192

An issue was discovered in libgig 4.1.0. There is a NULL pointer dereference in the function DLS::File::GetFirstSample in DLS.cpp...

CVE-2018-0466

A vulnerability in the Open Shortest Path First version 3 OSPFv3 implementation in Cisco IOS and IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload. The vulnerability is due to incorrect handling of specific OSPFv3 packets. An attacker could...

Cisco IOS and IOS XE Denial of Service Vulnerability (CNVD-2018-20235)

Cisco IOS Software and IOS XE Software are both operating systems developed by Cisco for its network devices. A denial of service vulnerability exists in the Open Shortest Path First version 3 OSPFv3 implementation in Cisco IOS Software and IOS XE Software. An attacker in close physical proximity...

September 26, 2018—KB4458469 (OS Build 17134.320)

None None...

Beware of Hurricane Florence Relief Scams

If you're thinking of donating money to help victims of Hurricane Florence, please do your research on the charitable entity before giving: A slew of new domains apparently related to Hurricane Florence relief efforts are now accepting donations on behalf of victims without much accountability fo...

Microsoft Windows Defender AV: Configure the Block at First Sight feature

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavblockatfirstsight.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Configure the 'Block at First Sight' feature Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net...

DEBIAN-CVE-2018-14642

An information leak vulnerability was found in Undertow. If all headers are not written out in the first write call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests...

No.1 Adware Removal Tool On Apple App Store Caught Spying On Mac Users

A highly popular top-tier app in Apple's Mac App Store that's designed to protect its users from adware and malware threats has been, ironically, found surreptitiously stealing their browsing history without their consent, and sending it to a server in China. What's more concerning? Even after...

Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2018-17868)

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in Monstra CMS version 3.0.4. The vulnerability can be exploited ...

Kernel: hw: cpu: L1 terminal fault (L1TF)

Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide inter-domain protection through access control and isolation. The L1TF issue was found in the way the x86 microprocessor designs have implemented speculative execution of...

USN-3740-1 linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oem, linux-raspi2 vulnerabilities

It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault L1TF. A local attacker in a guest virtual machine could use this to expose sensitive...

PHP Scripts Mall Car Rental Script Cross-Site Scripting Vulnerability

PHP Scripts Mall Car Rental Script is a set of car rental website scripts by PHP Scripts Mall India. A cross-site scripting vulnerability exists in PHP Scripts Mall Car Rental Script version 2.0.8. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the...