Unspecified Vulnerability in Oracle Hospitality Simphony First Edition (CNVD-2018-09079)

Oracle Hospitality Simphony First Edition is an enterprise hospitality management platform that delivers point-of-sale POS and back-office functionality on fixed and mobile devices to support stadiums, arenas and other food and beverage operations. An unspecified vulnerability exists in the Clien...

Unspecified Vulnerability in Oracle Hospitality Simphony First Edition (CNVD-2018-09078)

Oracle Hospitality Simphony First Edition is an enterprise hospitality management platform that delivers point-of-sale POS and back-office functionality on fixed and mobile devices to support stadiums, arenas and other food and beverage operations. An unspecified vulnerability exists in the...

CVE-2017-12701

BMC Medical Luna CPAP Machines released prior to July 1, 2017, contain an improper input validation vulnerability which may allow an authenticated attacker to crash the CPAP's Wi-Fi module resulting in a denial-of-service condition...

Microsoft Office: Disable First Run Movie

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013firstrunmovie.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Disable First Run Movie Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is free...

Perception Matters: Making RUM More Real

Traditional nav timing metrics have given us a lot in the way of understanding how our pages and apps are performing, but as users' expectations rise and page complexity grows, you need to really understand how users are perceiving the performance of your website beyond traditional page load...

gnome-session: Xsession creation of XDG user directories does not honor system umask policy

It was found that the system umask policy is not being honored when creating XDG user directories /Desktop etc on first login. This could lead to user's files being inadvertently exposed to other local users...

tcpdump: Buffer over-read in print-ospf6.c:ospf6_decode_v3() in OSPFv3 parser

The OSPFv3 parser in tcpdump before 4.9.2 has a buffer over-read in print-ospf6.c:ospf6decodev3...

Word Attachment Delivers FormBook Malware, No Macros Required

A new wave of document attacks targeting inboxes do not require enabling macros in order for adversaries to trigger an infection chain that ultimately delivers FormBook malware. Researchers at Menlo Security are reporting a wave of attacks that began last month that are targeting financial and...

CVE-2018-9230

In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.geturiargs and ngx.req.getpostargs functions that ignore parameters beyond the hundredth one, which might allow remote attackers to bypass intended access restrictions or interfere with certain Web Application Firewall...

first-sensor.com XSS vulnerability

Open Bug Bounty ID: OBB-591185 Description| Value ---|--- Affected Website:| first-sensor.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

go.firsttimebuyerwebinar.com XSS vulnerability

Open Bug Bounty ID: OBB-585514 Description| Value ---|--- Affected Website:| go.firsttimebuyerwebinar.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-8720

ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile aka navpage.do, or the Search bar of My Portal aka searchresults.do...

eQ-3 AG HomeMatic CCU2 User.getLanguage method directory traversal vulnerability

The eQ-3 AG Homematic CCU2 is a central control unit for controlling smart home devices from eQ-3 Germany. A directory traversal vulnerability exists in the User.getLanguage method in eQ-3 AG Homematic CCU2 version 2.29.2 and earlier. A remote attacker can exploit this vulnerability to read the...

CVE-2018-7296

Directory Traversal / Arbitrary File Read in User.getLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to read the first line of an arbitrary file on the CCU2's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web...

Progress Sitefinity Cross-Site Scripting Vulnerability (CNVD-2018-05684)

Progress Sitefinity is an open source platform for building corporate websites and intranets. A cross-site scripting vulnerability exists in Progress Sitefinity version 9.1. The vulnerability can be exploited by remote attackers to inject malicious JavaScript code via the Last name, First name, a...

Atlassian Bitbucket Server Path Traversal Vulnerability

Atlassian Bitbucket Server is a Git code hosting solution from Atlassian Australia. The solution is capable of managing and reviewing code with features such as diff view, JIRA integration and build integration. A path traversal vulnerability exists in the repository settings resource in Atlassia...

The vulnerability of the Mozilla Firefox ESR browser arises from an operation that goes beyond buffer boundaries in memory, allowing attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Mozilla Firefox ESR browser arises from an operation that goes beyond the buffer boundaries when applying style rules to pseudo-elements such as ::first-line. Exploiting this vulnerability can allow a malicious actor to cause a service failure using cached style data...

Essays from 7 Experts on Moving to a Cloud-Based Endpoint Security Platform

Carbon Black recently published a series of essays about the experiences of experts in the field on information security as they moved their endpoint security program to the cloud; this is one of those essays. To read the full series check out 7 Experts on Moving to a Cloud-Based Endpoint Securit...

CVE-2017-18038

The repository settings resource in Atlassian Bitbucket Server before version 5.6.0 allows remote attackers to read the first line of arbitrary files via a path traversal vulnerability through the default branch name...

Threat Analysis: Pylot (Travle) Malware Family

The Pylot or Travle malware family appears to be an evolution of the NetTravler malware family which has been linked to attackers out of China by numerous sources. Over the last year a variant has been observed as a secondary payload often used in conjunction with malicious carrier files typicall...