Unsafe Pseudorandom Number Generation Through The Use Of Insecure Entropy Source

uuid and node-uuid have flaws which lead to the use of an insecure entropy source "Math.random" to generate pseudorandom numbers instead of using a secure Cryptographic API...

The vulnerabilities of Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense’s microprogramming software, related to access control deficiencies, allow attackers to enhance their privileges.

The vulnerabilities of Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense microprogramming systems are related to access control deficiencies. Exploiting these vulnerabilities can allow attackers operating remotely to enhance their privileges...

KLA11404 Multiple vulnerabilities in Microsoft Development Tools

Multiple vulnerabilities were found in Microsoft Development Tools. Malicious users can exploit these vulnerabilities to obtain sensitive information, perform cross-site scripting attacks. Below is a complete list of vulnerabilities: 1. A cross-site-scripting XSS vulnerability in Team Foundation...

Popular Web-Hosting Platform Bluehost Riddled with Flaws

UPDATE A researcher has uncovered several one-click client-side vulnerabilities in the popular Bluehost web hosting platform. These would allow cybercriminals to easily carry out complete account takeover, according to the analysis. Bluehost has acknowledged the issue, and told Threatpost, “We ar...

The vulnerability of the Palo Alto Networks Expedition configuration migration software lies in its authentication procedures’ deficiencies, which allow attackers to gain access to protected information.

The vulnerability of the Expedition Migration Tool’s migration tool is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected information...

The vulnerability of D-Link DIR-620 router’s microprogramming software, related to deficiencies in access control, allows attackers to gain access to protected information.

The vulnerability of D-Link DIR-620 router microprogramming software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain access to protected information from a remote location...

The vulnerability of Microsoft Exchange Server, related to access control deficiencies, allows a hacker to execute arbitrary code in the context of the system’s users.

The vulnerability of Microsoft Exchange Server servers is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the system’s users, by sending a specially crafted email message...

CVE-2017-15404

An ability to process crash dumps under root privileges and inappropriate symlinks handling could lead to a local privilege escalation in Crash Reporting in Google Chrome on Chrome OS prior to 61.0.3163.113 allowed a local attacker to perform privilege escalation via a crafted HTML page...

ThreatList: WordPress Vulnerabilities Up 30 Percent in 2018

UPDATE Vulnerabilities in popular content management system CMS WordPress are growing at a rapid rate, up 30 percent in 2018, according to new web application bug research released Wednesday. Researchers at Imperva said that in 2018, they continued to see a trend of increasing web application...

Microsoft Patch Tuesday — January 2019 Security Updates Released

Microsoft has issued its first Patch Tuesday for this year to address 49 CVE-listed security vulnerabilities in its Windows operating systems and other products, 7 of which are rated critical, 40 important and 2 moderate in severity. Just one of the security vulnerabilities patched by the tech...

Microsoft Windows Multiple Vulnerabilities (KB4480973)

This host is missing a critical security update according to Microsoft KB4480973 SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows Multiple Vulnerabilities (KB4480116)

This host is missing a critical security update according to Microsoft KB4480116 SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Word 2010 Service Pack 2 Multiple Vulnerabilities (KB4461625)

This host is missing an important security update according to Microsoft KB4461625 SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Windows Multiple Vulnerabilities (KB4480970)

This host is missing an important security update according to Microsoft KB4480970 SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Windows Multiple Vulnerabilities (KB4480963)

This host is missing an important security update according to Microsoft KB4480963 SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

ZenPhoto 1.4.14 Cross Site Scripting

Multiple Cross-site Scripting Vulnerabilities in ZenPhoto 1.4.14 Information -------------------- Advisory by Netsparker Name: Multiple Cross-Site Scripting Vulnerabilities in ZenPhoto 1.4.14 Affected Software: ZenPhoto Affected Versions: 1.4.14 Homepage: http://www.zenphoto.org/ Vulnerability:...

Webgalamb Information Disclosure / XSS / CSRF / SQL Injection

Summary ------- Vendor: E.N.S. Zrt www.ens.hu Product: Webgalamb www.webgalamb.hu, www.facebook.com/webgalamb Webgalamb is a commercial email marketing software for managing subscription lists and sending out bulk emails. It is not SaaS but a PHP based web application that is typically hosted nex...

Adobe Issues Emergency Patches for Two Critical Flaws in Acrobat and Reader

I hope you had biggest, happiest and craziest New Year celebration, but now it's time to come back at work and immediately update your systems to patch new security flaws that could exploit your computer just by opening a PDF file. Adobe has issued an out-of-band security update to patch two...

Adobe Acrobat Reader 2017 Multiple Vulnerabilities (APSB19-02) - Mac OS X

Adobe Acrobat Reader 2017 is prone to multiple arbitrary code execution vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2018-20346

Multiple flaws were found in sqlite. An attacker having the ability to run arbitrary SQL commands could use this flaw to execute arbitrary code with the permission of the user running the sqlite application...