Cross site scripting

October CMS version prior to build 437 contains a Cross Site Scripting XSS vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable...

CVE-2018-1999008

October CMS version prior to build 437 contains a Cross Site Scripting XSS vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable...

Directory Traversal

Play Assets Controller is affected by a path traversal vulnerability. The application incorrectly handles file paths, making it possible to access files on the classpath that are stored outside of the public folder. This vulnerability only affects the application running on Windows...

CVE-2016-9486 On Windows endpoints, the SecureConnector agent is vulnerable to privilege escalation whereby an authenticated unprivileged user can obtain administrator privileges on the endpoint because files are created in a folder with incorrect privileges

On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality of the agent. The typical configuration is for the agent to run as a Windows service under the local SYSTEM account. The SecureConnector...

Total AV 4.6.19 Insecure Permissions

===== Tempest Security Intelligence - ADV-23/2018 === Total AV 4.1.7 4 .6.19 - Insecure Permissions ------------------------------------------------------- Author: - Filipe Xavier Oliveira: ===== Table of Contents ===================================================== Overview Detailed description...

DEBIAN-CVE-2017-7471

Quick Emulator Qemu built with the VirtFS, host directory sharing via Plan 9 File System 9pfs support, is vulnerable to an improper access control issue. It could occur while accessing files on a shared host directory. A privileged user inside guest could use this flaw to access host file system...

CVE-2018-9998

Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks...

CVE-2018-9998

Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks...

CVE-2018-7681

Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain administrative privileges then this vulnerability can impact other users in the system...

Security update 2018-06-19

...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM Platform Symphony and IBM Spectrum Symphony (CVE-2016-3610 CVE-2016-3598 CVE-2016-3606 CVE-2016-3587 CVE-2016-3511 CVE-2016-3550 CVE-2016-3485)

Summary Vulnerability in IBM Java SDK affects IBM Platform Symphony and IBM Spectrum Symphony Vulnerability Details CVE IDs: CVE-2016-3610 CVE-2016-3598 CVE-2016-3606 CVE-2016-3587 CVE-2016-3511 CVE-2016-3550 CVE-2016-3485 Affected Products and Versions IBM Platform Symphony: 5.2, 6.1.0.1, 6.1.1,...

CVE-2018-5756

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a...

Security Bulletin: Potential information leakage during process app export in IBM Business Process Manager (CVE-2017-1346)

Summary IBM Business Proccess Manager temporarily stores files in an usually shared directory during offline installs and thus might leak sensitive information stored in the files. Vulnerability Details CVEID: CVE-2017-1346 DESCRIPTION: IBM Business Process Manager temporarily stores files in a...

Multiple Calendars Secure Mail

Question: Can I synchronize multiple calendar or contacts folders using Secure Mail? Answer: You can only synchronize your default calendar folder, contact folder, and tasks folder. There is a third party limitation related to how Active Sync works, on the Microsoft website you can find the...

Twonky Server < 8.5.1 Multiple XSS Vulnerabilities

Twonky Server is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2018-9177

Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen...

CVE-2018-9177

Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen...

Design/Logic Flaw

Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen...

Microsoft Windows 10 #MicrosoftWindows #Windows10 scrrun.dll Active-X Creation / Deletion Issues

Exploit for windows platform in category dos / poc Title: Windows 10 'scrrun.dll' Multiple vulnerabilities Author: Nassim Asrir Contact: email protected / https://www.linkedin.com/in/nassim-asrir-b73a57122/ Vendor: https://www.microsoft.com/ Test ENV: ======== Browser : IE 11 OS: Windows 10 - x64...

Arbitrary File Write

Apache Hadoop Common is vulnerable to zip-slip vulnerability. The vulnerability exists when the attacker inputs a malicious zip archive with filenames including file traversal characters such as dot dot .., leading to concatenation of file path locating outside of the destination folder...