LiteCart File Upload Vulnerability

LiteCart is a free PHP-based e-commerce platform. The platform provides product categorization, payment checkout and search engine and other functions. A security vulnerability exists in the admin/vqmods.app/vqmods.inc.php file in LiteCart versions prior to 2.1.3. A remote attacker can exploit th...

Photon OS 1.0: Linux / Vim PHSA-2017-0006 (deprecated)

An update of linux,vim packages for PhotonOS has been released. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2/7/2019 The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2017-0006. The text itself is copyright C VMware, Inc...

Adobe Acrobat <= 15.006.30434 / 17.011.30096 / 18.011.20055 Multiple Vulnerabilities (APSB18-29) (macOS)

The version of Adobe Acrobat installed on the remote macOS or Mac OS X host is a version prior or equal to 15.006.30434, 17.011.30096, or 18.011.20055. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the...

Hardcoded credentials

Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

CVE-2017-13101

Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

CVE-2017-13100

DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

CVE-2017-13101 Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption

Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

CVE-2017-13104 Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryption

Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

CVE-2017-13100 DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryption

DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

SUSE SLED12 Security Update : Recommended update for NetworkManager-vpnc (SUSE-SU-2018:2297-1)

This update for NetworkManager-vpnc fixes the following issues: Security issue fixed : - CVE-2018-10900: Check configurations that contain newline characters and invalidate them to avoid security attacks bsc1101147. Note that Tenable Network Security has extracted the preceding description block...

CVE-2018-12408

The CVE-2018-12408 entry describes an XXE vulnerability in the BusinessWorks engine components of TIBCO ActiveMatrix BusinessWorks, including the main BusinessWorks product, the z/Linux variant, and the Silver Fabric distribution, all affected up to version 5.13.0. The root cause is an XML Extern...

Snapchat Hack — Hacker Leaked Snapchat Source Code On GitHub

The source code of the popular social media app Snapchat was recently surfaced online after a hacker leaked and posted it on the Microsoft-owned code repository GitHub. A GitHub account under the name Khaled Alshehri with the handle i5xx, who claimed to be from Pakistan, created a GitHub reposito...

Debian DSA-4263-1 : cgit - security update

Jann Horn discovered a directory traversal vulnerability in cgit, a fast web frontend for git repositories written in C. A remote attacker can take advantage of this flaw to retrieve arbitrary files via a specially crafted request, when 'enable-http-clone=1' default is not turned off. C Tenable...

HP Bug Bounty Program: Hack HP Printers & Earn Up To $10,000

By Uzair Amir HP Discloses its Bug Bounty Program and Here’s What You Need To Know. The Palo Alto Calif. based HP Inc., has disclosed what it terms as the industry’s first-ever bug bounty program, which has been launched to inspect printer security relates issues. The print security bug bounty...

Credit Card Issuer TCM Bank Leaked Applicant Data for 16 Months

TCM Bank, a company that helps more than 750 small and community U.S. banks issue credit cards to their account holders, said a Web site misconfiguration exposed the names, addresses, dates of birth and Social Security numbers of thousands of people who applied for cards between early March 2017...

moorefuneralservicesinc.com XSS vulnerability

Open Bug Bounty ID: OBB-657923 Description| Value ---|--- Affected Website:| moorefuneralservicesinc.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

VLC 3.0.x < 3.0.2 Heap Use-After-Free / Remote Code Execution Vulnerability

The version of VLC media player installed on the remote host is earlier than 3.0.2. It is, therefore, affected by a heap use-after-free vulnerability which could result in a remote code execution. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid111518;...

JVN#18716340: Multiple cross-site scripting vulnerabilities in GROWI

GROWI provided by WESEEK, Inc. contains multiple cross-site scripting vulnerabilities listed below. Stored cross-site scripting vulnerability in the UserGroup Management section of admin page CWE-79 - CVE-2018-0652 Version| Vector| Score ---|---|--- CVSS v3|...

[SECURITY] Fedora 28 Update: cups-2.2.6-16.fc28

CUPS printing system provides a portable printing layer for UNIX=EF=BF=BD=EF=BF=BD operating systems. It has been developed by Apple In c. to promote a standard printing solution for all UNIX vendors and users. CUPS provides the System V and Berkeley command-line interfaces...

Ubiquiti Inc.: Reflected XSS in Nanostation Loco M2 - AirOS ver=6.1.7

AirMax XW.v6.2.0 and prior containing multiple end-points with parameters vulnerable to reflected cross site scripting XSS, allowing attackers to abuse the user' session information and/or account takeover of the admin user. These vulnerabilities were found on AirMax AirMax AirOS v6.2.0 and prior...