Xxe

The TIBCO Designer component of TIBCO Software Inc.'s TIBCO Runtime Agent, and TIBCO Runtime Agent for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion XXE attacks to disclose host machine information. Affected releases are TIBCO Software Inc.'...

Scientific Linux Security Update : plexus-archiver on SL7.x (noarch) (20180612)

Security Fixes : - plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file CVE-2018-1002200 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid110508; scriptversion"1.5"...

Debian DSA-4221-1 : libvncserver - security update

Alexander Peslyak discovered that insufficient input sanitising of RFB packets in LibVNCServer could result in the disclosure of memory contents. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4221. The text...

Fortinet FortiGate <= 5.2.x / 5.4.x < 5.4.9 / 5.6.x < 5.6.3 Multiple Vulnerabilities (FG-IR-17-231, FG-IR-17-245 and FG-IR-17-172)

The remote host is running FortiOS 5.2.x or prior, 5.4.x prior to 5.4.9, or 5.6.x prior to 5.6.3. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid110415; scriptversion"1.9";...

Quest DR Series Disk Backup Software 4.0.3 Code Execution

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Quest DR Series Disk Backup Multiple Vulnerabilities 1. Advisory Information Title: Quest DR Series Disk Backup Multiple Vulnerabilities Advisory ID: CORE-2018-0002 Advisory URL:...

BlogoText Cross-Site Scripting Attack Vulnerability

BlogoText is a lightweight SQLite blogging engine. A cross-site scripting vulnerability exists in BlogoText versions prior to 3.7.6. The vulnerability can be exploited remotely to inject JavaScript code with the help of comments in the inc/conv.php file...

JVN#96954395: Nessus vulnerable to cross-site scripting

Nessus provided by Tenable, Inc. contains a stored cross-site scripting vulnerability CWE-79. Impact Arbitrary JavaScript may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the information provided by the developer. Products Affected...

Mozilla Firefox ESR < 52.8

The version of Firefox ESR installed on the remote Windows host is prior to 52.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-12 advisory. - Mozilla developers backported selected changes in the Skia library to the ESR52 branch of Firefox. These changes...

CVE-2018-0580

Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series CLIP STUDIO PAINT for Windows EX/PRO/DEBUT Ver.1.7.3 and earlier, CLIP STUDIO ACTION for Windows Ver.1.5.5 and earlier, with its timestamp prior to April 25, 2018, 12:11:31, and CLIP STUDIO MODELER for Windows Ver.1.6.3 and...

CVE-2018-0568

Unrestricted file upload vulnerability in SiteBridge Inc. Joruri Gw Ver 3.2.0 and earlier allows remote authenticated users to execute arbitrary PHP code via unspecified vectors...

Unrestricted file upload

Unrestricted file upload vulnerability in SiteBridge Inc. Joruri Gw Ver 3.2.0 and earlier allows remote authenticated users to execute arbitrary PHP code via unspecified vectors...

CVE-2018-0568

Unrestricted file upload vulnerability in SiteBridge Inc. Joruri Gw Ver 3.2.0 and earlier allows remote authenticated users to execute arbitrary PHP code via unspecified vectors...

Ubiquiti Inc.: Two Factor Authentication Bypass

The researcher found a method to brute-force the 2FA code request in the www.ubnt.com login page. This method still requires the username/password from the account...

JVN#34562916: RT-AC1200HP vulnerable to cross-site scripting

RT-AC1200HP provided by ASUS Japan Inc. is a wireless LAN router. RT-AC1200HP contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the logged in user's web browser. Solution Update the Firmware Apply the firmware update according to the information...

JVN#33901663: RT-AC87U vulnerable to cross-site scripting

RT-AC87U provided by ASUS Japan Inc. is a wireless LAN router. RT-AC87U contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Firmware Apply the firmware update according to the information provided by the...

JVN#73742314: RT-AC68U vulnerable to cross-site scripting

RT-AC68U provided by ASUS Japan Inc. is a wireless LAN router. RT-AC68U contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Firmware Apply the firmware update according to the information provided by the...

phpMyAdmin security bypass vulnerability (CNVD-2018-10169)

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A security vulnerability exists in the...

Oracle WebLogic HTTP Detection

Oracle formerly BEA WebLogic, a Java EE application server, is running on the remote web server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid109553; scriptversion"1.4"; scriptcvsdate"Date: 2019/11/22"; scriptnameenglish:"Oracle WebLogic HTTP Detection";...

Oracle WebLogic T3 Protocol Detection

The remote host is running the WebLogic t3 Protocol. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid109552; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01"; scriptnameenglish:"Oracle WebLogic T3 Protocol Detection";...

Design/Logic Flaw

The GridServer Broker, GridServer Driver, and GridServer Engine components of TIBCO Software Inc. TIBCO DataSynapse GridServer Manager contain vulnerabilities related to both the improper use of encryption mechanisms and the use of weak ciphers. A malicious actor could theoretically compromise th...