Ubiquiti Inc.: [dev-nightly.ubnt.com] Local File Reading

Description Reading files outside the web root via path traversal PoC http GET /............................\etc\passwd HTTP/1.1 Host: dev-nightly.ubnt.com curl "https://dev-nightly.ubnt.com/......\etc\passwd" Result F213057...

Fedora 26 : kernel (2017-adc7d95627)

The 4.12.5 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

JVN#05340005: WCR-1166DS vulnerable to OS command injection

WCR-1166DS provided by BUFFALO INC.is a wireless LAN router. WCR-1166DS contains an OS command injection vulnerability CWE-78. Impact A user who can access the administrative console of the device may execute an arbitrary OS command. Solution Update the Firmware Apply the firmware update accordin...

JVN#74871939: WSR-300HP vulnerable to arbitrary code execution

WSR-300HP provided by BUFFALO INC. is a wireless LAN router. WSR-300HP contains an arbitrary code execution vulnerability. Impact By executing a specially crafted request prepared by a remote attacker, arbitrary code may be executed. Solution Update the Firmware Apply the firmware update accordin...

atlasrealtyinc.com XSS vulnerability

Vulnerable URL: http://www.atlasrealtyinc.com/%3Cimg%20src=x%20onerror=alert'openbugbounty'%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 05.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website...

OpenEMR Security Bypass Vulnerability

OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A security bypass vulnerability exists in the 'csvloghtml' function in th...

RHEL 7 : pki-core (RHSA-2017:2335)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2335 advisory. Red Hat Certificate System is an enterprise software system designed to manage enterprise public key infrastructure PKI deployments. PKI Core contain...

Breach at Third Party Contractor Affects 18,000 Anthem Members

A month after it agreed to settle 2015’s massive data breach, Anthem Inc., the United States’ largest healthcare company, has a new problem on its hands. The Indianapolis-based company began notifying 18,000 members affected by another unrelated data breach last week. Anthem reported the breach o...

Juniper Junos CLI Local Privilege Escalation (JSA10803)

According to its self-reported version number, the remote Juniper Junos device is affected by an unspecified buffer overflow condition in the CLI component that allows a local attacker who has read-only privileges to execute arbitrary code with root privileges. C Tenable Network Security, Inc...

JVN#24238648: RBB SPEED TEST App fails to verify SSL server certificates

RBB SPEED TEST App provided by IID, Inc. fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Application Update to the latest version according to the information provided by the developer...

JVN#48413726: Multiple vulnerabilities in multiple Buffalo wireless LAN routers

WMR-433 and WMR-433W provided by BUFFALO INC. are wireless LAN routers. WMR-433 and WMR-433W contain multiple vulnerabilities listed below. Cross-site Request Forgery CWE-352 - CVE-2017-2273 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L| Base Score: 4.3...

PEGA Platform 7.2 ML0 - Missing Access Control Cross-Site Scripting

PEGA Platform 7.2 ML0 - Missing Access Control Cross-Site Scripting Summary ======= 1. Missing access control CVE-2017-11356 2. Multiple cross-site scripting CVE-2017-11355 Vendor ====== "Pegasystems Inc. is the leader in software for customer engagement and operational excellence. Pega’s adaptiv...

PEGA Platform <= 7.2 ML0 - Missing Access Control / Cross-Site Scripting Vulnerabilities

Exploit for multiple platform in category web applications Summary ======= 1. Missing access control CVE-2017-11356 2. Multiple cross-site scripting CVE-2017-11355 Vendor ====== "Pegasystems Inc. is the leader in software for customer engagement and operational excellence. Pega’s adaptive,...

PEGA Platform <= 7.2 ML0 - Missing Access Control / Cross-Site Scripting

Summary ======= 1. Missing access control CVE-2017-11356 2. Multiple cross-site scripting CVE-2017-11355 Vendor ====== "Pegasystems Inc. is the leader in software for customer engagement and operational excellence. Pega’s adaptive, cloud-architected software – built on its unified Pega® Platform ...

CVE-2017-1000006

Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue...

Cross site scripting

Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue...

PEGA Platform 7.2 ML0 Missing Access Control / Cross Site Scripting

Summary ======= 1. Missing access control CVE-2017-11356 2. Multiple cross-site scripting CVE-2017-11355 Vendor ====== "Pegasystems Inc. is the leader in software for customer engagement and operational excellence. Pegaas adaptive, cloud-architected software a built on its unified PegaAr Platform...

CVE-2017-1000006

Summary: CVE-2017-1000006 affects Plotly’s plotly.js versions prior to 1.16.0, introducing a cross-site scripting (XSS) vulnerability. Component/affected software: plotly.js (Plotly, Inc.). Root cause / nature: XSS in rendering of plots; vulnerable to injection that can lead to script execution i...

CVE-2017-1000006

Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue...

Barracuda WAF V360 Firmware 8.0.1.014 Grub Password Complexity

KL-001-2017-012 : Barracuda WAF Grub Password Complexity Title: Barracuda WAF Grub Password Complexity Advisory ID: KL-001-2017-012 Publication Date: 2017.07.06 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-012.txt 1. Vulnerability Details Affected Vendor: Barracuda...