10409 matches found
Supreme Directory Theme <= 1.1.8 - Unauthenticated Cross-Site Scripting (XSS)
This theme has a parameter, s, that allows execute a xss payload: " PoC 1. Install the theme 2. Access the web on another browser 3. Write this uri: website.com/?s="...
Red Hat RPM Elevation of Privilege Vulnerability (CNVD-2018-17735)
Red Hat RPM RPM Package Manager is a command-line driven package manager from Red Hat, Inc. that is used to install, uninstall, verify, query, and upgrade computer packages. A security vulnerability exists in Red Hat RPM that stems from rpm's failure to properly handle RPM installations when the...
Fedora Update for php-zendframework-zend-http FEDORA-2018-71e9650fa9
The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
UBUNTU-CVE-2017-7500
It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory ...
Critical: Red Hat Security Advisory: cobbler security update
An update for cobbler is now available for Red Hat Satellite 5.6, Red Hat Satellite 5.7, and Red Hat Satellite 5.8. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...
Siemens SIMATIC STEP 7 and WinCC Denial of Service Vulnerability
Siemens SIMATIC STEP 7 TIA Portal and WinCC TIA Portal are both products of Siemens, Germany.Siemens SIMATIC STEP 7 TIA Portal is a programming software for SIMATIC controllers. The software provides PLC programming, design option packages and advanced drive technology, etc. WinCC TIA Portal is a...
Security Bulletin: Vulnerability in IBM Java Runtime affects TPF Toolkit (CVE-2016-3485)
Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 7 that is used by TPF Toolkit. Vulnerability Details CVEID: CVE-2016-3485 DESCRIPTION: An unspecified vulnerability in Oracle Java SE and Java SE Embedded related to the Networking component has no...
How do file partner programs work?
It's easy to notice if you've fallen victim to an advertising partner program: the system has new apps that you didn't install, ad pages spontaneously open in the browser, ads appear on sites where they never used to, and so on. If you notice these symptoms on your computer, and in the list of...
npm Token Leak in npm
Affected versions of the npm package include the bearer token of the logged in user in every request made by the CLI, even if the request is not directed towards the user's active registry. An attacker could create an HTTP server to collect tokens, and by various means including but not limited t...
chromium-browser: Permissions bypass in extension installation
Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwanted extension via a crafted HTML page...
Fedora Update for sox FEDORA-2018-57a9f93beb
The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Introducing: Malwarebytes Browser Extension
Are you tired of all the unwanted content the world wide web offers up, whether you like it or not? It is our privilege to introduce you to the Malwarebytes Browser Extension BETA. Or, better said, the Malwarebytes Browser Extensions, because we have one for Firefox and one for Chrome. Introducti...
Arbitrary Code Execution Vulnerability in GolemCMS
GolemCMS is a PHP-based content management system CMS. An arbitrary code execution vulnerability exists in GolemCMS version 2008-12-24 and earlier. A remote attacker can execute arbitrary PHP code or obtain sensitive information by sending a direct request to the 'Table prefix' form field in...
CVE-2018-6169
Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwanted extension via a crafted HTML page...
CVE-2018-14579
GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote attackers to execute arbitrary PHP code by inserting this code into the "Database Information" "Table prefix" form field, or obtain sensitive information via a direct request for...
CVE-2018-14579
GolemCMS (before 2008-12-24) is affected. If the install/ directory remains active after installation, remote attackers can execute arbitrary PHP code by injecting code into the Database Information > Table prefix field or obtain sensitive information via a direct request to install/install.sq...
July 24, 2018—KB4340917 (OS Build 17134.191)
None None...
Fedora Update for uwsgi FEDORA-2018-acfce682f4
The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EU Fines Google Record $5 Billion in Android Antitrust Case
Google has been hit by a record-breaking $5 billion antitrust fine by the European Union regulators for abusing the dominance of its Android mobile operating system and thwarting competitors. That's the largest ever antitrust penalty. Though Android is an open-source and free operating system,...
Unauthorized users are able to determine when a plugin was extracted from its JPI package
Files indicating when a plugin JPI file was last extracted into a subdirectory of plugins/ in the Jenkins home directory were accessible via HTTP by users with Overall/Read permission. This allowed unauthorized users to determine the likely install date of a given plugin. The affected files are n...