Design/Logic Flaw

An issue was discovered in Open Ticket Request System OTRS 7.x before 7.0.5. An attacker who is logged into OTRS as an agent or a customer user can use the search result screens to disclose information from invalid system entities. Following is the list of affected entities: Custom Pages, FAQ...

CVE-2019-9753

An issue was discovered in Open Ticket Request System OTRS 7.x before 7.0.5. An attacker who is logged into OTRS as an agent or a customer user can use the search result screens to disclose information from invalid system entities. Following is the list of affected entities: Custom Pages, FAQ...

CVE-2019-9753

Removed by vendor...

CVE-2019-9753

OTRS 7.x before 7.0.5 has an information disclosure vulnerability (CVE-2019-9753). An authenticated user (agent or customer) can use search result screens to disclose data from internal entities: Custom Pages, FAQ Articles, Service Catalogue Items, and ITSM Configuration Items. Root cause: inform...

WordPress WPGraphQL 0.2.3 Authentication Bypass / Information Disclosure

!/usr/bin/env python Author: Simone Quatrini of Pen Test Partners CVEs: 2019-9879, 2019-9880, 2019-9881 Tested on Wordpress 5.1.1 and wp-graphql 0.2.3 https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/ import argparse import requests import base64 import json import sys parse...

CVE-2017-9362

ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API...

CVE-2017-9362

CVE-2017-9362 affects ManageEngine ServiceDesk Plus prior to version 9312, where an XML injection vulnerability exists in the CMDB API’s add Configuration items endpoint. The issue allows crafted XML data to be processed by the application, potentially impacting confidentiality, integrity, and av...

CVE-2017-9362: Improper Restriction of XML External Entity Reference

ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API...

tcpdump 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads

tcpdump 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads Through fuzzing of network capture .pcap files, we have identified 16 crashes with unique stack traces in tcpdump. These crashes are caused by heap-based out-of-bounds memory reads, and can be reproduced with the latest tcpdump source code...

BlueHat Shanghai 2019 Call for Papers is Now Open!

We know security experts with diverse skills and experiences are found around the world. This year, the BlueHat Security Conference is coming to Shanghai! BlueHat Shanghai 2019 will take place on May 29-30 at W Shanghai - The Bund. We want to provide a venue for security researchers to come...

More Alleged SIM Swappers Face Justice

Prosecutors in Northern California have charged two men with using unauthorized SIM swaps to steal and extort money from victims. One of the individuals charged allegedly used a hacker nickname belonging to a key figure in the underground who's built a solid reputation hijacking mobile phone...

CVE-2018-20345

Incorrect access control in StackStorm API st2api in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker who has a StackStorm account and is authenticated against the StackStorm API to retrieve datastore items for other users by utilizing the /v1/keys "?scope=all" and "?user=" que...

Improper access control

Incorrect access control in StackStorm API st2api in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker who has a StackStorm account and is authenticated against the StackStorm API to retrieve datastore items for other users by utilizing the /v1/keys "?scope=all" and "?user=" que...

CVE-2018-20345

Incorrect access control in StackStorm API st2api in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker who has a StackStorm account and is authenticated against the StackStorm API to retrieve datastore items for other users by utilizing the /v1/keys "?scope=all" and "?user=" que...

CVE-2018-20345

Incorrect access control in StackStorm API st2api in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker who has a StackStorm account and is authenticated against the StackStorm API to retrieve datastore items for other users by utilizing the /v1/keys "?scope=all" and "?user=" que...

CVE-2018-20345: Undefined Security Weakness

Incorrect access control in StackStorm API st2api in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker who has a StackStorm account and is authenticated against the StackStorm API to retrieve datastore items for other users by utilizing the /v1/keys "?scope=all" and "?user= "...

Mozilla's 'Privacy Not Included' Gift Report Highlights Security Concerns

In its second annual “Privacy Not Included” guide, the nonprofit highlights internet-connected items that value your privacy—and the ones that may not...

FUEL CMS SQL Injection Vulnerability

FUEL CMS is a content management system based on CodeIgniter. FUEL CMS 1.4.1 suffers from a SQL injection vulnerability that can be exploited by an attacker via the layout, published or searchterm parameters of pages/items...

CVE-2018-16762

FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or searchterm parameter to pages/items...

CVE-2018-16762: Improper Neutralization of Special Elements used in an SQL Command

FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or searchterm parameter to pages/items...