PT-2018-5175

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.73.1 and earlier, 2.83 and earlier Description The issue allows users with permission to create or configure agents in Jenkins to run arbitrary shell commands on the master node. This is possible through the 'Launch agent vi...

CVE-2017-17535

lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17525

guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17511

KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to prefs.c and worldgui.c...

CVE-2017-17551

The Backup and Restore feature in Mobotap Dolphin Browser for Android 12.0.2 suffers from an arbitrary file write vulnerability when attempting to restore browser settings from a malicious Dolphin Browser backup file. This arbitrary file write vulnerability allows an attacker to overwrite a...

IRCCloud: [IRCCloud Android] XSS in ImageViewerActivity

Hi, I'd like to report HTML/JS injection in activity com.irccloud.android.activity.ImageViewerActivity which is exported: xml so can be launched by arbitrary apps installed on the same device. On the newest Androids could be exploited also by Android Instant Apps directly from a web-browser...

FS Car Rental Script - pickup_location SQL Injection

FS Car Rental Script - pickuplocation SQL Injection Exploit Title: FS Car Rental Script - SQL Injection Date: 2017-10-23 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/car-rental-script/ Version: 23 October 17 Tested on: Kali...

FS Lynda Clone - category SQL Injection

FS Lynda Clone - category SQL Injection Exploit Title: FS Lynda Clone - SQL Injection Date: 2017-10-23 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/lynda-clone/ Version: 23 October 17 Tested on: Kali Linux 2.0 | Mac OS...

CVE-2017-7972

A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 that allows the ability to escape out of remote PowerSCADA Anywhere applications and launch other processes...

WEM 4.4 -Transformer autologon is not launching the Agent at logon

WEM Transformer does not auto-launch after an end user logs onto a WEM Agent machine...

LaZagne v2.2 - Credentials Recovery Project

The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. Each software stores its passwords using different techniques plaintext, APIs, custom algorithms, databases, etc.. This tool has been developed for the purpose of finding these passwor...

"Unknown Client Error 1110" error when launching Desktop using Firefox

When launching adesktop, user might get an "Unknown Client Error 1110" error The error is appearing only when using the Firefox browser to connect to the gateway. If used with other browsers, desktop is launching properly. If the ICA file is saved to the disk prior to launch, the desktop...

Error: “Cannot start apps. Please run reset receiver to resolve a lockdown conflict for ClientHostedAppsShortcuts (error 2320)”

Users access a StoreURL and launch published IE from their Client machines. Then they use published IE and connect to another StoreURL from another farm to access another application. Majority but not all users get errors while launching the application. Error: “Cannot start apps. Please run Rese...

Game Crunch Doesn't Always Have to be a Thing

You've been dreading the conversation. You know there's no way out of it, given the timeline. Your execs have made it clear that the very large marketing spend is going to hit during the week when two of your engineers were planning to be on vacation. You've got a brilliant team that has helped y...

CVE-2017-10951

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

Cisco AnyConnect Secure Mobility Client Software Cross-Site Scripting Vulnerability

The Cisco AnyConnect Secure Mobility Client is Cisco's next-generation VPN client. Cisco AnyConnect Secure Mobility Client suffers from a cross-site scripting vulnerability in the WebLaunch feature, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code...

thepack.gamerlaunch.com XSS vulnerability

Vulnerable URL: https://thepack.gamerlaunch.com/recruiting/login.php?destination=INFOSEC.COM.BR"'- -! Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check...

Facebook Covertly Launches A Photo-Sharing App In China

The Chinese market is no doubt a pot of gold for big technology giants with over 700 million internet users, but the Chinese government heavily controls the Internet within its borders through its Golden Shield project – the Great Firewall of China. The Great Firewall has blocked some 171 out of...

CVE-2017-9799

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure...

CVE-2017-9799

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure...