6366 matches found
Reflected Cross-site Scripting (XSS)
Keycloak services is vulnerable to reflected cross-site scripting XSS attacks. These attacks are possible because keycloak would accept a HOST header URL within the admin console when determining the web resource location...
CVE-2017-12158
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server...
Linux Kernel 4.14.0-rc4+ - 'waitid()' Privilege Escalation(CVE-2017-5123)
This is a guest post by a young and talented Portuguese exploiter, Federico Bento. He won this year’s Pwnie for Epic Achievement exploiting TIOCSTI ioctl. Days ago he posted a video demonstrating an exploit for CVE-2017-5123 and luckly for you I managed to convince him to do a write-up about it. ...
CVE-2017-7148
An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Location Framework" component. It allows attackers to obtain sensitive location information via a crafted app that reads the location variable...
CVE-2017-7145
An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Time" component. The "Setting Time Zone" feature mishandles the possibility of using location data...
CVE-2017-7145
An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Time" component. The "Setting Time Zone" feature mishandles the possibility of using location data...
CVE-2017-7148
An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Location Framework" component. It allows attackers to obtain sensitive location information via a crafted app that reads the location variable...
Code injection
An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Time" component. The "Setting Time Zone" feature mishandles the possibility of using location data...
Design/Logic Flaw
An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Location Framework" component. It allows attackers to obtain sensitive location information via a crafted app that reads the location variable...
CVE-2017-7148
CVE-2017-7148 affects the Location Framework in iOS 11-era devices, describing a permissions issue that could allow an app to read sensitive location information via a crafted app reading the location variable. The connected Apple entry notes the vulnerability as addressed by additional ownership...
CVE-2017-7148
An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Location Framework" component. It allows attackers to obtain sensitive location information via a crafted app that reads the location variable...
CVE-2017-7145
An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Time" component. The "Setting Time Zone" feature mishandles the possibility of using location data...
CVE-2017-7145
CVE-2017-7145 affects iOS before 11 in the Time component, specifically the Time Zone setting that may misuse location data. The Apple security content entry notes a permissions issue in the time zone handling process, addressed by modifying permissions. Connected references corroborate the issue...
Apple iOS Location Framework Information Disclosure Vulnerability
Apple iOS is an operating system developed by Apple for mobile devices. Location is one of the frameworks used to determine a user's location. An information disclosure vulnerability exists in the Location Framework component in versions of Apple iOS prior to 11. The vulnerability can be exploite...
Apple iOS Time has an unspecified vulnerability
Apple iOS is an operating system developed by Apple Inc. for mobile devices.Time component is one of the time components. A security vulnerability exists in the Time component of Apple iOS prior to version 11, which arises from the possibility that the program fails to properly handle the use of...
Apache Solr 7.0.1 - XML External Entity Expansion / Remote Code Execution(CVE-2017-12629)
First Vulnerability: XML External Entity Expansion deftype=xmlparser Lucene includes a query parser that is able to create the full-spectrum of Lucene queries, using an XML data structure. Starting from version 5.1 Solr supports "xml" query parser in the search query. The problem is that lucene x...
Hackers can hack your kid’s smartwatch and track their location
By Carolina With smartwatches designed especially for kids being available now, parents This is a post from HackRead.com Read the original post: Hackers can hack your kids smartwatch and track their location...
SmoothCriminal Update: Additional Sandbox Detection Methods
PenTestIT RSS Feed About three months ago, I had written about a tool which helps you detect sandboxes using cursor movements. I was extremely busy, by the author of this tool - @G4lB1t was king enough to bring to my notice that it was about a SmoothCriminal update. This update brings in addition...
How to Backup The Veeam ONE SQL Database
Purpose This article documents methods to back up the Veeam ONE SQL database. This is useful when you have to do a backup before an upgrade or if you have been asked to provide a backup of Veeam ONE database to Veeam Support for further in-depth analysis. Solution Identify the Location of the Vee...