306 matches found
CVE-2020-13998
Citrix XenApp 6.5, when 2FA is enabled, allows a remote unauthenticated attacker to ascertain whether a user exists on the server, because the 2FA error page only occurs after a valid username is entered. NOTE: This vulnerability only affects products that are no longer supported by the maintaine...
CVE-2019-17221
PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HT...
CVE-2019-17221
Removed by vendor...
CVE-2019-6177
A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to non-standard locations, potentially leading to privilege escalation. Lenovo ended support for Lenovo Solution Center and recommended that customers migrate to...
Exploit for Path Traversal in Atutor
ATutor 2.2.4 Arbitrary File Upload / RCE CVE-2019-12169 - E...
Denial Of Service (DoS) CPU Consumption
mingw32-libxml2 is vulnerable to denial of service. The attack exists because it uses predictable hashing function causing intentional collisions and does not prevent the attacker inputing a malicious message to an XML service, resulting in longer processing time, which could lead to a denial of...
WordPress YellowPencil Visual CSS Style Editor plugin <= 7.2.0 - Unauthenticated arbitrary Options update vulnerability
Unauthenticated arbitrary Options update vulnerability found in WordPress YellowPencil Visual CSS Style Editor plugin versions = 7.2.0. Solution 12 April 2019 - this plugin was closed and is no longer available for download...
API server used by JR East Japan train operation information push notification App for Android fails to restrict access permissions
Overview JR East Japan train operation information push notification App for Android provided by East Japan Railway Company fails to restrict access permissions CWE-284. The application is no longer available/supported, and its service was ended in 2019 march 23. Tomoya Takahashi of TCU...
Multiple vulnerabilities in YukiWiki
Overview YukiWiki is a Wiki engine. YukiWiki contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2018-0699 Processing a particular request consumes large amounts of CPU and memory resources CWE-400 - CVE-2018-0700 Tanaka Akira of National Institute of Advanced...
DEBIAN-CVE-2017-5472
A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node in the tree that no longer exists. This results in a potentially exploitable crash. This vulnerability affects Firefox 54, Firefox ESR 52.2, and Thunderbird...
How to mitigate rapid cyberattacks such as Petya and WannaCrypt
In the first blog post of this 3-part series, we introduced what rapid cyberattacks are and illustrated how rapid cyberattacks are different in terms of execution and outcome. In the second blog post, we provided some details on Petya and how it worked. In this final blog post, we will share:...
[SECURITY] [DLA 1263-1] debian-security-support update
Package : debian-security-support Version : 2018.01.29deb7u1 This update marks several packages as no longer supported by wheezy-lts: teamspeak-server, teamspeak-client, libstruts1.2-java, nvidia-graphics-drivers, glassfish, jbossas4, libnet-ping-external-perl, mp3gain, tor, jasperreports. For th...
PWR-Q200 vulnerable to DNS cache poisoning attacks
Overview PWR-Q200 provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION is a mobile WiFi router. PWR-Q200 is vulnerable to DNS cache poisoning attacks as DNS queries are done with a fixed source port CWE-330. Toshifumi Sakaguchi reported this vulnerability to IPA. JPCERT/CC coordinated with...
Lotus CC:Mail Installed (EASYPI)
Lotus CC:Mail, an unsupported and vulnerable mail application, is installed on the remote host. It is, therefore, affected by a vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code. EASYPI is one of multiple Equation Group vulnerabilities and exploits disclosed ...
Fedora 25 : php-pear-CAS (2017-2a90185a04)
Changes in version 1.3.5 - Security Fixes : - Fix possible authentication bypass in validateCAS20 228 Gregory Boddin - Bug Fixes : - Fix file permissions non-executable 177 Remi Collet - Fixed translations Greek and Japanese 192 ikari7789 - Fix errors under phpdbg 204 MasonM - Fix logout...
Olive Diary DX vulnerable to cross-site scripting
Overview Olive Diary DX provided by Olive Design contains a cross-site scripting vulnerability CWE-79 due to a flaw in processing the page parameter. Impact An artbitrary script may be executed on the user's web browser. Solution Do not use Olive Diary DX Olive Diary DX is no longer being develop...
WEB SCHEDULE vulnerable to cross-site scripting
Overview WEB SCHEDULE provided by Olive Design contains a cross-site scripting vulnerability CWE-79 due to a flaw in processing the month parameter. Impact An artbitrary script may be executed on the user's web browser. Solution Do not use WEB SCHEDULE WEB SCHEDULE is no longer being developed or...
Simple keitai chat vulnerable to cross-site scripting
Overview Simple keitai chat provided by LEMON-S PHP contains reflected and stored cross-site scripting vulnerabilities CWE-79. Yuji Tounai of NTT Communications Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...
dance.nyc XSS vulnerability
Vulnerable URL: https://www.dance.nyc/search/?dir=%3C/script%3E%3Cscript%3Ealert'OPENBUGBOUNTY';%3C/script%3E%3Cscript%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 759468 VIP...
