Hardcoded credentials

Teradata Viewpoint before 14.0 and 16.20.00.02-b80 contains a hardcoded password of TDv1i2e3w4 for the viewpoint database account in viewpoint-portal\conf\server.xml that could potentially be exploited by malicious users to compromise the affected system...

KLA12056 XSS vulnerability in Cisco Jabber

A cross-site scripting XSS vulnerability was found in Cisco Jabber. Malicious users can exploit this vulnerability to perform cross-site scripting attack. Original advisories Cisco Jabber Client Framework Instant Message Cross-Site Scripting Vulnerability Related products Cisco-Jabber CVE list...

XSS vulnerability with unsafe link protocols

An XSS vulnerability CVE-2018-20583 has been identified in the following versions of this library: 0.15.6 0.15.7 0.16.0 0.17.0 0.17.1 0.17.2 0.17.3 0.17.4 0.17.5 0.18.0 It allows unsafe URLs to be added to links. The issue has been fixed in version 0.18.1. All users should upgrade to version 0.18...

KLA11897 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Diagnostics Hub...

KLA11887 XSS vulnerability in Microsoft Azure

A cross-site-scripting XSS vulnerability was found in in MIcrosoft Azure. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2018-8600 Related products Microsoft-Azure CVE list CVE-2018-8600 high KB list Solution Install necessary updates from the KB...

KLA11344 ACE vulnerability in Yammer Desktop App

A remote code execution vulnerability was found in Yammer Desktop Application. Malicious users can exploit this vulnerability remotely via specially crafted website to execute arbitrary code. Original advisories CVE-2018-8569 Related products Yammer-Desktop-App CVE list CVE-2018-8569 high KB list...

GHSA-49H4-G8P5-JGQ6 Moderate severity vulnerability that affects org.apache.juddi:juddi-client

After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to redirect the browser to an unintended web page in Apache jUDDI 3.1.2, 3.1.3, 3.1.4, and 3.1.5 when utilizing the portlets based user interface also known as...

KLA11339 Multiple vulnerabilities in Oracle Virtual Box

Multiple serious vulnerabilities were found in Oracle VM Virtual Box. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service. Below is a complete list of vulnerabilities: 1. Vulnerability in the Oracle VM VirtualBox component of Oracle...

KLA11337 Multiple DoS vulnerabilities in Wireshark

Multiple serious vulnerabilities were found in Wireshark. Malicious users can exploit these vulnerabilities to cause denial of service. Below is a complete list of vulnerabilities: 1. An unspecified vulnerability in the MS-WSP dissector can be exploited remotely via malformed packet trace file to...

KLA11797 Security vulnerability in Zoom

Security vulnerability was found in Zoom. Malicious users can exploit this vulnerability to obtain sensitive information, bypass security restrictions, spoof user interface. Original advisories Zoom Security CVE-2018-15715 CVE-2018-15715 Exploitation Malware exists for this vulnerability. Usually...

KLA11327 SB vulnerability in Apache Tomcat

A vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability via specially crafted URI to bypass security restrictions. Original advisories Apache Tomcat 7.x vulnerabilities Apache Tomcat 8.x vulnerabilities Apache Tomcat 9.x vulnerabilities Related products...

SQL Injection

phpMyFAQ/phpMyFAQ is vulnerable to SQL Injections. The library does not properly escape parameters in the SQL query executed by the restore function, allowing malicious users to inject and execute arbitrary SQL queries...

KLA11305 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Diagnostic Hub Standard Collector can be...

KLA11361 OSI vulnerability in Teamviewer

Unspecified vulnerability was found in Teamviewer. Malicious users can exploit this vulnerability via leveraging an unattended workstation on which TeamViewer has disconnected but remains running to obtain sensitive information. Original advisories Reaction to CVE-2018-143333 Related products...

CVE-2016-9485

On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality of the agent. The typical configuration is for the agent to run as a Windows service under the local SYSTEM account. The SecureConnector...

KLA12551 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Security Update. Malicious users can exploit these vulnerabilities to obtain sensitive information, cause denial of service, bypass security restrictions, gain privileges, spoof user interface, execute arbitrary code. Below is a...

KLA12552 RCE vulnerability in Microsoft Device

Remove code execution vulnerability was found in Microsoft Wireless Display Adapter. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2018-8306 CVE list CVE-2018-8306 high Solution Install necessary updates from the KB section, that are listed in...

KLA11277 Multiple vulnerabilities in VMware products

Multiple out-of-bounds read vulnerabilities have been found in VMware Workstation and Fusion. Malicious users can exploit these vulnerabilities to obtain sensitive information or gain privileges. Original advisories VMSA-2018-0016 Related products VMware-Workstation VMware-Fusion CVE list...

Security Bulletin: IBM MQ Appliance potential access to queue manager private keys (CVE-2015-1985)

Summary There is potential for malicious users to access IBM MQ Appliance queue manager private keys without requiring knowledge of the password. Vulnerability Details CVEID: CVE-2015-1985 DESCRIPTION: IBM MQ Appliance M2000 could allow a malicious user with read authority to copied key repositor...

Hardcoded credentials

The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending...