Master Slider <= 3.7.0 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not properly sanitise the slider name when creating or editing a slider, leading to an Authenticated editor+ Stored Cross-Site Scripting issue which will be triggered in the Slider table /wp-admin/admin.php?page=master-slider. Edit WPScanTeam: - The original report was from 2018,...

Master Slider <= 3.7.0 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not properly sanitise the slider name when creating or editing a slider, leading to an Authenticated editor+ Stored Cross-Site Scripting issue which will be triggered in the Slider table /wp-admin/admin.php?page=master-slider. Edit WPScanTeam: - The original report was from 2018,...

WP Master Slider v3.5.1 - Cross Site Scripting Vulnerability

Document Title: =============== WP Master Slider v3.5.1 - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2158 Reference: https://wordpress.org/support/?posttype=topic&p=10874555...

Redis Replication Code Execution

This module can be used to leverage the extension functionality added since Redis 4.0.0 to execute arbitrary code. To transmit the given extension it makes use of the feature of Redis which called replication between master and slave. Module Options msf use...

atomic-openshift: oc patch with json causes masterapi service crash

An out of bounds write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform 3.x. An attacker can use this flaw to cause a denial of service attack on the Openshift master API service which provides cluster management...

GHSA-W4R4-65MG-45X2 org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs vi...

EulerOS 2.0 SP3 : firefox (EulerOS-SA-2018-1367)

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Mozilla: Crash in TransportSecurityInfo due to cached data CVE-2018-12385 - Mozilla: Setting a master password post-Firefox 58 does not delete...

Scannerl - The Modular Distributed Fingerprinting Engine

Scannerl is a modular distributed fingerprinting engine implemented by Kudelski Security. Scannerl can fingerprint thousands of targets on a single host, but can just as easily be distributed across multiple hosts. Scannerl is to fingerprinting what zmap is to port scanning. Scannerl works on...

EulerOS 2.0 SP2 : firefox (EulerOS-SA-2018-1359)

According to the versions of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 CVE-2018-12376 - Mozilla: Use-after-free in driver timers CVE-2018-12377 -...

RHEL 7 : thunderbird (RHSA-2018:3458)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:3458 advisory. - Mozilla: Proxy bypass using automount and autofs CVE-2017-16541 - Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2...

Mozilla: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is...

IBM InfoSphere Master Data Management Collaborative Edition Information Disclosure Vulnerability

IBM InfoSphere Master Data Management MDM is an IBM solution for helping organizations manage enterprise-wide master data information about customers, suppliers, products, and accounts. The solution supports the centralization of multiple data domains through three master data usage styles:...

RHEL 6 : thunderbird (RHSA-2018:3403)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:3403 advisory. - Mozilla: Proxy bypass using automount and autofs CVE-2017-16541 - Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2...

Mozilla: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Design/Logic Flaw

IBM InfoSphere Master Data Management Collaboration Server 11.4, 11.5, and 11.6 could allow an authenticated user with CA level access to change change their ca-id to another users and read sensitive information. IBM X-Force ID: 138077...

CVE-2018-1380

IBM InfoSphere Master Data Management Collaboration Server 11.4, 11.5, and 11.6 could allow an authenticated user with CA level access to change change their ca-id to another users and read sensitive information. IBM X-Force ID: 138077...

Open Faculty Evaluation System 5.6 - batch_name SQL Injection

Open Faculty Evaluation System 5.6 - batchname SQL Injection Exploit Title: Open Faculty Evaluation System 5.6 - 'batchname' SQL Injection Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://openfacultyeval.sourceforge.io/ Software Link:...

CVE-2017-18311

XPU Master privilege escalation is possible due to improper access control of unused configuration xPU ports where unused configuration ports are open in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU...

CVE-2017-18311

CVE-2017-18311 concerns a privilege-escalation flaw in the XPU Master caused by improper access control of unused xPU ports that remain open. Affected products span Snapdragon Automotive, Mobile, and Wear lines (listed chipsets such as MDM9607/9635M/9640/9645/9650/9655, MSM89xx/SD-series includin...