CVE-2017-2611

Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes SECURITY-389. The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes that a...

CVE-2017-5599

An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a reflected Cross Site Scripting vulnerability which affects the raceMasterList.jsp page within the Patient Portal. Inserted payload is rendered within the Patient Portal and the raceMasterList.jsp page does not requir...

New Relic: Restricted User can view multiple account details including customer_root_account_id, payment method, date of first payment, etc.

Summary When a restricted user visits this URL: There is a request sent to this URL: https://www.staging-bam.nr-data.net. Within that request leaks the following information about the entire account, that the restricted user can view:...

Insecure NAS Device Exposes 350 Ameriprise Investment Accounts

A trove of data belonging to Ameriprise Financial was found earlier this month that included Social Security numbers, decryption keys and confidential internal company documents. The breach is related to the use of a network attacked storage device that insecurely backed up data from an internal...

WordPress Quiz And Survey Master 4.7.8 / 4.5.4 XSS / CSRF Vulnerabilities

WordPress Quiz and Survey Master versions 4.5.4 and 4.7.8 suffer from cross site request forgery and cross site scripting vulnerabilities. Details ================ Software: Quiz And Survey Master Formerly Quiz Master Next Version: 4.5.4,4.7.8 Homepage:...

WordPress Plugin Quiz And Survey Master 4.5.44.7.8 - Cross-Site Request Forgery

WordPress Plugin Quiz And Survey Master 4.5.44.7.8 - Cross-Site Request Forgery alert1” in the questionname field then “question: ‘alert1’,” will get output inside the JS object. All good so far. However, in js/adminquestion.js on line 205, we see this line, as part of some JS-generated HTML:...

WordPress Quiz And Survey Master 4.7.8 / 4.5.4 XSS / CSRF

Details ================ Software: Quiz And Survey Master Formerly Quiz Master Next Version: 4.5.4,4.7.8 Homepage: https://wordpress.org/plugins/quiz-master-next/ Advisory report:...

WordPress Quiz And Survey Master Plugin <= 4.7.8 - Multiple Vulnerabilities

This plugin is prone to a stored cross site scripting and cross site request forgery vulnerabilities. Solution Update the plugin...

TTL Master - Possible privilege escalation, Runtime command execution, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application TTL Master published at the 'play' market has multiple vulnerabilities...

PT-2021-5604 · Saltstack +2 · Saltstack Salt +2

Name of the Vulnerable Software and Affected Versions: SaltStack Salt versions prior to 3002.5 Description: The issue is related to errors in processing authentication requests for expired eauth tokens. This could allow a remote attacker to execute arbitrary commands, potentially against the salt...

CentOS 6 : 389-ds-base (CESA-2016:2765)

"An update for 389-ds-base is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Chess Master King - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Chess Master King published at the 'play' market has multiple vulnerabilities...

CentOS Update for 389-ds-base CESA-2016:2765 centos6

Check for the Version of 389-ds-base SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882594";...

389 security update

CentOS Errata and Security Advisory CESA-2016:2765 An update for 389-ds-base is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Buffer overflow vulnerability in CFM function in multiple Huawei products

CloudEngine 5800, CloudEngine 6800, CloudEngine 7800, CloudEngine 8800, CloudEngine 12800 are Huawei switch devices. A buffer overflow vulnerability exists in the CFM Connectivity Fault Management feature in multiple Huawei products. When the device uses CFM and is configured with MEP Maintenance...

RHEL 6 : 389-ds-base (RHSA-2016:2765)

"An update for 389-ds-base is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Moderate: Red Hat Security Advisory: 389-ds-base security, bug fix, and enhancement update

An update for 389-ds-base is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

CrySis Ransomware Master Decryption Keys Released

The threat posed by a ransomware family known as CrySis was diminished considerably on Sunday when the master decryption keys were released to the public. Researchers at Kaspersky Lab said they have already folded the keys into the company’s Rakhni decryptor and victims of CrySis versions 2 and 3...

Microsoft SQL Server Master Data Services Cross-Site Scripting Vulnerability

Microsoft SQL Server is the United States Microsoft Microsoft company develops and maintains a set of applications in the Microsoft Windows system under the large commercial database system. A cross-site scripting vulnerability exists in Microsoft SQL Server Master Data Services. The vulnerabilit...

util-linux: Extended partition loop in MBR partition table leads to DOS

It was found that util-linux's libblkid library did not properly handle Extended Boot Record EBR partitions when reading MS-DOS partition tables. An attacker with physical USB access to a protected machine could insert a storage device with a specially crafted partition table that could, for...