Sparkasse (Bank) - Service Security Advisory WB021 2016

Document Title: =============== Sparkasse Bank - Service Security Advisory WB021 2016 References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1959 Download PDF: https://www.vulnerability-lab.com/resources/documents/spk-sec-WB021.pdf Vulnerability Magazine:...

RealEstate CMS 3.00.50 Cross Site Scripting

i?Document Title: =============== RealEstate CMS 3.00.50 - Cross Site Web Vulnerability Release Date: ============= 2016-09-08 Vulnerability Disclosure Timeline: ================================== 2016-09-23 : Public Disclosure Product & Service Introduction: ===============================...

PHPHolidays CMS 3.00.50 Cross Site Scripting

Document Title: =============== PHPHolidays CMS v3.00.50 - Cross Site Scripting Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1948 Release Date: ============= 2016-09-08 Vulnerability Laboratory ID VL-ID:...

USN-3048-1 curl vulnerability | Cloud Foundry

USN-3048-1 curl vulnerability Medium Vendor Canonical Ubuntu, curl Versions Affected Canonical Ubuntu 14.04 LTS Description Bru Rom discovered that curl incorrectly handled client certificates when resuming a TLS session. CVE-2016-5419 It was discovered that curl incorrectly handled client...

phpCollab CMS 2.5 Cross Site Request Forgery

Document Title: =============== phpCollab v2.5 CMS - Privilege Escalate CSRF Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1911 Release Date: ============= 2016-08-17 Vulnerability Laboratory ID VL-ID: ====================================...

nopCommerce 3.70 Cross Site Scripting

Security Advisory CVE-ID: N/A Topic: Reflected Cross Site Scripting XSS Vulnerability in "successful registration" page Class: Input Validation Severity: Medium Discovery: 2016-04-28 Vendor Notification: 2016-04-28 Vendor response: 2016-05-30 Vendor Patch: 2016-05-31 Public Announced: 2016-08-15...

Nagios Network Analyzer 2.2.1 - Multiple Cross-Site Request Forgery Vulnerabilities

Nagios Network Analyzer 2.2.1 - Multiple Cross-Site Request Forgery Vulnerabilities + Credits: John Page hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NAGIOS-NA-v2.2.1-MULTIPLE-CSRF.txt + ISR: ApparitionSec Vendor: =============== www.nagios.co...

Facebook User ID Bypass Issue

Document Title: =============== Facebook Bug Bounty 33 - Bypass ID user to linked Phone Number Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1896 Release Date: ============= 2016-08-08 Vulnerability Laboratory ID VL-ID:...

FortiCloud Cross Site Scripting

Document Title: =============== FortiCloud - Reports Summary Multiple Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1735 Release Date: ============= 2016-08-05 Vulnerability Laboratory ID VL-ID:...

WinSaber - Unquoted Service Path Privilege Escalation

Document Title: =============== WinSaber - Unquoted Service Path Privilege Escalation References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1879 Release Date: ============= 2016-07-29 Vulnerability Laboratory ID VL-ID: ==================================== 1879...

DornCMS v1.4 - (FileManager) Persistent XSS Vulnerability

Document Title: =============== DornCMS v1.4 - FileManager Persistent XSS Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1885 Release Date: ============= 2016-07-26 Vulnerability Laboratory ID VL-ID: ==================================== 18...

Exponent CMS 2.3.9 - Useraccounts Persistent Vulnerability

Document Title: =============== Exponent CMS 2.3.9 - Useraccounts Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1886 Release Date: ============= 2016-07-26 Vulnerability Laboratory ID VL-ID: ====================================...

DornCMS v1.4 - (FileManager) Persistent XSS Vulnerability

Document Title: =============== DornCMS v1.4 - FileManager Persistent XSS Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1885 Release Date: ============= 2016-07-25 Vulnerability Laboratory ID VL-ID: ==================================== 18...

S3 Boot Script Protection

Lenovo Security Advisory: LEN-2014-006 Potential Impact: Elevation of Privilege Severity: Medium Summary: Certain firmware implementations may not correctly protect memory that stores the BIOS S3 Boot Script when a system is suspended. Exploitation of such vulnerabilities could potentially lead t...

Unauthorized Modification of UEFI Variables in UEFI Systems

Lenovo Security Advisory: LEN-2014-002 Potential Impact: Modifications of UEFI variables Severity: Medium Summary: Certain firmware implementations may not correctly protect and validate information contained in certain UEFI variables. Exploitation of such vulnerabilities could potentially lead t...

Intel BIOS locking mechanism contains race condition that enables write protection bypass

Lenovo Security Advisory: LEN-2015-001 Potential Impact: Denial of Service, Elevation of Privilege Severity: Medium Summary: A race condition exists in computers using Intel chipsets that rely solely on two particular BIOS write locking mechanisms. Successful exploitation of this race condition m...

UEFI EDK2 Capsule Update Vulnerabilities

Lenovo Security Advisory: LEN-2014-001 Potential Impact: Execution of arbitrary code Severity: Medium Summary: The EDK2 UEFI reference implementation contains multiple vulnerabilities in the Capsule Update mechanism. Description: The open source EDK2 project provides a reference implementation of...

SMM "Incursion" Attack

Lenovo Security Advisory: LEN-2015-002 Potential Impact: Execute arbitrary code, Bypass Secure Boot, Denial of Service, Escalation of Privilege Severity: Medium Summary: Some BIOS implementations permit unsafe System Management Mode SMM function calls to memory locations outside of System...

SQL Injection in TYPO3 Frontend Login

It has been discovered, that TYPO3 is susceptible to SQL Injection. Component Type: TYPO3 CMS Release Date: July 19, 2016 Vulnerable subcomponent: Frontend Login Vulnerability Type: SQL Injection Affected Versions: Versions 6.2.0 to 6.2.25 and 7.6.0 to 7.6.9 Severity: Medium Suggested CVSS v2.0:...

Insecure Unserialize in TYPO3 Import/Export

It has been discovered, that TYPO3 is susceptible to Insecure Unserialize. Component Type: TYPO3 CMS Release Date: July 19, 2016 Vulnerable subcomponent: Import/Export Vulnerability Type: Insecure Unserialize Affected Versions: Versions 6.2.0 to 6.2.25, 7.6.0 to 7.6.9 and 8.0.0 to 8.2.0 Severity:...