VulnCheck KEV: CVE-2017-3198

GIGABYTE BRIX UEFI firmware does not cryptographically validate images prior to updating the system firmware. Additionally, the firmware updates are served over HTTP. An attacker can make arbitrary modifications to firmware images without being detected...

Default credentials

Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perform other user account modifications via unspecified vectors...

Joomla! -- multiple vulnerabilities

The JSST and the Joomla! Security Center report: 20161001 - Core - Account Creation Inadequate checks allows for users to register on a site when registration has been disabled. 20161002 - Core - Elevated Privilege Incorrect use of unfiltered data allows for users to register on a site with...

Inteno EG101R1 VoIP Router - unauthorized modifications to DNS

No description provided by source. if $ -gt 3 || $ -lt 2 ; then echo " Inteno EG101R1 VoIP Router " echo " Unauthenticated Remote DNS Change Exploit" echo " ===================================================================" echo " Usage: $0 " echo " Example: $0 133.7.133.7 8.8.8.8" echo "...

Open-Xchange App Suite 7.8.2 Cross Site Scripting

Product: OX App Suite Vendor: OX Software GmbH Internal reference: 46484 Bug ID Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.8.2 and earlier Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.6.2-rev46, 7.6.3-rev1...

Security Misconfiguration Vulnerability

There's an improper default directory umask that can potentially allow unauthorized modifications of PHP code...

IDS IPS Testing Framework: pytbull

pytbull is an Intrusion Detection/Prevention System IDS/IPS Testing Framework for Snort, Suricata and any IDS/IPS that generates an alert file. It can be used to test the detection and blocking capabilities of an IDS/IPS, to compare IDS/IPS, to compare configuration modifications and to...

CVE-2016-3984

The McAfee VirusScan Console mcconsol.exe in McAfee Active Response MAR before 1.1.0.161, Agent MA 5.x before 5.0.2 Hotfix 1110392 5.0.2.333, Data Exchange Layer 2.x DXL before 2.0.1.140.1, Data Loss Prevention Endpoint DLPe 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control MDC 9.3...

CVE-2016-0888

EMC Documentum D2 before 4.6 lacks intended ACLs for configuration objects, which allows remote authenticated users to modify objects via unspecified vectors...

Oracle Application Testing Suite ReportImage tempfilename Directory Traversal (CVE-2016-0489)

A directory traversal vulnerability exists in Oracle's Application Testing Suite. The vulnerability is due to insufficient input validation in the Oracle Test Manager component while processing the HTTP request parameter tempfilename. A remote, authenticated attacker could exploit this...

SA113 : January 2016 NTP Security Vulnerabilities

SUMMARY Blue Coat products using affected versions of the NTP software distribution from ntp.org are susceptible to multiple vulnerabilities. A remote attacker may exploit these vulnerabilities to set the victim's system time to an arbitrary value or cause it to become out of sync. The attacker c...

Code injection

IBM WebSphere Portal 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 uses weak permissions for content items, which allows remote authenticated users to make modifications via the authoring UI...

CVE-2015-7455

CVE-2015-7455 affects IBM WebSphere Portal versions 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09. The vulnerability is described as weak permissions on content items, enabling remote authenticated users to modify content via the authoring UI. Connected source...

SOL21230183 - NTP vulnerability CVE-2015-7976

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Microsoft Internet Explorer Mutation Observer Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how...

CF Image Host 1.65 - Cross-Site Request Forgery

input type="text"...

CVE-2015-5499

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...

Security Misconfiguration Vulnerability in the AWS SDK for PHP

SECURITY FIX: This release addresses a security issue associated with CVE-2015-5723, specifically, fixes improper default directory umask behavior that could potentially allow unauthorized modifications of PHP code. Thanks to @ryan-lane for the initial report. - Aws\Ec2 - Added support for...

Important: 389-ds-base

Issue Overview: A flaw was found in the authorization of modrdn operations. An unauthenticated attacker able to issue an ldapmodrdn call to the directory server could use this flaw to perform unauthorized modifications of entries in the directory server. Affected Packages: 389-ds-base Issue...

MGASA-2015-0183 Updated 389-ds-base packages fix CVE-2015-1854

Updated 389-ds-base packages fix security vulnerability: A flaw was found in the way Red Hat Directory Server performed authorization of modrdn operations. An unauthenticated attacker able to issue an ldapmodrdn call to the directory server could use this flaw to perform unauthorized modification...