ThinkPHP 3.X/5.X order by injection vulnerability

ThinkPHP is a lightweight PHP development framework. A security vulnerability exists in ThinkPHP. The vulnerability is due to ThinkPHP in the processing of order by sorting, when the sorting parameters are controllable and associated arrays key-value, the framework does not make security filterin...

CVE-2017-15423

Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512password by inspecting protocol traffic...

Mozilla Firefox < 57.0.4 Multiple Vulnerabilities

Binary data 700325.prm...

DEBIAN-CVE-2018-15470

An issue was discovered in Xen through 4.11.x. The logic in oxenstored for handling writes depended on the order of evaluation of expressions making up a tuple. As indicated in section 7.7.3 "Operations on data structures" of the OCaml manual, the order of evaluation of subexpressions is not...

alaedintravel.ir XSS vulnerability

Open Bug Bounty ID: OBB-665641 Description| Value ---|--- Affected Website:| alaedintravel.ir Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

The vulnerability of the Product Diagnostic Tools component of the Order Management system allows a perpetrator to gain full control over the application.

The vulnerability of the Product Diagnostic Tools component in the Order Management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain full control over the application...

Order Override Vulnerability in Rice CMS

DAMI CMS is an all-in-one system for pc and mobile site building. Rice CMS v6.0.0 suffers from an order override vulnerability, which can be exploited by an attacker to grab order packets and change prices in an order to purchase a company product...

openSUSE Security Update : libgcrypt (openSUSE-2018-795)

This update for libgcrypt fixes the following issues : The following security vulnerability was addressed : - CVE-2018-0495: Mitigate a novel side-channel attack by enabling blinding for ECDSA signatures bsc1097410. The following other issues were fixed : - Extended the fipsdrv dsa-sign and...

SUSE SLED12 / SLES12 Security Update : libgcrypt (SUSE-SU-2018:2089-1)

This update for libgcrypt fixes the following issues: The following security vulnerability was addressed : - CVE-2018-0495: Mitigate a novel side-channel attack by enabling blinding for ECDSA signatures bsc1097410. The following other issues were fixed : - Extended the fipsdrv dsa-sign and...

waveneyrush.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-651394 Description| Value ---|--- Affected Website:| waveneyrush.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

paperwritingonline.com XSS vulnerability

Open Bug Bounty ID: OBB-651386 Description| Value ---|--- Affected Website:| paperwritingonline.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Oracle E-Business Multiple Vulnerabilities (July 2018 CPU)

The version of Oracle E-Business installed on the remote host is missing the July 2018 Oracle Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities as noted in the July 2018 Critical Patch Update advisory : - An unspecified vulnerability in the Oracle One-to-One...

CVE-2018-2954

Vulnerability in the Oracle Order Management component of Oracle E-Business Suite subcomponent: Product Diagnostic Tools. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Difficult to exploit vulnerability allows low privileged attacker...

CVE-2018-2954

Vulnerability in the Oracle Order Management component of Oracle E-Business Suite subcomponent: Product Diagnostic Tools. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Difficult to exploit vulnerability allows low privileged attacker...

CVE-2018-2954

Vulnerability in the Oracle Order Management component of Oracle E-Business Suite subcomponent: Product Diagnostic Tools. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Difficult to exploit vulnerability allows low privileged attacker...

CVE-2018-2954

CVE-2018-2954 affects Oracle E-Business Suite Order Management, specifically the Product Diagnostic Tools subcomponent. The vulnerability impacts multiple supported 12.1.x and 12.2.x versions; it is exploitable by a low-privileged user with login to the hosting infrastructure and can lead to take...

CVE-2018-2954

Vulnerability in the Oracle Order Management component of Oracle E-Business Suite subcomponent: Product Diagnostic Tools. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Difficult to exploit vulnerability allows low privileged attacker...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2018-24110)

Oracle E-Business Suite is based on the original Application ERP expansion, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management, and so on a variety of management software collection, is a seamless integration of a management suite. An...

LogonTracer - Investigate Malicious Windows Logon By Visualizing And Analyzing Windows Event Log

Investigate malicious logon by visualizing and analyzing Windows active directory event logs. Concept LogonTracer associates a host name or an IP address and account name found in logon-related events and displays it as a graph. This way, it is possible to see in which account login attempt occur...

CVE-2018-0384

A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a URL-based access control policy that is configured to block traffic for an affected system. The vulnerability exists because the affected software incorrectly...