Design/Logic Flaw

Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute any PHP file in the filesystem. This attack appear to be exploitable via Attacker must be have access to an admin account on the target site. This vulnerabili...

CVE-2018-1000504

CVE-2018-1000504 affects Redirection version 2.7.3 in Pass-through mode, exposing an ACE file-inclusion vulnerability that can allow an admin to execute arbitrary PHP files on the filesystem. The issue requires admin access to the target site and is reported as fixed in version 2.8. The connected...

CVE-2018-1000504

Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute any PHP file in the filesystem. This attack appear to be exploitable via Attacker must be have access to an admin account on the target site. This vulnerabili...

Fedora 27 : pass (2018-a3e631b454)

Update to new upstream release Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

Fedora Update for pass FEDORA-2018-a3e631b454

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for pass FEDORA-2018-a89844963c

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 28 Update: pass-1.7.2-1.fc28

Stores, retrieves, generates, and synchronizes passwords securely using gpg and git...

[SECURITY] Fedora 27 Update: pass-1.7.2-1.fc27

Stores, retrieves, generates, and synchronizes passwords securely using gpg and git...

[ASA-201806-11] pass: arbitrary code execution

Arch Linux Security Advisory ASA-201806-11 ========================================== Severity: High Date : 2018-06-19 CVE-ID : CVE-2018-12356 Package : pass Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-720 Summary ======= The package pass before version...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MQ Internet Pass Thru

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7.0.10.10 used by IBM MQ Internet Pass Thru. These issues were disclosed as part of the IBM Java SDK updates in January 2018. Vulnerability Details If you run your own Java code using the IBM Java Runtime deliver...

Security Bulletin: Vulnerability in SSLv3 affects IBM WebSphere MQ, IBM WebSphere MQ Internet Pass-Thru and IBM Mobile Messaging and M2M Client Pack (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled by default in IBM WebSphere MQ. Vulnerability Details CVE ID: CVE-2014-3566 DESCRIPTION: IBM WebSphere MQ could allow a remote attacker to obtain...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MQ Internet Pass Thru

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7.0.10.5 used by IBM MQ Internet Pass Thru. These issues were disclosed as part of the IBM Java SDK updates in July 2017. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered...

Security Bulletin: Non-configured connections could cause denial of service in IBM WebSphere MQ Internet Pass-Thru (CVE-2017-1118 )

Summary When using the MQIPT SecurityManager, IP addresses that are not configured in the MQIPT security policy file with the accept and resolve socket permissions, cause MQIPT to stop responding to connection attempts. Vulnerability Details CVEID: CVE-2017-1118 DESCRIPTION: IBM WebSphere MQ...

Security Bulletin: Vulnerability in IBM Java Runtime affects IBM WebSphere MQ Internet Pass-Thru (CVE-2015-7575)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 7 that is used by IBM MQ Internet Pass-Thru. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Patches for these are available in IB...

Security Bulletin: IBM WebSphere MQ Internet Pass-Thru is affected by multiple vulnerabilities in IBM SDK, Java™ Technology Edition, Version 7 (CVE-2014-4263, CVE-2014-4244, CVE-2014-3068)

Summary Multiple security vulnerabilities exist in the IBM Java Runtime Environment component of WebSphere MQIPT, a patch for these are available in IBM SDK, Java™ Technology Edition, Version 7 Service Refresh 7 Fix Pack 1 Vulnerability Details CVEID: CVE-2014-4263 DESCRIPTION: An unspecified...

SUSE SLES11 Security Update : libvirt (SUSE-SU-2018:1475-1) (Spectre)

This update for libvirt fixes the following issues : - CVE-2018-3639: cpu: Added support for 'ssbd' and 'virt-ssbd' CPUID feature bits pass through. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

Trend Micro Email Encryption Gateway SQL Injection Vulnerability

Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. A SQL injection vulnerability exists in the formChangePass class in Trend Micro...

CVE-2018-2417

Under certain conditions, the SAP Identity Management 8.0 pass of type ToASCII allows an attacker to access information which would otherwise be restricted...

██████: Same Origin Policy Bypass at ██████.com

██████.com: helps different sectors of business to create passes very easily through their app. ██████.org: helps their customers focus on using video to move their business in meaningful ways...

Retrieving NTLM Hashes without Touching LSASS: Internal Monologue Attack

Mimikatz, developed by Benjamin Delpy @gentilkiwi, is a well-regarded post-exploitation tool, which allows adversaries to extract plain text passwords, NTLM hashes and Kerberos tickets from memory, as well as perform attacks such as pass-the-hash, pass-the-ticket or build a golden ticket. Arguabl...