jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using MyBatis classes when using DefaultTyping. An attacker could use this flaw to achieve content exfiltration and possibly conduct further attacks...

CVE-2019-12463

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring,...

CVE-2019-10665

An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with...

CVE-2019-11724

Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now redirects to another site. This additional permission is unnecessary and is a potential vector for malicious attacks. This vulnerability affects Firefox 68...

PT-2019-9889 · Ibm · Ibm Security Identity Manager

Name of the Vulnerable Software and Affected Versions: IBM Security Identity Manager version 7.0.1 Description: The issue discloses sensitive information to unauthorized users, which can be used to mount further attacks on the system. Recommendations: For IBM Security Identity Manager version...

CVE-2019-9803

The Upgrade-Insecure-Requests UIR specification states that if UIR is enabled through Content Security Policy CSP, navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrectly navigate to an HTTP URL rather than perform the security upgrade requested by the CSP in some...

CVE-2018-17891

Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is no Oracle TNS listener available, users will trigger an HTTP 500 error, leaking technical information an attacker could use to initiate a...

Microsoft Windows: Audit Other Logon/Logoff Events

Audit Other Logon/Logoff Events determines whether Windows generates audit events for other logon or logoff events. These other logon or logoff events include: - A Remote Desktop session connects or disconnects. - A workstation is locked or unlocked. - A screen saver is invoked or dismissed. - A...

Microsoft Windows SMBTouch Scanner

The SMBTouch Vulnerability Scanning tool comes from a cluster of other attack tools. This module is used to gather information from servers about their vulnerabilities. Such scans may indicate preparation for further attacks...

softdebut.com Open Redirect vulnerability

Vulnerable URL: http://www.softdebut.com/CMSModules/BannerManagement/CMSPages/BannerRedirect.ashx?bannerID=244=http%3A%2F%2Fwww.xssposed.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly...

OpenDNS BGP Stream Twitter Feed

Enterprises in the throes of a denial-of-service attack, or suspicious about the integrity of their Internet traffic, will soon have a free data feed available that cuts through the noise produced by normal Internet routing over BGP, the Border Gateway Protocol. During next month’s Black Hat...

Fixed potential path traversal attack and remote code injection

This is a security release. All users MUST upgrade to this release to prevent two potential security issues: path traversal attack remote code injection These two security issues have been reported by Andreas Forsblom. THANKS! Below is the original report Andreas sent me: Hi William, First, thank...

Pligg 9.9.5 'CAPTCHA' Registration Automation Security Bypass Weakness

No description provided by source. source: http://www.securityfocus.com/bid/30518/info Pligg is prone to a security-bypass weakness. Successfully exploiting this issue will allow an attacker to register multiple new users through an automated process. This may lead to other attacks. Pligg 9.9.5 i...

joola.io: SSH Port Wide Open

SSH port is wide open, this can give attackers additional information to coordinate an attack: Nmap scan report for joola.io 178.79.174.108 Host is up 0.033s latency. rDNS record for 178.79.174.108: li311-108.members.linode.com Not shown: 994 closed ports PORT STATE SERVICE 20/tcp filtered ftp-da...

phpMyRecipes - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/58160/info phpMyRecipes is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the...

DOMParser loads linked resources in extensions when parsing text/html — Mozilla

Security researcher vsemozhetbyt reported that when the DOMParser is used to parse text/html data in a Firefox extension, linked resources within this HTML data will be loaded. If the data being parsed in the extension is untrusted, it could lead to information leakage and can potentially be...

shopex password retrieve at the newly generated password may predict vulnerability-vulnerability warning-the black bar safety net

Brief description: shopex in the password place, there are some logic design problems, the cause can be predicted the newly-generated password may be used to attack acquiring others passwords Detailed description: The relevant code /core/shop/controller/ctl. passport. php: function sendPSW...

A2CMS - index.php Local File Disclosure

A2CMS - index.php Local File Disclosure source: https://www.securityfocus.com/bid/49883/info A2CMS is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input. Exploiting this vulnerability would allow an attacker to obtain potentially sensitive...

Looking Glass - Cross-Site Scripting

source: https://www.securityfocus.com/bid/14680/info Looking Glass is prone to a cross-site scripting vulnerability. This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the software. Other attacks are also possible...

Looking Glass - Cross-Site Scripting

Looking Glass - Cross-Site Scripting source: https://www.securityfocus.com/bid/14680/info Looking Glass is prone to a cross-site scripting vulnerability. This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the software. Other attacks are also...