3591 matches found
GitLab CE/EE Information Disclosure Vulnerability (CNVD-2019-32228)
GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. GitLab CE/...
PT-2019-12326
Name of the Vulnerable Software and Affected Versions Couchbase Server versions 5.5.0 through 6.0.0 Description The eventing service in Couchbase Server exposes system diagnostic profiles via an HTTP endpoint that does not require credentials on a port intended for internal traffic only...
7 Hidden Signs That Your Network is Under Attack
Editor’s Note: Sam Bocetta, a guest author on the Carbon Black blog, is a freelance journalist specializing in U.S. diplomacy and national security, with emphases on technology trends in cyber warfare, cyber defense, and cryptography. When you think of hackers, do you picture some teenage prodigy...
CVE-2019-15873
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pmtemplatepreview&html=?php substring followed by PHP code...
CVE-2019-15873
The WordPress plugin profilegrid-user-profiles-groups-and-communities (Profiles Grid) is vulnerable before version 2.8.6. The issue is remote code execution via wp-admin/admin-ajax.php using action=pm_template_preview&html=
CVE-2019-15873: Improper Control of Generation of Code
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pmtemplatepreview&html=...
PT-2019-14453
Name of the Vulnerable Software and Affected Versions profilegrid-user-profiles-groups-and-communities plugin versions prior to 2.8.6 Description The issue allows for remote code execution. This can be achieved through a request to the wp-admin/admin-ajax.php endpoint with specific parameters,...
CVE-2019-4536
IBM i 7.4 users who have done a Restore User Profile RSTUSRPRF on a system which has been configured with Db2 Mirror for i might have user profiles with elevated privileges caused by incorrect processing during a restore of multiple user profiles. A user with restore privileges could exploit this...
Design/Logic Flaw
IBM i 7.4 users who have done a Restore User Profile RSTUSRPRF on a system which has been configured with Db2 Mirror for i might have user profiles with elevated privileges caused by incorrect processing during a restore of multiple user profiles. A user with restore privileges could exploit this...
Covenant - A .NET Command And Control Framework For Red Teamers
Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers. Covenant is an ASP.NET Core, cross-platform application that includes a...
PT-2019-8420
Name of the Vulnerable Software and Affected Versions Cognitoys Dino devices affected versions not specified Description The issue allows for a CSRF attack on the profiles add.html page. Recommendations At the moment, there is no information about a newer version that contains a fix for this...
Apple iOS and Apple tvOS Profiles Component Authorization Validation Vulnerability
Apple iOS and Apple tvOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices. apple tvOS is an operating system for smart TVs. profiles is one of the profile components. A security vulnerability exists in the Profiles component of Apple iOS before 12.4 an...
About the security content of tvOS 12.4
About the security content of tvOS 12.4 This document describes the security content of tvOS 12.4. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
HackerOne: Total bounties paid amount is disclosed because of redesign of the Program Profiles
Description: On July 2 Hackerone redesigned the Program Profiles.After the new program page design, I noticed that it is disclosing total bounties paid amount. For some program total bounties paid amount was hidden ████. It used to show like $4000 if the bounty was $3990.But after the redesign, i...
CVE-2019-6640
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, SNMP exposes sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is inserted into various profile types and accessed using SNMPv...
PT-2019-18222 · F5 · Big-Ip
Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions 11.5.1 through 11.5.8 F5 BIG-IP versions 11.6.1 through 11.6.3.4 F5 BIG-IP versions 12.1.0 through 12.1.4 F5 BIG-IP versions 13.0.0 through 13.1.1.4 F5 BIG-IP versions 14.0.0 through 14.0.0.4 F5 BIG-IP versions 14.1.0 throu...
F5 Networks BIG-IP : SNMP vulnerability (K40443301)
SNMP exposes sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is inserted into various profile types and accessed using SNMPv2. CVE-2019-6640 Impact An attacker with direct SNMP access to a BIG-IP system, or an attacker with a privileged...
Dating App Jack'd Fined After Leaking Users' Nude Pics
LGBTQ dating app Jack’d must cough up a $240,000 fine and “make substantial changes to improve security” on the heels of a security faux pas that leaked the private data – including nude photos – of thousands of its users. Jack’d is a popular location-based app that caters to gay and bisexual men...
