CSRF vulnerability in JUnit Plugin

A URL used to allow setting the description of a test object in JUnit Plugin did not require POST requests, resulting in a cross-site request forgery vulnerability. That URL now requires POST requests be sent...

Server-side request forgery vulnerability in Mesos Plugin

A missing permission check in a form validation method in Mesos Plugin allowed users with Overall/Read permission to initiate a connection test, connecting to an attacker-specified URL. Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability. Thi...

Time-out error occurs when you install a Windows Update package that contains drivers on a computer that is running Windows 7 or Windows Server 2008 R2

Time-out error occurs when you install a Windows Update package that contains drivers on a computer that is running Windows 7 or Windows Server 2008 R2 Symptoms Consider the following scenario: You try to install a Windows Update package that is marked as Important on a computer that is running...

Cisco TelePresence Codec Remote Detection

Detects the installed version of Cisco TelePresence Codec. This script sends an HTTP GET request and tries to ensure the presence of Cisco TelePresence Codec. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

CVE-2018-16286

LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits...

Description of the security update for the elevation of privilege vulnerability in Visual Studio 2015 Update 3: September 11, 2018

None None...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 69 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 69.0.3497.81 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming...

UBUNTU-CVE-2018-8022

A carefully crafted invalid TLS handshake can cause Apache Traffic Server ATS to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions...

Google Sued Over Misleading Users About Location Tracking Feature

Google was in the news last week for a misleading claim that "with Location History off, the places you go are no longer stored," which is not true. Now, the search engine giant is once again in the news after a San Diego man has filed the first lawsuit against Google over this issue. Last week,...

Microsoft Windows: Require a password when a computer wakes (plugged in)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winpasswdwakesplugged.nasl 11344 2018-09-12 06:57:52Z emoss $ Check value for Require a password when a computer wakes plugged in Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

[SECURITY] Fedora 27 Update: python-cryptography-vectors-2.3-1.fc27

Test vectors for the cryptography package. The only purpose of this package is to be a building requirement for python-cryptography, otherwise it has no use. Don=EF=BF=BD=EF=BF=BD=EF=BF =BDt install it unless you really know what you are doing...

[SECURITY] Fedora 28 Update: python-cryptography-vectors-2.3-1.fc28

Test vectors for the cryptography package. The only purpose of this package is to be a building requirement for python-cryptography, otherwise it has no use. Don=EF=BF=BD=EF=BF=BD=EF=BF =BDt install it unless you really know what you are doing...

CVE-2018-3089

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. The supported version that is affected is Prior to 5.2.16. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to...

CVE-2017-13097 The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), including modification of Rights Block to remove or relax license requirement

The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property IP, as well as the management of access rights for such IP, including modification of Rights Block to remove or relax license requirement. The methods are flawed and, in the most egregious case...

CVE-2017-13097

CVE-2017-13097 refers to a weakness in the IEEE P1735 standard where an attacker can modify the Rights Block to remove or relax license requirements. The associated CERT/NVD entries describe this as part of a broader set of flaws in P1735 that can enable recovery of plaintext IP and insertion of ...

Description of the security update for the remote code execution vulnerability in Visual Studio 2015 Update 3: July 10, 2018

None None...

CVE-2018-0295

A vulnerability in the Border Gateway Protocol BGP implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition due to the device unexpectedly reloading. The vulnerability is due to incomplete input validation of the BGP update...

CSRF vulnerability and missing permission checks in Black Duck Detect Plugin allowed server-side request forgery, capturing credentials

Black Duck Detect Plugin did not perform permission checks on methods implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored...

Default credentials

Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in...

72 Hours: Understanding the GDPR Data Breach Reporting Timeline

We're down to the wire with respect to the General Data Protection Regulation GDPR compliance deadline of May 25, 2018. Organizations that fail to comply could face fines of up to €20M roughly $22M or 4 percent of their annual global turnover from the prior year and we’ll soon see just how EU...