Tax Identity Theft Awareness Week

Tax Identity Theft Awareness Week is January 29 to February 2, and many federal agencies are offering information and resources to help consumers learn to protect themselves from tax-related identity theft and Internal Revenue Service IRS imposter scams. NCCIC/US-CERT encourages consumers to revi...

Nari PCS-9611 relay input validation vulnerability

Nari PCS-9611 relay is a line protection measurement and control device from China Guodian Nanrui Nari. An input validation vulnerability exists in the Nari PCS-9611 relay. A remote attacker can exploit this vulnerability to arbitrarily read/access system resources...

CVE-2018-5447

An Improper Input Validation issue was discovered in Nari PCS-9611 relay. An improper input validation vulnerability has been identified that affects a service within the software that may allow a remote attacker to arbitrarily read/access system resources and affect the availability of the syste...

CVE-2018-5447

An Improper Input Validation issue was discovered in Nari PCS-9611 relay. An improper input validation vulnerability has been identified that affects a service within the software that may allow a remote attacker to arbitrarily read/access system resources and affect the availability of the syste...

CVE-2018-5447

The CVE-2018-5447 issue affects the Nari PCS-9611 relay (line protection/control device) with an improper input validation vulnerability (CWE-20) that may allow a remote attacker to arbitrarily read/access system resources and impact availability. Affected products include all PCS-9611 versions; ...

External Resource Load

nifi-jetty is vulnerable to malicious external resource loads. Using a malicious HOST header, attackers can load malicious resources from external sources...

Apache NiFi Sensitive Information Disclosure Vulnerability

Apache NiFi is a data streaming based data processing and distribution system. A security vulnerability in Apache NiFi's handling of HTTP requests allows remote attackers to exploit the vulnerability by submitting a special request to load NiFi to load resources from an external server...

CVE-2017-12632

A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate...

CVE-2018-6029

The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery SSRF, because URL validation only considers whether the URL contains the "csdn" substring...

NoneCms Server-Side Request Forgery Vulnerability

NoneCms is an open source CMS Content Management System for quickly building corporate websites, personal blogs and supporting mobile. A cross-site request forgery vulnerability exists in the 'copy' function of the application/admin/controller/Article.php file in NoneCms version 1.3.0, which stem...

PHP < 5.6.33, 7.x < 7.0.27, 7.1.x < 7.1.13, 7.2.x < 7.2.1 Multiple Vulnerabilities - Windows

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

CVE-2018-2654

Vulnerability in the PeopleSoft Enterprise HCM Human Resources component of Oracle PeopleSoft Products subcomponent: Company Dir / Org Chart Viewer. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

Code injection

Vulnerability in the PeopleSoft Enterprise HCM Human Resources component of Oracle PeopleSoft Products subcomponent: Company Dir / Org Chart Viewer. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2018-2681

Vulnerability in the PeopleSoft Enterprise HCM Human Resources component of Oracle PeopleSoft Products subcomponent: Security. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft...

CVE-2018-2681

Vulnerability in the PeopleSoft Enterprise HCM Human Resources component of Oracle PeopleSoft Products subcomponent: Security. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft...

CVE-2018-2654

Vulnerability in the PeopleSoft Enterprise HCM Human Resources component of Oracle PeopleSoft Products subcomponent: Company Dir / Org Chart Viewer. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2018-2654

The CVE-2018-2654 entry describes a vulnerability in Oracle PeopleSoft Products, specifically the PeopleSoft Enterprise HCM Human Resources component, subcomponent Company Dir / Org Chart Viewer (version 9.2 affected). An unauthenticated attacker who can reach the system over HTTP can compromise ...

Atlassian Jira Information Disclosure Vulnerability

Atlassian Jira is a defect tracking management system, a commercial application for defect management, task tracking and project management. An information disclosure vulnerability exists in the Trello import program in Atlassian Jira. A remote attacker could exploit this vulnerability to access...

Cisco WebEx Meetings Server Information Disclosure Vulnerability

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the application. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to a design flaw i...

CVE-2017-16865

The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery SSRF. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access...