CVE-2017-6781

A vulnerability in the management of shell user accounts for Cisco Policy Suite CPS Software for CPS appliances could allow an authenticated, local attacker to gain elevated privileges on an affected system. The affected privilege level is not at the root level. The vulnerability is due to...

Cisco Patches Privilege Escalation Bugs in APIC

Cisco patched two high-severity vulnerabilities in its Cisco Application Policy Infrastructure Controller APIC that could allow an attacker to elevate privileges on the host machine. The product automates and manages the APIC fabric, optimizing application performance and provisioning for physica...

Cisco Application Policy Infrastructure Controller Elevation of Privilege Vulnerability

The Cisco Application Policy Infrastructure Controller is Cisco's robust all-in-one architecture for transport networks. A security vulnerability in the Cisco Application Policy Infrastructure Controller RBAC privilege assignment allows remote attackers to exploit the vulnerability by submitting...

Cisco Unified Communications Manager Horizontal Privilege Escalation Vulnerability

A vulnerability in configuration modification permissions validation for Cisco Unified Communications Manager could allow an authenticated, remote attacker to perform a horizontal privilege escalation where one user can modify another user's configuration. The vulnerability is due to lack of prop...

August 10, 2017 – Morning Cyber Coffee Headlines – “PGA Championship” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 10, 2017 - Headlines One easy thing your agency can do to attract more...

Facebook Like Button - Moderately Critical - XSS - DRUPAL-SA-CONTRIB-2017-066

This module provides a Facebook Like button on node pages and blocks. The module does not sufficiently sanitize output when configured to use custom css rules. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer fblikebutton". CVE...

Better field descriptions - Critical - XSS - SA-CONTRIB-2017-064

This module enables you to add themeable descriptions to fields in forms. The module doesn't sufficiently sanitize descriptions. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "add better descriptions to fields". CVE identifiers issued ACVE...

openvswitch: Invalid processing of a malicious OpenFlow role status message

While parsing an OpenFlow role status message Open vSwitch OvS, a call to the abort function for undefined role status reasons in the function 'ofpprintrolestatusmessage' in 'lib/ofp-print.c' could be misused for a remote denial of service attack by a malicious switch...

Design/Logic Flaw

Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet...

CloudForms: lack of RBAC on various methods in web UI

CloudForms lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails applications portion of CloudForms to escalate privileges...

Information Disclosure

Moodle is vulnerable to information disclosures. The application sets certain group IDs to 0 upon a database-entry change, allowing a malicious user to view group-level entries after being edited by a user with a teacher role...

Privilege Escalation

Moodle is vulnerable to privilege escalations. On big installations, when the sync script was run it would improperly assign a manager role to suspended student accounts, granting these accounts the same access rights as a manager role...

Denial Of Service (DoS) Through Disk Consumption

Moodle is vulnerable to denial of service DoS attacks. A malicious user with the guest role can create multiple big drafts with the Atto module's editor-autosave feature to cause the system to run out of disk space...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS. Authenticated attackers can leverage a flaw in the survey module and the student role to inject web script into a survey answer...

Privilege Escalation

Moodle is vulnerable to privilege escalation attacks. The attacks exist because the permission check for teacher are not properly handled, allowing any authenticated users with teacher role without accessallgroups capability to post any arbitrary groups...

CVE-2017-11422

Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include reset password, create new account, create new role, etc...

CVE-2017-11422

Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include reset password, create new account, create new role, etc...

CVE-2017-2338

A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the...

CVE-2017-2339

A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the...

CVE-2017-2337

A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to inject HTML/JavaScript content into the management session of other users including the administrator. This enables the...