HPSBHF03588 rev. 1 - Intel Q1 2018 Intel® Active Management Technology 9.x/10.x/11.x Security Review Cumulative Update and Intel® Management Engine 11.x Issue

Potential Security Impact Elevation of Privilege Source: HP, HP Product Security Response Team PSRT Reported by: Intel VULNERABILITY SUMMARY Intel has identified security vulnerabilities that could potentially place affected platforms at risk. The issues affect Intel® Active Management Technology...

ADB Group Manipulation Privilege Escalation

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Privilege escalation via linux group manipulation product: All ADB Broadband Gateways / Routers based on Epicentro platform vulnerable version: Hardware: ADB P.RG AV4202N...

Zyxel ZyWALL ZLD 4.30 Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Reflected Cross-Site Scripting product: Zyxel ZyWALL: see "Vulnerable / tested version" vulnerable version: ZLD 4.30 and before fixed version: ZLD 4.31 CVE number: -...

WSO2 Identity Server 5.3.0 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications ======================================================================= title: Multiple Stored XSS Vulnerabilities product: WSO2 Carbon, WSO2 Dashboard Server vulnerable version: WSO2 Identity Server 5.3.0 fixed version: WSO2 Identity Server...

TestLink Open Source Test Management Insecure Direct Object Reference Vulnerability

Exploit for php platform in category web applications ======================================================================= title: Insecure Direct Object Reference product: TestLink Open Source Test Management vulnerable version: 1.9.17 fixed version: 1.9.17 after November 2017, and the current...

Sonatype Nexus Repository Manager OSS/Pro Multiple Cross-Site Scripting Vulnerabilities

Exploit for multiple platform in category web applications ======================================================================= title: Multiple Cross-Site Scripting Vulnerabilities product: Sonatype Nexus Repository Manager OSS/Pro vulnerable version: =2.14.5, =3.7.1 fixed version: 2.14.6, 3.8...

Sonatype Nexus Repository Manager OSS/Pro 2.14.5 / 3.7.1 XSS

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Cross-Site Scripting Vulnerabilities product: Sonatype Nexus Repository Manager OSS/Pro vulnerable version: =2.14.5, =3.7.1 fixed version: 2.14.6, 3.8.0 CVE...

Oracle Financial Services Analytical Applications 7.3.5.x / 8.0.x XXE Injection(CVE-2018-2660) / XSS(CVE-2018-2661)

Vendor description: ------------------- "Oracle is the unchallenged leader in Financial Services, with an integrated, best-in-class, end-to-end solution of intelligent software and powerful hardware designed to meet every financial service need." Source:...

OpenEMR 5.0.0 - OS Command Injection / Cross-Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: OS Command Injection & Reflected Cross Site Scripting product: OpenEMR vulnerable version: 5.0.0 fixed version: 5.0.0 Patch 2 or higher CVE number: - impact: Critical...

OS Command Injection & Reflected Cross Site Scripting in OpenEMR

Vendor description: ------------------- "OpenEMR is the most popular open source electronic health records and medical practice management solution. ONC certified with international usage, OpenEMR's goal is a superior alternative to its proprietary counterparts." Source: http://www.open-emr.org/...

WAGO PFC 200 SERIES Multiple Vulnerabilities

Exploit for hardware platform in category local exploits VENDOR DESCRIPTION “The WAGO-I/O-SYSTEM is a flexible fieldbus-independent solution for decentralized automation tasks. With the relay, function and interface modules, as well as overvoltage protection, WAGO provides a suitable interface fo...

CRITICAL CODESYS VULNERABILITIES IN WAGO PFC 200 SERIES

VENDOR DESCRIPTION “The WAGO-I/O-SYSTEM is a flexible fieldbus-independent solution for decentralized automation tasks. With the relay, function and interface modules, as well as overvoltage protection, WAGO provides a suitable interface for any application.” Source:...

Progress Sitefinity 10.0 / 10.1 Broken Access Control / LINQ Injection Vulnerability

Exploit for multiple platform in category web applications ======================================================================= title: Broken access control & LINQ injection product: Progress Sitefinity vulnerable version: 10.0, 10.1 fixed version: =10.1.6527.0 internal build, 10.2 CVE number:...

Progress Sitefinity 10.0 / 10.1 Broken Access Control / LINQ Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Broken access control & LINQ injection product: Progress Sitefinity vulnerable version: 10.0, 10.1 fixed version: =10.1.6527.0 internal build, 10.2 CVE number: - impact:...

Siemens SICAM RTUs SM-2556 COM Modules XSS / Bypass / Code Execution Vulnerabilities

Siemens SICAM RTUs SM-2556 COM modules firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00 suffer from authentication bypass, code execution, and cross site scripting vulnerabilities. ======================================================================= title: Authentication...

Siemens SICAM RTUs SM-2556 COM Modules XSS / Bypass / Code Execution

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Authentication bypass, cross-site scripting & code execution product: Siemens SICAM RTUs SM-2556 COM Modules firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00 and...

Linksys E Series - Multiple Vulnerabilities

Exploit for hardware platform in category web applications ======================================================================= title: Multiple vulnerabilities product: Linksys E series, see "Vulnerable / tested versions" vulnerable version: see "Vulnerable / tested versions" fixed version: no...

Afian AB FileRun 2017.03.18 - Multiple Vulnerabilities

Afian AB FileRun 2017.03.18 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Afian AB FileRun vulnerable version: 2017.03.18 fixed version: 2017.09.18 impact:...

Webtrekk Pixel Tracking Cross Site Scripting Vulnerability

Webtrekk Pixel Track versions 3.24 to 3.40, 4.00 to 4.40, and 5.00 to 5.04 suffer from a cross site scripting vulnerability. ======================================================================= title: Cross site scripting product: Webtrekk Pixel tracking vulnerable version: v3.24 to v3.40, v4....

Afian AB FileRun 2017.03.18 CSRF / Shell Upload / XSS / Redirection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Afian AB FileRun vulnerable version: 2017.03.18 fixed version: 2017.09.18 impact: critical homepage: https://www.filerun.com |...