Oriental Resources Self-service Website - SQL Injection Vulnerability in Enterprise Website Management System

Enterprise Website Management System is an enterprise website based on PHP+MYSQL. An SQL injection vulnerability exists in Oriental Resources Self-service Website Builder - Enterprise Website Management System. The vulnerability is due to the system pkey parameter does not filter the data submitt...

Fedora 25 : glpi (2017-2ec83f11c1)

various security fixes https://github.com/glpi-project/glpi/issues/2475, https://github.com/glpi-project/glpi/issues/2476, https://github.com/glpi-project/glpi/issues/2492, - fix regressions on self service portal : - self-service users should not be auto assigned as tech - type and category...

Fedora 26 : glpi (2017-fd9d2dd019)

various security fixes https://github.com/glpi-project/glpi/issues/2475, https://github.com/glpi-project/glpi/issues/2476, https://github.com/glpi-project/glpi/issues/2492, - fix regressions on self service portal : - self-service users should not be auto assigned as tech - type and category...

EMC RSA Authentication Manager < 8.2 SP1 Patch 2 Self-Service Console Brute-force PIN Disclosure (ESA-2017-084)

The version of EMC RSA Authentication Manager running on the remote host is prior to 8.2 SP1 Patch 2 8.2.1.2. It is, therefore, affected by an information disclosure vulnerability in the self-service console due to a lack of brute-force protection mechanisms. An authenticated, remote attacker can...

Selfservice.exe Crashes on First Log On, Second Attempt Works

When a user attempts to logon it fails the first time and succeeds the second time. The first time selfservice.exe crashes. Self-service Plug-in exited unexpectedly. Exception was Object reference not set to an instance of an object. at Dazzle.AppMonitor.Control.Controller.WaitForLogoff at...

CVE-2017-8006

In EMC RSA Authentication Manager 8.2 SP1 Patch 1 and earlier, a malicious user logged into the Self-Service Console of RSA Authentication Manager as a target user can use a brute force attack to attempt to identify that user's PIN. The malicious user could potentially reset the compromised PIN t...

Authentication flaw

In EMC RSA Authentication Manager 8.2 SP1 Patch 1 and earlier, a malicious user logged into the Self-Service Console of RSA Authentication Manager as a target user can use a brute force attack to attempt to identify that user's PIN. The malicious user could potentially reset the compromised PIN t...

CVE-2017-8006

In EMC RSA Authentication Manager 8.2 SP1 Patch 1 and earlier, a malicious user logged into the Self-Service Console of RSA Authentication Manager as a target user can use a brute force attack to attempt to identify that user's PIN. The malicious user could potentially reset the compromised PIN t...

How Do I Deploy Self-Service Password Reset For the First Time

The primary intent of this article is to provide steps to how to deploy Self-Service Password Reset SSPR environment for the first time...

CVE-2017-3592

Vulnerability in the Oracle Payables component of Oracle E-Business Suite subcomponent: Self Service Manager. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows high privileged attacker with network access...

CVE-2016-1915

Multiple cross-site scripting XSS vulnerabilities in BlackBerry Enterprise Server 12 BES12 Self-Service before 12.4 allow remote attackers to inject arbitrary web script or HTML via the locale parameter to 1 mydevice/index.jsp or 2 mydevice/loggedOut.jsp...

Sql injection

Multiple SQL injection vulnerabilities in the com.rim.mdm.ui.server.ImageServlet servlet in BlackBerry Enterprise Server 12 BES12 Self-Service before 12.4 allow remote attackers to execute arbitrary SQL commands via the imageName parameter to 1 mydevice/client/image, 2 admin/client/image, 3...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in BlackBerry Enterprise Server 12 BES12 Self-Service before 12.4 allow remote attackers to inject arbitrary web script or HTML via the locale parameter to 1 mydevice/index.jsp or 2 mydevice/loggedOut.jsp...

CVE-2016-1915

The CVE-2016-1915 entry describes XSS vulnerabilities in BlackBerry BES12 Self-Service prior to 12.4. Affected component: the self-service web app; vulnerable via the locale parameter in mydevice/index.jsp and mydevice/loggedOut.jsp. Impact: remote injection of script/HTML. Root cause: cross-site...

Airwatch 6.1.x / 6.4.x LDAP Injection

https://www.osisecurity.com.au/airwatch-self-service-portal-username-parameter-ldap-injection.html Date: 04-Apr-2017 Product: AirWatch Self Service MDM Versions affected: v6.1.x v6.4.x Vulnerability: LDAP injection Example: https://target/DeviceManagement/ URL accepts the following POST parameter...

SAP Cloud Commerce Platform HANA System Authentication Vulnerability

The SAP Cloud Commerce Platform HANA system is a real-time data computing platform based on in-memory computing technology. There are multiple vulnerabilities in the SAP Cloud Commerce Platform HANA system, one of the critical vulnerabilities is an authentication vulnerability that can be exploit...

Multiple Unspecified Security Bypass Vulnerabilities in SAP HANA User Self Service Tools

SAP HANA is a suite of real-time data analytics platforms from Germany's SAP. Multiple unspecified security bypass vulnerabilities exist in SAP HANA User Self Service Tools. An attacker could use this vulnerability to bypass certain security restrictions and perform unauthorized operations...

Unspecified Vulnerability in Oracle E-Business Suite Oracle iRecruitment Component

Oracle E-Business Suite E-Business Suite is the United States Oracle Oracle company's set of fully integrated global business management software. The software provides customer relationship management, service management, financial management and other functions. Oracle iRecruitment is one of th...

Apache MyFaces Trinidad CVE-2016-5019 Remote Code Execution Vulnerability

Description Apache MyFaces Trinidad is prone to a security vulnerability. Successfully exploiting this issue allows attackers to obtain sensitive information or execute arbitrary code in the context of the affected application. Apache MyFaces Trinidad 1.2.14-core , 1.0.13-core , 2.0.1-core and...

How to Control Receiver Self-Service.exe Launch

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information How to control or configure Receiver Self-Service.exe launching or refresh time. SelfServicePlugin runs...