RHEL 7 : firefox (RHSA-2018:2835)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:2835 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

Cross site scripting

On the RICOH MP C406Z printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

RICOH MP 305+ Printer - Cross-Site Scripting

RICOH MP 305+ Printer - Cross-Site Scripting Exploit Title: RICOH MP 305+ Printer - Cross-Site Scripting Date: 2018-09-21 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.ricoh.com/ Hardware Link:...

Microsoft Windows Defender AV: Turn on behavior monitoring

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavbehaviormonitoring.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Turn on behavior monitoring Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is...

Microsoft Windows Defender AV: Threat alert levels at which default action should not be taken (High)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavthreatseveritydefaultaction4.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Specify threat alert levels at which default action should not be taken when detected High Authors: Emanuel Moss Copyright: Copyright c...

Microsoft Windows Defender AV: Configure local setting override for scanning all downloaded files and attachments

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavoverrideioavprotection.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Configure local setting override for scanning all downloaded files and attachments Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbon...

Microsoft Windows Defender AV: Process Exclusions

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavprocessexclusions.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Process Exclusions Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is free...

Microsoft Windows Defender AV: Specify the day of the week to check for definition updates

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavspecifydaydefinitionupdates.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Specify the day of the week to check for definition updates Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Microsoft Windows Defender AV: Turn off real-time protection

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavrealtimeprotection.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Turn off real-time protection Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is...

Microsoft Windows Defender AV: Specify the day of the week to run a scheduled scan

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavspecifydayscheduledscan.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Specify the day of the week to run a scheduled scan Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Microsoft Windows Defender AV: Turn off routine remediation

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavroutineremediation.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Turn off routine remediation Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is...

Microsoft Windows Defender AV: Configure local setting override for reporting to Microsoft MAPS

This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy. If you disable or do not configure this setting, Group Policy...

CVE-2018-7991

Huawei smartphones Mate10 with versions earlier before ALP-AL00B 8.0.0.110C00 have a Factory Reset Protection FRP bypass vulnerability. The system does not sufficiently verify the permission, an attacker uses a data cable to connect the smartphone to the computer and then perform some specific...

CVE-2018-7991

CVE-2018-7991 concerns Huawei Mate10 smartphones (versions earlier than ALP-AL00B 8.0.0.110(C00)) with a Factory Reset Protection (FRP) bypass vulnerability. The issue arises because the system does not sufficiently verify permissions when a device is connected via a data cable to a computer and ...

Code injection

admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting...

CVE-2018-17133

admin/webconfig.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting...

PHPMyWind Arbitrary Code Execution Vulnerability (CNVD-2018-19543)

PHPMyWind is a set of PHP and MySQL-based and W3C-compliant enterprise website building solutions. A security vulnerability exists in the admin/webconfig.php file in PHPMyWind version 5.5. The vulnerability can be exploited to execute arbitrary code by rewriting URL settings...

File Manager < 3.1 - CSRF to Stored Cross-Site Scripting

The plugin is lacking CSRF as well as sanitisation checks, allowing attackers to perform CSRF attacks against logged in administrators and set an XSS payload in the publicpath setting. PoC...

MediaTek Wireless Utility rt2870 Denial Of Service

Exploit Title: MediaTek Wirless Utility rt2870 - Denial of Service PoC Autor: Lawrence Amer Date: 2018-09-13 Vendor: MediaTek Software url: https://click.pstmrk.it/2ts/d86o2zu8ugzlg.cloudfront.net%2Fmediatek-craft%2Fdrivers%2FRT27702870RT307x.zip/K94pHAI/oTs1/oC6CdN114w Tested on OS: Windows 7...

aiohttp-session Session Fixation vulnerability

The pypi package aiohttp-session before 2.4.0 contained a Session Fixation vulnerability in loadsession function for RedisStorage that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies ?session=, or meta tags or script tags wi...