Security update for gitolite (moderate)

This update for gitolite fixes the following issues: Gitolite was updated to 3.6.9: - CVE-2018-16976: prevent racy access to repos in process of migration to gitolite boo1108272 - 'info' learns new '-p' option to show only physical repos as opposed to wild repos The update to 3.6.8 contains: - fi...

CVE-2018-9501

In the SetupWizard, there is a possible Factory Reset Protection bypass due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1...

Circontrol CirCarLife Information Disclosure Vulnerability (CNVD-2018-20063)

Circontrol CirCarLife is a parking lot automation system from Circontrol, Spain. A security vulnerability exists in Circontrol CirCarLife versions prior to 4.3, which originates from the program storing sensitive information elements in JSON format in the /services/system/setup.json file. An...

How to use GPMC to manage Citrix Policies (GPOs) for your DaaS environment

This article describes the required steps to be able to correctly setup and configure the management of Citrix Policies using Microsoft's Group Policy Management Console gpmc from a machine other than a Citrix Delivery Controller DDC...

SUSE-SU-2018:2902-1 Security update for yast2-smt

This update fixes the following issues in yast2-smt: - Explicitly mention 'Organization Credentials' fate321759 - Rearrange the SMT set-up dialog bsc977043 - Added missing translation marks bsc1037811 - Remove cron job rescheduling bsc1097560 This update is a requirement for the security update f...

Information disclosure

An issue was discovered in CIRCONTROL CirCarLife before 4.3. Due to the storage of multiple sensitive information elements in a JSON format at /services/system/setup.json, an authenticated but unprivileged user can exfiltrate critical setup information...

CVE-2018-16672

An issue was discovered in CIRCONTROL CirCarLife before 4.3. Due to the storage of multiple sensitive information elements in a JSON format at /services/system/setup.json, an authenticated but unprivileged user can exfiltrate critical setup information...

CVE-2018-16672

An issue was discovered in CIRCONTROL CirCarLife before 4.3. Due to the storage of multiple sensitive information elements in a JSON format at /services/system/setup.json, an authenticated but unprivileged user can exfiltrate critical setup information...

CVE-2018-17400

The PhonePe wallet aka com.PhonePe.app application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by intercepting the user name and PIN during the initial configuration of the application. NOTE: the vendor says that, to exploit this, the user has to...

CVE-2018-17403

The PhonePe wallet aka com.PhonePe.app application 3.0.6 through 3.3.26 for Android might allow attackers to impersonate a user and set up their account without their knowledge. NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibili...

CVE-2018-17403

PhonePe wallet (com.PhonePe.app) on Android, versions 3.0.6–3.3.26, is vulnerable to user impersonation and unauthorized account setup via a malicious app that users must explicitly install and grant Accessibility permission to. This capability relies on the Android Accessibility framework and is...

PT-2018-14013 · Phonepe · Phonepe

Name of the Vulnerable Software and Affected Versions: PhonePe wallet aka com.PhonePe.app versions 3.0.6 through 3.3.26 Description: The issue might allow attackers to perform Account Takeover attacks by intercepting the user name and PIN during the initial configuration of the application. To...

CVE-2013-7203

gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when running gitolite setup...

DEBIAN-CVE-2013-7203

gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when running gitolite setup...

Code injection

gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when running gitolite setup...

Update Rollup 11 for Azure Site Recovery

Describes the fixes that are included in Update Rollup 11 for Microsoft Azure Site Recovery Provider version 5.1.1500 and for Azure Site Recovery Unified Setup VMware to Azure version 9.0.4083.1.IntroductionThis article describes the fixes that are included in Update Rollup 11 for the...

CVE-2018-17207

An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files installer.php and installer-backup.php, an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution...

Provisioning services--Connection Timeout Expired when adding a new server to an existing farm

The following error can be seen trying to add a PVS server to an exisiting farm. "Connection timeout expired. The timeout period elapsed while attempting to consume the pre-login handshake acknowledgement. The could be because the pre-login handshake failed or the server was unable to respond pac...

CLI for Ephemeral Penetration Testing: hideNsneak

This application assists in managing attack infrastructure for penetration testers by providing an interface to rapidly deploy, manage, and take down various cloud services. These include VMs, domain fronting, Cobalt Strike servers, API gateways, and firewalls. hideNsneak provides a simple...

Duplicator <= 1.2.40 - Unauthenticated Arbitrary Code Execution

If installer files, installer.php and installer-backup.php, are not removed by the administrators, a code injection during the database setup step allows to execute arbitrary code on the server. PoC actionajax=3step=3=nowhere=test=test=test'; fileputcontents"test.php", ' '; /=12345&...