WBCE CMS vulnerable to SQL injection

Overview WBCE CMS provided by WBCE Team is an open-source Contents Management System CMS. WBCE CMS contains an SQL injection vulnerability CWE-89. ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An...

CubeCart vulnerable to directory traversal

Overview CubeCart from CubeCart Limited is an open source system for creating online shopping websites. CubeCart contains a directory traversal vulnerability CWE-22. ASAI Ken reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

DSA-3797-1 mupdf - security update

Bulletin has no description...

MGASA-2017-0067 Updated php-tcpdf packages fix security vulnerability

A local file inclusion vulnerability in TCPDF allows to upload files from the server generating PDF files to an external FTP server CVE-2017-6100. The updated php-tcpdf-6.0.098-1.1.mga5 package fixes this issue by setting KTCPDFCALLSINHTML configuration parameter to false by default...

DLA-835-1 cakephp - security update

Bulletin has no description...

Security Advisory - Privilege Elevation Vulnerability Caused by Arbitrary File Upload in Huawei Themes

The Huawei Themes APP in some Huawei products has a privilege elevation vulnerability due to the lack of theme pack check. An attacker could exploit this vulnerability to upload theme packs containing malicious files and trick users into installing the theme packets, resulting in the execution of...

Cybozu Garoon fails to restrict access permission in the mail function

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an access restriction flaw in the mail function. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact A user may alter the order of the mail folders. Solution...

Cybozu Garoon vulnerable to information disclosure

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an information disclosure vulnerability. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact Token used for cross-site request forgery CSRF protection may be...

Cybozu Garoon vulnerable to SQL injection

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an SQL injection vulnerability. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the Information Security Early...

Cybozu Garoon fails to restrict access permission in the Phone Messages function

Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an access restriction flaw in the Phone Messages function Yuji Tounai reported this vulnerability to Cybozu, Inc., and Cybozu, Inc. reported it to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC...

DSA-3789-1 libevent - security update

Bulletin has no description...

MGASA-2017-0047 Updated calibre packages fix security vulnerability

Newer devices like Kobo Aura HD requires newer versions of calibre for their new firmwares. Current calibre package does not support them. Also, our current calibre packages in both core and backports repositories have a security issue CVE-2016-10187. Newer versions of calibre 2.75.0 + fixes this...

DLA-819-2 mysql-5.5 - version number correction

Bulletin has no description...

Watch Out! First-Ever Word Macro Malware for Apple Mac OS Discovered in the Wild

After targeting Windows-based computers over the past few years, hackers are now shifting their interest to Macs as well. The emergence of the first macro-based Word document attack against Apple's macOS platform is the latest example to prove this. The concept of Macros dates back to 1990s. You...

Hands-on Vulnerability Learning Tool "AppGoat" vulnerable to remote code execution

Overview AppGoat provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA is a hands-on vulnerability learning tool. Hands-on Vulnerability Learning Tool "AppGoat" for Web Application contains a remote code execution vulnerability. Shoji Baba reported this vulnerability to IPA. JPCERT/CC...

Hands-on Vulnerability Learning Tool "AppGoat" vulnerable to cross-site request forgery

Overview AppGoat provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA is a hands-on vulnerability learning tool. Hands-on Vulnerability Learning Tool "AppGoat" for Web Application contains a cross-site request forgery vulnerability. Shoji Baba reported this vulnerability to IPA. JPCERT/...

Security Advisory - Buffer Overflow Vulnerability in Goldeneye Driver of Huawei Smart Phones

The goldeneye driver of some Huawei smart phones has buffer overflow vulnerability due to the lack of a parameters check. An attacker with the root privilege of the Android system can tricks a user into installing a malicious application on the smart phone, and send given parameter to smart phone...

St. Jude Patches Additional Cardiac Device

St. Jude Medical has patched a vulnerability in another Merlin@home Transmitter medical device vulnerable to a man-in-the-middle attack. The medical device maker issued an update on Monday for its Merlin@home Transmitter “inductive” models, expanding the number of devices impacted by a...

Information disclosure in email field dialog at sharing - ownCloud

An attacker can get sensitive information in the E-Mail share dialog with the autocompletion by default Affected Software ownCloud Server 9.1.3 CVE-2017-5866 core/c27b2b935f940a2c8e2fc1a5d8934407ae85dd57 ownCloud Server 9.0.7 CVE-2017-5866 core/62b1865a301a1ce90f9a3c773f5eb00c33deb581 ownCloud...

MGASA-2017-0034 Updated wireshark packages fix security vulnerabilities

The wireshark package has been updated to version 2.0.10, which fixes two security issues where a malformed packet trace could cause it to go into an infinite loop, and fixes several other bugs as well. See the release notes for details...