SAP NetWeaver AS JAVA 7.4 XXE Injection

Application: SAP NetWeaver AS JAVA Versions Affected: SAP NetWeaver AS JAVA 7.4 Vendor URL: http://SAP.com Bug: XXE Sent: 04.12.2015 Reported: 05.12.2015 Vendor response: 05.12.2015 Date of Public Advisory: 12.04.2016 Reference: SAP Security Note 2254389 Author: Vahagn Vardanyan ERPScan Descripti...

Sam Pfanstiel Appointed Director, Solution Architecture for Payments

Coalfire today announced Sam Pfanstiel has joined the company as the Director of Solution Architecture for Payments. Pfanstiels experience spans solution engineering and consulting as well as research and development positions...

GSX Analyzer 10.12 / 11 Backdoor Account

Exploit Title: GSX Analyzer hardcoded superadmin credentials in Main.swf Google Dork: inurl:"/Main.swf?cachebuster=" need to manually look for stringtitle "Loading GSX Analyzer ... 0%" Date: 12-07-16 Exploit Author: ndevnull Vendor Homepage: http://www.gsx.com/products/gsx-analyzer Software Link:...

Apache Archiva 1.3.9 - Multiple Cross-Site Request Forgery Vulnerabilities

Apache Archiva 1.3.9 - Multiple Cross-Site Request Forgery Vulnerabilities RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Apache Archiva Vendor URL: https://archiva.apache.org Type: Cross-Site Request Forgery CWE-253 Date found: 2016-05-...

GSX Analyzer 10.1211 - main.swf Hard-Coded Superadmin Credentials

GSX Analyzer 10.1211 - main.swf Hard-Coded Superadmin Credentials Exploit Title: GSX Analyzer hardcoded superadmin credentials in Main.swf Google Dork: inurl:"/Main.swf?cachebuster=" need to manually look for stringtitle "Loading GSX Analyzer ... 0%" Date: 12-07-16 Exploit Author: ndevnull Vendor...

Microsoft Windows Excel Viewer Remote Code Execution Vulnerability (3170008)

This host is missing an important security update according to Microsoft Bulletin MS16-088. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2016-5850

Cross-site scripting XSS vulnerability in the volume backup service module in Huawei Public Cloud Solution before 1.0.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-5850

CVE-2016-5850 affects Huawei Public Cloud Solution (volume backup service module) prior to 1.0.5. The vulnerability is an XSS issue exploitable by remote authenticated users via unspecified vectors to inject scripts/HTML; advisory HWPSIRT-2016-06017 notes updates to fix the problem. If exploited,...

CVE-2016-5850

Cross-site scripting XSS vulnerability in the volume backup service module in Huawei Public Cloud Solution before 1.0.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

MS16-090: Description of the security update for Windows kernel-mode drivers: July 12, 2016

None None...

Internet Explorer help

None None...

Apache Archiva 1.3.9 Cross Site Request Forgery

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Apache Archiva Vendor URL: https://archiva.apache.org Type: Cross-Site Request Forgery CWE-253 Date found: 2016-05-31 Date published: 2016-07-11 CVSSv3 Score: 5.4...

F5 Networks BIG-IP : GraphicsMagick vulnerability (K82747025)

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | pipe character at the start of a filename. CVE-2016-5118 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Path traversal with SaveDir and UploadDir

PMASA-2016-37 Announcement-ID: PMASA-2016-37 Date: 2016-07-12 Summary Path traversal with SaveDir and UploadDir Description A vulnerability was reported with the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a...

Tiki Wiki CMS 15.0 - Arbitrary File Download

Exploit for php platform in category web applications Exploit Title: Tiki Wiki CMS 15.0 Arbitrary File Download Date: 11-07-2016 Software Link: https://tiki.org Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1...

Fedora Update for mingw-xerces-c FEDORA-2016-87e8468465

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the client system in the VMware Horizon View Client virtualization solution allows users of the guest operating system to trigger a service failure for the host operating system.

The vulnerability of the TPView.dll library in the VMware Horizon View Client virtualization solution is related to resource management errors. Exploiting this vulnerability can allow users of the guest operating system to cause failures in the host operating system...

OpenDocMan v1.3.5 - Full Path Disclosure Vulnerability

Document Title: =============== OpenDocMan v1.3.5 - Full Path Disclosure Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1868 Release Date: ============= 2016-07-03 Vulnerability Laboratory ID VL-ID: ==================================== 186...

Lenovo Solution Center Arbitrary Code Execution Vulnerability

Lenovo Solution Center LSC is a suite of software from the Chinese company Lenovo that helps users quickly identify the state of system health, network connectivity and overall system security. An arbitrary code execution vulnerability exists in LSC versions prior to 3.3.003. An attacker can...

Lenovo Solution Center Local Elevation of Privilege Vulnerability

Lenovo Solution Center LSC is a suite of software from the Chinese company Lenovo that helps users quickly identify the state of system health, network connectivity and overall system security. A local elevation of privilege vulnerability exists in versions prior to LSC 3.3.003. A local attacker...