SUSE SLED15 / SLES15 Security Update : ucode-intel (SUSE-SU-2019:0712-1)

This update for ucode-intel fixes the following issues : Updated to the 20190312 bundle release bsc1129231 New Platforms : AML-Y22 H0 6-8e-9/10 0000009e Core Gen8 Mobile WHL-U W0 6-8e-b/d0 000000a4 Core Gen8 Mobile WHL-U V0 6-8e-d/94 000000b2 Core Gen8 Mobile CFL-S P0 6-9e-c/22 000000a2 Core Gen9...

Description of the security update for the information disclosure vulnerability in Windows Embedded POSReady 2009: March 12, 2019

Description of the security update for the information disclosure vulnerability in Windows Embedded POSReady 2009: March 12, 2019 Summary An information disclosure vulnerability exists when the Windows Print Spooler does not properly handle objects in memory. To learn more about the vulnerability...

Cloud replica failover fails after upgrade to Veeam Backup & Replication 9.5 Update 4

Challenge After upgrade to Veeam Backup & Replication 9.5 Update 4, starting failover for a Cloud Connect replica in the VMware environment fails with the appliance related error message: Timed out waiting to obtain helper appliance VM IP address Cause Due to a newly introduced issue, the applian...

AVEVA Wonderware System Platform

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Low skill level to exploit Vendor: AVEVA Equipment: Wonderware System Platform Vulnerability: Insufficiently Protected Credentials 2. RISK EVALUATION This vulnerability could allow unauthorized access to the credentials for the ArchestrA Network User...

Authorization Bypass In The InvokeNextValue Function

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...

FreeBSD : shibboleth-sp -- crashes on malformed date/time content (4f8665d0-0465-11e9-b77a-6cc21735f730)

The Shibboleth Consortium reports : SAML messages, assertions, and metadata all commonly contain date/time information in a standard XML format. Invalid formatted data in such fields cause an exception of a type that was not handled properly in the V3 software and causes a crash usually to the...

shibboleth-sp -- crashes on malformed date/time content

The Shibboleth Consortium reports: SAML messages, assertions, and metadata all commonly contain date/time information in a standard XML format. Invalid formatted data in such fields cause an exception of a type that was not handled properly in the V3 software and causes a crash usually to the shi...

CVE-2018-17948

An open redirect vulnerability exists in the Access Manager Identity Provider prior to 4.4 SP3...

Eaton UPS 9PX 8000 SP Password Disclosure Vulnerability (CNVD-2019-22860)

The Eaton UPS 9PX 8000 SP is a power management device from Eaton USA. The Eaton UPS 9PX 8000 SP suffers from a password disclosure vulnerability that originates from a web page displayed by the device containing a clear-text password, which can be retrieved by an attacker by browsing the source...

CVE-2018-9279

CVE-2018-9279 affects Eaton UPS 9PX 8000 SP devices. The web UI exposes the user password in cleartext and the password can be retrieved by inspecting the page source. Multiple sources (NVD/NES plugins, CNVD) describe this disclosure vulnerability. The connected documents do not provide a remedia...

CVE-2018-9281

Eaton UPS 9PX 8000 SP product is affected by CVE-2018-9281, which involves a CSRF vulnerability in the change-password functionality that can force a logged-in administrator to silently update the password. The same flaw also enables Reflected Cross-Site Scripting in affected forms, potentially e...

sp-ark.org XSS vulnerability

Open Bug Bounty ID: OBB-686390 Description| Value ---|--- Affected Website:| sp-ark.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

RICOH SP 4510SF Cross-Site Scripting Vulnerability

The RICOH SP 4510SF is a multifunction printer device from Ricoh Japan. A cross-site scripting vulnerability exists in the address addition area of the RICOH SP 4510SF, which arises from the program failing to properly validate user-submitted input. An attacker can exploit this vulnerability by...

HPSBHF03595 rev. 6 - LoJax UEFI Rootkit

Potential Security Impact Elevation of Privilege, Information Disclosure, Loss of Confidentiality, Loss of Integrity. Source: HP, HP Product Security Response Team PSRT Reported by: ESET Research VULNERABILITY SUMMARY HP has identified a potential security vulnerability with a UEFI rootkit LoJax...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2018-19871)

DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /plus/feedbackajax.php file in DedeCMS version 5.7 SP2, which can be exploited by remote attackers to execute JavaScript code with the help of the onhashchange attribute in the 'msg'...

camarasaltinho.sp.gov.br XSS vulnerability

Open Bug Bounty ID: OBB-679277 Description| Value ---|--- Affected Website:| camarasaltinho.sp.gov.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-17001

On the RICOH SP 4510SF printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

Cross site scripting

On the RICOH SP 4510SF printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

CVE-2018-17001

On the RICOH SP 4510SF printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi...

CVE-2018-17001

The CVE-2018-17001 entry concerns the Ricoh SP 4510SF printer with HTML Injection and Stored XSS in the web UI. Specifically, the vulnerability arises in the address-adding workflow via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi, where insufficient input validation e...