1774 matches found
CVE-2019-5725: Server-Side Request Forgery (SSRF)
qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file...
PT-2018-15321 · Igraph +1 · Igraph +1
Name of the Vulnerable Software and Affected Versions: igraph versions through 0.7.1 Description: The issue is related to a NULL pointer dereference in the igraph i strdiff function within igraph trie.c, which can be exploited by attackers to cause a denial of service, resulting in an application...
Step 1. Identify users: top 10 actions to secure your environment
This series outlines the most fundamental steps you can take with your investment in Microsoft 365 security solutions. Well provide advice on activities such as setting up identity management through active directory, malware protection, and more. In this post, we explain how to create a single...
CVE-2018-19557
An issue was discovered in arcms through 2018-03-19. No authentication is required for index/main, user/useradd, or img/images...
PT-2018-3492 · Twisted Matrix Laboratories +3 · Twisted +3
Name of the Vulnerable Software and Affected Versions: Twisted versions through 19.2.1 Description: The issue is related to the XMPP support in the words.protocols.jabber.xmlstream module of the Twisted network framework, which did not verify certificates when used with TLS. This allows an attack...
tomcat: A bug in the UTF-8 decoder can lead to DoS
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86...
CVE-2018-16738: Improper Authentication
tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1...
PT-2018-14219 · Google · Html Package
Name of the Vulnerable Software and Affected Versions: html package aka x/net/html versions through 2018-09-25 Description: The issue is related to the html package mishandling certain HTML inputs, such as , leading to a "panic: runtime error" index out of range in nodeStack.pop or...
Emerson AMS Device Manager Code Execution Vulnerability
Emerson Electric AMS Device Manager is a fixed asset management software from Emerson Electric. The software provides predictive diagnostics, device configuration management, and other features. A code execution vulnerability exists in Emerson Electric AMS Device Manager versions 12.0 through 13....
Brave Software: RCE: DnDing shortcut files to chrome://brave allows loading HTML files in Muon's context
Summary: \395737 has shown that Brave supports chrome://brave/ URLs. The Brave team introduced a patch which blocks navigation to chrome://brave and removed chrome.remote.require to prevent command execution on the machine. Navigation to chrome://brave via shortcut files From my understanding: 1...
Assessing the security of a portable router: a look inside its hardware
Network administrators should perform security assessments of hardware that they will provide their users, or particularly paranoid users might want to poke at their devices just to be extra sure. In this blog post, we will demonstrate the techniques used to assess security on a generic portable...
CVE-2018-1000635
The Open Microscopy Environment OMERO.server version 5.4.0 to 5.4.6 contains a Information Exposure Through Sent Data vulnerability in OMERO.server that can result in an Attacker gaining full administrative access to server and may be able to disable it. This vulnerability appears to have been...
CVE-2018-14982: Incorrect Permission Assignment for Critical Resource
Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application. The LG ID is LVE-SMP-180004...
CVE-2018-14981: Incorrect Permission Assignment for Critical Resource
Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents. The LG ID is LVE-SMP-180005...
PT-2018-12824
Name of the Vulnerable Software and Affected Versions dilawar sound through 2017-11-27 Description The issue is related to Mismatched Memory Management Routines, specifically the use of operator new versus operator delete in the end of openWavFile in wav-file.cc. Recommendations For dilawar sound...
CVE-2018-14743
An issue was discovered in libpbc.a in cloudwu PBC through 2017-03-02. A SEGV can occur in wiretypedecode in context.c...
CVE-2018-2967
Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite subcomponent: Core. Supported versions that are affected are 16.x, 17.x and 18.x. Easily exploitable vulnerability allows physical access to compromise Primavera Unifier. While the vulnerability is in...
FTP2FTP 1.0 - Arbitrary File Download
FTP2FTP 1.0 - Arbitrary File Download Exploit Title: FTP2FTP 1.0 - Arbitrary File Download Dork: N/A Date: 18.07.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/ftp2ftp-server-to-server-file-transfer-php-script/21972395 Version: 1.0 Category: Webapps...