CVE-2018-1101

Ansible Tower, before version 3.2.4, has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization...

CVE-2018-1104: Improper Input Validation

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server...

CVE-2018-1101: Incorrect Privilege Assignment

Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrato...

tower-finance.com XSS vulnerability

Open Bug Bounty ID: OBB-590662 Description| Value ---|--- Affected Website:| tower-finance.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Important: Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update

An update is now available for CloudForms Management Engine 5.8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

onepiecetower.tokyo XSS vulnerability

Open Bug Bounty ID: OBB-570582 Description| Value ---|--- Affected Website:| onepiecetower.tokyo Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3583-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3583-1 advisory. It was discovered that an out-of-bounds write vulnerability existed in the Flash-Friendly File System f2fs in the Linux kernel. An attacker could constru...

USN-3583-1: Linux kernel vulnerabilities

It was discovered that an out-of-bounds write vulnerability existed in the Flash-Friendly File System f2fs in the Linux kernel. An attacker could construct a malicious file system that, when mounted, could cause a denial of service system crash or possibly execute arbitrary code. CVE-2017-0750 It...

UBUNTU-CVE-2017-15102

The towerprobe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users who are physically proximate for inserting a crafted USB device to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer...

Ansible Tower Arbitrary Command Execution Vulnerability

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage, and orchestrate computer systems.Ansible Tower a.k.a. Ansible UI is one of the task control applications that provides a user interface UI, dashboard, and REST API. An arbitrary command...

Tower: modification of git hooks in SCM repo via upstream playbook execution

A flaw was found in Tower's interface with SCM repositories. If a Tower project SCM repository definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that, when executed by Tower,...

Important: Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update

An update is now available for CloudForms Management Engine 5.8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

arp.de XSS vulnerability

Vulnerable URL: https://www.arp.de/lenovo-s510-10kw-002v-tower-pc-top-10kw002vge-5'%22%3E%3Cimg%20src=x%20onerror=alert'OPENBUGBOUNTY'%3E%3C!-- Details: Description| Value ---|--- Patched:| No Latest check for patch:| 14.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

CVE-2017-12148

A flaw was found in Tower's interface with SCM repositories. If a Tower project SCM repository definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that, when executed by Tower,...

Dell Precision Optimizer Local Privilege Escalation Vulnerability(CVE-2017-2802)

Summary An exploitable dll hijacking vulnerability exists in the poaService.exe service component of the Dell Precision Optimizer software version 3.5.5.0. A specifically named malicious dll file located in one of directories pointed to by the PATH environment variable will lead to privilege...

August 30, 2017 – Morning Cyber Coffee Headlines – “Eiffel Tower” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 30, 2017 - Headlines Carbon Black in the News: Carbon Black names Marco...

CVE-2017-7528

Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems using callback...

Vulnerability Spotlight: Dell Precision Optimizer and Invincea Vulnerabilities

Vulnerabilities discovered by Marcin ‘Icewall’ Noga of Cisco Talos.OverviewTalos are releasing advisories for vulnerabilities in the Dell Precision Optimizer application service software, Invincea-X and Invincea Dell Protected Workspace. These packages are pre-installed on certain Dell systems...

Petya in the end is what the Ghost-vulnerability warning-the black bar safety net

Late last month, German veteran security vendors Goethe Tower released a security report, the report pointed out the emergence of a named Petya in the new extortion Trojan. Then this new extortion Trojan the hell is going on? 0x01 Trojan overview The Trojan itself is actually technically is not...

Drop Stack Plus - Block Tower - Base64 encoded String, Exported ContentProvider, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Drop Stack Plus - Block Tower published at the 'play' market has multiple vulnerabilities...