11784 matches found
Debian DLA-1592-1 : otrs2 security update
Two security vulnerabilities were discovered in OTRS, a Ticket Request System, that may lead to privilege escalation or arbitrary file write. CVE-2018-19141 An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS...
PT-2018-3485 · Clusterlabs +5 · Pacemaker +5
Name of the Vulnerable Software and Affected Versions: Pacemaker versions up to and including 2.0.0 Description: A flaw was found in the way Pacemaker's client-server authentication was implemented, allowing a local attacker to achieve local privilege escalation by combining this flaw with other...
CVE-2018-7910
Some Huawei smartphones ALP-AL00B 8.0.0.118DC00, ALP-TL00B 8.0.0.118DC01, BLA-AL00B 8.0.0.118DC00, BLA-L09C 8.0.0.127C432, 8.0.0.128C432, 8.0.0.137C432, BLA-L29C 8.0.0.129C432, 8.0.0.137C432 have an authentication bypass vulnerability. When the attacker obtains the user's smartphone, the...
Authentication flaw
Some Huawei smartphones ALP-AL00B 8.0.0.118DC00, ALP-TL00B 8.0.0.118DC01, BLA-AL00B 8.0.0.118DC00, BLA-L09C 8.0.0.127C432, 8.0.0.128C432, 8.0.0.137C432, BLA-L29C 8.0.0.129C432, 8.0.0.137C432 have an authentication bypass vulnerability. When the attacker obtains the user's smartphone, the...
CVE-2018-7910
Some Huawei smartphones ALP-AL00B 8.0.0.118DC00, ALP-TL00B 8.0.0.118DC01, BLA-AL00B 8.0.0.118DC00, BLA-L09C 8.0.0.127C432, 8.0.0.128C432, 8.0.0.137C432, BLA-L29C 8.0.0.129C432, 8.0.0.137C432 have an authentication bypass vulnerability. When the attacker obtains the user's smartphone, the...
Security update for MozillaThunderbird (important)
This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues. Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25 and MFSA 2018-28. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading...
Command injection
An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. /mnt/mtd/boot.sh has 0777 permissions, allowing local users to control the commands executed at...
CVE-2018-19071
An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. /mnt/mtd/boot.sh has 0777 permissions, allowing local users to control the commands executed at...
CVE-2018-16840
A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the Curlclose function, the library code first frees a struct without nulling the pointer and might then subsequently...
Security update for MozillaThunderbird (important)
This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues. Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are...
tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up
If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not...
HPSBHF03593 rev. 2 - Firmware Trusted Platform Module (fTPM) for Select AMD Client Systems
Potential Security Impact Unauthorized access, elevation of privilege. Source: HP, HP Product Security Response Team PSRT Reported By: CTS-Labs VULNERABILITY SUMMARY A security vulnerability has been identified in specific versions of the AMD firmware-based Trusted Platform Module fTPM. The fTPM ...
Wildpwn - Unix Wildcard Attack Tool
Wildpwn is a Python UNIX wildcard attack tool that helps you generate attacks, based on a paper by Leon Juranic. It’s considered a fairly old-skool attack vector, but it still works quite often. First things first! Read: https://www.exploit-db.com/papers/33930/ Basic usage It goes something like...
CVE-2018-17012
An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services e.g., inetd, HTTP, DNS, and UPnP via long JSON data for hostsinfo setblockflag uplimit...
CVE-2018-2459
Users of an SAP Mobile Platform version 3.0 Offline OData application, which uses Offline OData-supplied delta tokens which is on by default, occasionally receive some data values of a different user...
CVE-2018-15678
An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting...
CVE-2018-15678
An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting...
Cross site scripting
An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting...