CVE-2020-13183

Reflected Cross Site Scripting in Teradici PCoIP Management Console prior to 20.07 could allow an attacker to take over the user's active session if the user is exposed to a malicious payload...

CVE-2018-4062

A hard-coded credentials vulnerability exists in the snmpd function of the Sierra Wireless AirLink ES450 FW 4.9.3. Activating snmpd outside of the WebUI can cause the activation of the hard-coded credentials, resulting in the exposure of a privileged user. An attacker can activate snmpd without a...

The vulnerability of the Postgresql database management system in the Astra Linux operating system allows a perpetrator to gain access to confidential data and cause service interruptions.

The vulnerability of the Postgresql database management system in the Astra Linux operating system is related to an error in the interaction with LDAP via parsec calls when retrieving user security attributes. Exploiting this vulnerability allows a malicious actor to gain access to information...

zzcms SQL Injection Vulnerability (CNVD-2018-26017)

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A SQL injection vulnerability exists in the admin/specialadd.php file in ZZCMS version 8.3. A remote attacker can exploit this vulnerability to obtain the current user name of mysql with the help of zxbigclass...

CVE-2017-1481

IBM Sterling B2B Integrator Standard Edition 5.2 allows a user to view sensitive information that belongs to another user. IBM X-Force ID: 128619...

Threat Hunting for Dridex Attacks: Top Questions from Security Teams

Editor's Note: This article originally appeared on RedCanary.com. I recently spoke on a threat hunting webinar with our partner Carbon Black in which we dove into Dridex attacks: how they work, why they’re so effective, and how security teams can detect them through a proactive threat hunting...

CLI: Insecure default permissions on history file

It was found that the Command Line Interface, as provided by Red Hat Enterprise Application Platform, created a history file named .jboss-cli-history in the user's home directory with insecure default file permissions. This could allow a malicious local user to gain information otherwise not...

Trove: potential leak of passwords into log files

The strutils.maskpassword function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log...

Apache Rave User Exposure

CVE-2013-1814: Apache Rave exposes User over API Severity: Important Vendor: The Apache Software Foundation Versions Affected: Rave 0.11 to 0.20 Description: Rave returns the full user object, including the salted and hashed password, via the User RPC API. This endpoint is only available to...

JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing

twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments...

rhncfg: Insecure permissions used for /var/log/rhncfg-actions file

Red Hat Network RHN Configuration Client rhncfg-client in rhncfg before 5.10.27-8 uses weak permissions world-readable for /var/log/rhncfg-actions, which allows local users to obtain sensitive information about the rhncfg-client actions by reading the file...

ESPCMS pass to kill 0day-vulnerability warning-the black bar safety net

Baidu keywords:inurl:index. php? ac=article&at=read&did= =========================================================================================================== 默认 后台 :adminsoft/index.php OR admin...

How to Secure Web Apps Against XSS Flaws

As a security researcher, I regularly come across software vulnerabilities. Some can have a deep and lasting effect on the way customers and clients view the security of the organization and some can have a fairly minimal impact. However, when there are applications susceptible to a few basic typ...

Mozilla Firefox: Multiple vulnerabilities

Background Mozilla Firefox is a popular open-source web browser from the Mozilla Project. Description An anonymous researcher found evidence of memory corruption in the way Mozilla Firefox handles certain types of SVG comment DOM nodes. Additionally, Frederik Reiss discovered a heap-based buffer...

DEBIAN-CVE-2005-3147

StoreBackup before 1.19 creates the backup root with world-readable permissions, which allows local users to obtain sensitive information...

DEBIAN-CVE-2005-1855

Backup Manager backup-manager before 0.5.8 creates backup files with world-readable default permissions, which allows local users to obtain sensitive information...

[Full-disclosure] MSN Plus Password Change Security Bypass Vulnerability

Title: MSN Plus Password Change Security Bypass Vulnerability Risk: Medium Date: 07.04.2005 Publisher: m0fo editor at sec.org.il Source: http://sec.org.il/articles.php?a=187 Vendor: http://www.msgplus.net MSN Plus is additional application for the MSN Messenger. Msn Plus is adding a lot of option...

[Full-Disclosure] Trend Micro ActiveX Multiple Overflows

Systems affected: HouseCall Trend Micros Online virus scanning service and Damage Cleanup Server version 1.0 Some history: On 06/22/03 in the "Symantec ActiveX control buffer overflow" advisory i put the next at the bottom of it: --------------------------- Important note: I recomend antivirus...

CVE-2001-0465

CVE-2001-0465 relates to TurboTax saving passwords in a temporary file when a user imports investment tax information, potentially allowing local users to obtain sensitive data. The vulnerability stems from passwords being written to a temporary file accessible on the local system, enabling parti...