CVE-2019-6267

The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log viewing at the templates/admin/redirect-log.php URI...

CVE-2018-12306

Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1" URL parameter, a similar issue to CVE-2018-11344...

Intel (Skylake Kaby Lake) - PortSmash CPU SMT Side-Channel

Intel Skylake Kaby Lake - PortSmash CPU SMT Side-Channel Summary This is a proof-of-concept exploit of the PortSmash microarchitecture attack, tracked by CVE-2018-5407. Setup Prerequisites A CPU featuring SMT e.g. Hyper-Threading is the only requirement. This exploit code should work out of the b...

Cisco Umbrella API Unauthorized Access Vulnerability

Cisco Umbrella is a cloud security platform. An unauthorized access vulnerability exists in the Cisco Umbrella API due to insufficient authentication configuration of Cisco Umbrella's API interface, which allows an authenticated, remote attacker to view and modify data in his or her organization...

CVE-2018-2442

Summary of CVE-2018-2442 : In SAP BusinessObjects BI (versions 4.0–4.2), viewing a Web Intelligence report from BI Launchpad can reveal session details captured by an HTTP analysis tool, which may be reused in an HTML page while the user session remains valid. This describes a cross‑site request ...

VK.com: Получение БД кэша из Android-приложения через стороннее приложение

Просмотр кэша приложения на Android...

MyBB Group MyBB Access Control Error Vulnerability

MyBB aka MyBulletinBoard is a free and web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. An access control error vulnerability exists in the private forums in MyBB Group MyBB. The...

CVE-2018-12909

Webgrind

MemoCGI vulnerable to directory traversal

Overview MemoCGI provided by ChamaNet contains a directory traversal vulnerability CWE-22. Ikuo Shoji reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A remote attacker may view files on the server. Solution...

Microsoft Windows: Service: Problem Reports and Solutions Control Panel Support

The service SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.109268";...

Octopus Deploy Information Disclosure Vulnerability (CNVD-2018-11359)

Octopus Deploy is an automation tool for the development and deployment of .NET, Java and other applications from Octopus Deploy Australia. A security vulnerability exists in Octopus Deploy versions 2018.5.1 through 2018.5.7. An attacker could use the vulnerability to view passwords...

Path traversal

serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e . and %2f / and allowing them in paths, which allows a malicious user to view the contents of any directory with known path...

Cybozu Garoon Browsing Restriction Bypass Vulnerability

Cybozu Garoon is an office software with Chinese, Japanese, and English languages. A browsing restriction bypass vulnerability exists in the application "Space" in Cybozu Garoon 4.0.0 through 4.6.0. The vulnerability can be exploited by users who can log in to the product to view the closed...

CVE-2017-1705

IBM Security Privileged Identity Manager 2.1.0 contains left-over, sensitive information in page comments. While this information is not visible at first it can be obtained by viewing the page source. IBM X-Force ID: 134427...

[SECURITY] Fedora 28 Update: kst-2.0.8-20.fc28

Kst is a real-time data viewing and plotting tool with basic data analysis functionality. Kst contains many powerful built-in features and is expandable with plugins and extensions. Main features of kst include: Robust plotting of live "streaming" data. Powerful keyboard and mouse plot...

DLINK DCS-5020L - Remote Code Execution (PoC)

DLINK DCS-5020L - Remote Code Execution PoC “The DCS-5020L Wireless N Day & Night Pan/Tilt Cloud Camera is a day/night network camera that easily connects to your existing home network for remote viewing on a range of mobile devices. It features pan, tilt and digital zoom function to allow you to...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2018-07085)

Mozilla Firefox browser Firefox is a free, open source browser for Windows, Linux and MacOSX platforms. An information disclosure vulnerability exists in a legacy extension in Mozilla Firefox. A remote user can send a specially crafted request to exploit the vulnerability to view potentially...

Drupal Information Disclosure Vulnerability (CNVD-2018-05187)

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security vulnerability exists in Drupal version 8.4.x prior to 8.4.5. An attacker could use the vulnerability to view content and comments that require permissions, and...

foreman: inside discovery-debug, the root password is displayed in plaintext

A flaw was found in discovery-debug in foreman. An attacker, with permissions to view the debug results, would be able to view the root password associated with that system, potentially allowing them to access it...

CVE-2018-0105

A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables. An attacker could exploit this vulnerability by browsing to a specific URL. ...