Input validation

A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18...

CVE-2017-1000016

A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18...

CVE-2017-1000016

Summary (from provided sources): CVE-2017-1000016 describes a cookie attribute injection weakness in phpMyAdmin, allowing an attacker to inject arbitrary values into browser cookies. The CVE is described as a re-issue of an incomplete fix from PMASA-2016-18. Connected advisories reference phpMyAd...

CVE-2017-1000013

phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness...

CVE-2017-1000014

phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality...

CVE-2017-1000017

CVE-2017-1000017 affects phpMyAdmin 4.0, 4.4 and 4.6. A user with appropriate permissions can connect to an arbitrary MySQL server, indicating a serious exposure for affected deployments. The entry includes CVSS details (v3: 8.8, HIGH) from NVD, with network attack vector and no user interaction ...

CVE-2017-1000014

phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality...

CVE-2017-1000016

A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18...

Reflective Cross-site Scripting Vulnerability in Empire Web Management System

Empire Website Management System is a content management system based on php+mysql. A cross-site scripting vulnerability exists in the Empire Website Management System due to the system failing to perform strict filtering of strings. An attacker can exploit this vulnerability to perform cross-sit...

The vulnerability of the Microsoft Office suite and Skype for Business messaging software allows a perpetrator to execute arbitrary code.

The vulnerability of the Microsoft Office suite and the Skype for Business messaging application exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially crafted content...

HP SiteScope Multiple Vulnerabilities (HPESBGN03763)

The version of HP SiteScope running on the remote host is 11.2x or 11.3x. It is, therefore, affected by multiple vulnerabilities : - A cryptographic weakness exists in the sspu.jar library due to the use of hard-coded encryption keys. A local attacker can exploit this to disclose potentially...

WakaTime: Password Policy Issue

Greetings Wakatime, I just found a weak password policy in your login page. Some websites prevents the users to use password constructed of character combinations that otherwise meet company policy, but should no longer be used because they have been deemed insecure for one or more reasons, such ...

CVE-2017-7905

A Weak Cryptography for Passwords issue was discovered in General Electric GE Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 469 Motor Protection Relay, firmware versions prior to Versio...

Design/Logic Flaw

A Violation of Secure Design Principles issue was discovered in Schneider Electric Modicon Modbus Protocol. The Modicon Modbus protocol has a session-related weakness making it susceptible to brute-force attacks...

CVE-2017-6032

A Violation of Secure Design Principles issue was discovered in Schneider Electric Modicon Modbus Protocol. The Modicon Modbus protocol has a session-related weakness making it susceptible to brute-force attacks...

CVE-2017-6032

A Violation of Secure Design Principles issue was discovered in Schneider Electric Modicon Modbus Protocol. The Modicon Modbus protocol has a session-related weakness making it susceptible to brute-force attacks...

Intel Active Management Technology (AMT) Web UI Clickjacking Weakness (INTEL-SA-00081) (remote check)

The Intel Management Engine on the remote host has Active Management Technology AMT enabled, and according to its self-reported version in the banner, it is running Intel manageability firmware version 9.0.x or 9.1.x prior to 9.1.40.1000, 9.5.x prior to 9.5.60.1952, 10.0.x prior to 10.0.50.1004,...

Telerik UI for ASP.NET AJAX Cryptographic Weakness

The version of Telerik UI for ASP.NET AJAX installed on the remote Windows host is affected by a cryptographic weakness in Telerik.Web.UI.dll. An unauthenticated, remote attacker can exploit this, via specially crafted data, to disclose encryption keys. %NASLMINLEVEL 70300 C Tenable Network...

The vulnerability of the SAP HANA database management system allows a hacker to execute arbitrary code.

The vulnerability of the SAP HANA database management system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, using vectors that include audit logs. This is referred to as SAP Security Note 2170806...

AgileBits 1Password 6.3.3 Multiple Vulnerabilities

The version of AgileBits 1Password installed on the remote Windows host is equal or prior to 6.3.3. It is, therefore, affected by multiple vulnerabilities : - A security weakness exists in the internal web browser in which the default protocol that is used is set to HTTP. If a user visits a websi...