CVE-2019-6438: Undefined Security Weakness

SchedMD Slurm before 17.11.13 and 18.x before 18.08.5 mishandles 32-bit systems...

Fluid Core Oracle PeopleSoft Enterprise PeopleTools Unauthorized Access

The vulnerability of the Fluid Core component in the Oracle PeopleSoft Enterprise PeopleTools business application suite is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected data using the...

Enterprise Manager Base Platform Unauthorized Access

The vulnerability of the Enterprise Manager Base Platform EM Console software platform of Oracle Enterprise Manager is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected data using the...

Rukovoditel Project Management CRM 2.4.1 - lists_id SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Rukovoditel Project Management CRM 2.4.1 - 'listsid' SQL Injection Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.rukovoditel.net/ Software Link: https://sourceforge.net/projects/rukovoditel/ Version: 2.4.1 Categor...

Outside In Filters Component Unauthorized Access

The vulnerability of the Outside In Filters component within the Oracle Outside In Technology SDK is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to data or cause service failures using the HTTP protocol...

What is a vulnerability and what is not?

It looks like a pretty simple question. I used it to started my MIPT lecture. But actually the answer is not so obvious. There are lots of formal definitions of a vulnerability. For example in NIST Glossary there are 17 different definitions. The most popular one used in 13 documents is:...

Access and Security Component Unauthorized Access

The vulnerability of the Access and Security component of the Oracle Hyperion Data Relationship Management data management application relates to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected dat...

Outside In Oracle SDK DoS

The vulnerability of the Outside component in Oracle’s software development kit SDK is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to cause a service failure using the HTTP protocol...

Sun ZFS Storage Appliance Kit Object Store Full Control

The vulnerability of the Object Store component in the Sun ZFS Storage Appliance Kit is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain full control over the application...

Command Execution Vulnerability in HDCMS v2.0

HDCMS is a content management system software package developed in PHP+Mysql. It provides customers with powerful and complete functionality to accomplish rapid website development. A command execution vulnerability exists in HDCMS v2.0, which can be exploited by an attacker to gain control of a...

Bomb Threat, Sextortion Spammers Abused Weakness at GoDaddy.com

Two of the most disruptive and widely-received spam email campaigns over the past few months -- including an ongoing sextortion email scam and a bomb threat hoax that shut down dozens of schools, businesses and government buildings late last year -- were made possible thanks to an authentication...

ManageEngine OpManager 12.3 Privilege Escalation

ManageEngine OpManager Privilege Escalation Vendor: Zoho Corporation Pvt. Ltd. Product web page: https://www.manageengine.com Affected version: 12.3 Summary: OpManager offers comprehensive network monitoring capabilities that help you monitor network performance, detect network faults in real tim...

D-Link Central WiFi Manager SSRF

The vulnerability of the MailConnect function in the D-Link Central WiFi Manager software control panel exists due to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

CVE-2018-5915: Undefined Security Weakness

Exception in Modem IP stack while processing IPv6 packet in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660,...

CVE-2019-6440: Undefined Security Weakness

Zemana AntiMalware before 3.0.658 Beta mishandles update logic...

Streamworks Job Scheduler Release 7 Authentication Weakness

Affected Products Streamworks Job Scheduler Release 7 older/newer releases have not been tested References Secuvera-SA-2016-01 https://www.secuvera.de/advisories/secuvera-SA-2016-01.txt used for updates No CVE number could be assigned vendor not listed under...

CVE-2018-4181: Undefined Security Weakness

In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions...

Exchange Outlook Web Access Disclosure

The vulnerability of the Exchange Outlook Web Access OWA component of the Microsoft Exchange Server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to disclose sensitive information by sending a specially crafted email message to the user,...

Microsoft Exchange Server MFC Code Execution

The vulnerability of the Microsoft Foundation Classes MFC in the Microsoft Exchange Server mail server is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Design/Logic Flaw

A security weakness in SAP Financial Consolidation Cube Designer BOBJEADES fixed in versions 8.0, 10.1 may allow an attacker to discover the password hash of an admin user...