Stored XSS Vulnerability in xycms Ad Design Center Web System

xycms advertising design center website system is to asp + access for the development of advertising company website. A stored XSS vulnerability exists in the xycms Advertising Design Center website system. The vulnerability stems from the program's failure to perform effective filtering. A remot...

CVE-2018-5461

An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. An inadequate encryption strength vulnerability in the web interface has been identified, which may allow an attacker to obtain sensiti...

Gemalto SafeNet Authentication Service TokenValidator Proxy Agent Elevation of Privilege Vulnerability

Gemalto SafeNet Authentication Service TokenValidator Proxy Agent is a proxy program from Gemalto USA. The program implements proxy authentication requests from other proxies to the SAS. A security vulnerability exists in the Gemalto SafeNet Authentication Service TokenValidator Proxy Agent that...

The vulnerability of microprogramming software in media devices. Valve’s Steam Link allows a intruder to gain access to the device.

The vulnerability of Valve’s Steam Link media controller software relates to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to gain access to the device with root privileges, using the IPv6 TCP port 22...

Code injection

SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module, a different vulnerability than CVE-2015-7965...

CVE-2015-7596

SafeNet Authentication Service End User Software Tools for Windows uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module...

The vulnerability of the quickTemplateSelect.xhtml component of the HPE Intelligent Management Center PLAT software platform allows a perpetrator to execute arbitrary code.

The vulnerability of the quickTemplateSelect.xhtml component in the HPE Intelligent Management Center PLAT software platform is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code using the beanName parameter...

OpenJDK: insufficient strength of key agreement (JCE, 8185292)

It was discovered that the key agreement implementations in the JCE component of OpenJDK did not guarantee sufficient strength of used keys to adequately protect generated shared secret. This could make it easier to break data encryption by attacking key agreement rather than the encryption using...

foreman: models with a 'belongs_to' association to an Organization do not verify association belongs to that Organization

It was found that foreman in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations...

The vulnerability of the MembersApp component of the SAP NetWeaver software integration platform allows a hacker to disclose user information.

The vulnerability of the MembersApp component of the SAP NetWeaver software integration platform is related to insufficient data protection. Exploiting this vulnerability allows a malicious actor to obtain user information such as listing user names by taking advantage of the temporary difference...

The vulnerability of Phoenix Contact FL SWITCH router microprogramming software, related to deficiencies in authentication procedures, allows a malicious actor to gain access to the device with administrator privileges.

The vulnerability of Phoenix Contact FL SWITCH router microprogramming software is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain administrator privileges through specially crafted HTTP requests...

The vulnerability of Phoenix Contact FL SWITCH router microprogramming software, related to deficiencies in authentication procedures, allows a intruder to access diagnostic information.

The vulnerability of Phoenix Contact FL SWITCH router microprogramming software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to remotely access diagnostic information by using the device’s monitoring mode...

CVE-2018-2376: Undefined Security Weakness

In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space...

Microsoft Intune App PIN Bypass

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: Microsoft Intune 1 Vendor: Microsoft CSNC ID: CSNC-2017-027 Subject: App PIN Bypass Risk: Medium Effect: Locally exploitable Author: Stephan Sekula Date: 31.08.2017 Introduction: ------------- Define a mobile...

LogicalDOC Enterprise 7.7.4 - User Enumeration

LogicalDOC Enterprise 7.7.4 - User Enumeration LogicalDOC Enterprise 7.7.4 Username Enumeration Weakness Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary: LogicalDOC is a free document management...

LogicalDOC Enterprise 7.7.4 - User Enumeration

LogicalDOC Enterprise 7.7.4 Username Enumeration Weakness Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary: LogicalDOC is a free document management system that is designed to handle and share...

LogicalDOC Enterprise 7.7.4 Username Enumeration Weakness

Summary LogicalDOC is a free document management system that is designed to handle and share documents within an organization. LogicalDOC is a content repository, with Lucene indexing, Activiti workflow, and a set of automatic import procedures. Description The weakness is caused due to the...

CVE-2018-1000048

NASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval functionality of RtRetrieval framework that can result in remote code execution. This attack appear to be exploitable via Victim tries to retrieve and process a weather data file...

Banknotes Misproduction security & biometric weakness

Document Title: =============== Banknotes Misproduction security & biometric weakness References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2105 Download: https://www.vulnerability-lab.com/resources/documents/7692342363856723534.rar Release Date: ============= 2018-01-29...

Banknotes Misproduction security & biometric weakness

Document Title: =============== Banknotes Misproduction security & biometric weakness References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2106 Video: https://www.youtube.com/watch?v=ORbU8fyhkgY Advisory: https://www.vulnerability-lab.com/getcontent.php?id=2105 Vulnerabilit...