uTorrent Users Warned of Remote Code Execution Vulnerability

Google Project Zero researchers are warning of two critical remote code execution vulnerabilities in popular versions of BitTorrent’s web-based uTorrent Web client and its uTorrent Classic desktop client. According to researchers, the flaws allow a hacker to either plant malware on a user’s...

CVE-2018-2364

SAP CRM WebClient UI 7.01, 7.31, 7.46, 7.47, 7.48, 8.00, 8.01, S4FND 1.02, does not sufficiently validate and/or encode hidden fields, resulting in Cross-Site Scripting XSS vulnerability...

Remote code execution

Remote Code Execution in Saperion Web Client version 7.5.2 83166...

CVE-2018-6292

Remote Code Execution in Saperion Web Client version 7.5.2 83166...

CVE-2018-6292

Remote Code Execution in Saperion Web Client version 7.5.2 83166...

CVE-2018-6293

Arbitrary File Read in Saperion Web Client version 7.5.2 83166...

Design/Logic Flaw

Arbitrary File Read in Saperion Web Client version 7.5.2 83166...

CVE-2018-6293

Arbitrary File Read in Saperion Web Client version 7.5.2 83166...

CVE-2018-6293

Hyland Saperion Web Client (v7.5.2 83166) contains an Arbitrary File Read vulnerability. The CVE-2018-6293 entry is supported by multiple connected documents (e.g., CNVD and NVD) that describe information disclosure via reading arbitrary files. CVSS metrics indicate Confidentiality impact HIGH (C...

CVE-2018-6292

CVE-2018-6292 affects Saperion Web Client version 7.5.2 (build 83166). The NVD entry documents a Remote Code Execution with network attack vector, low complexity, no privileges required, and no user interaction, leading to high impact on confidentiality, integrity, and availability. CVSSv3.0 base...

CVE-2018-6292

Remote Code Execution in Saperion Web Client version 7.5.2 83166...

CVE-2018-6293

Arbitrary File Read in Saperion Web Client version 7.5.2 83166...

Nokia VitalQIP Web Client Detection

Binary data vitalqipwebclientdetect.nbin...

VMware Issues 3 Critical Patches for vSphere Data Protection

VMware, a Dell Technologies subsidiary, released several patches Tuesday fixing critical vulnerabilities affecting its vSphere cloud computing virtualization platform. The bugs address three vulnerabilities in VMware’s vSphere Data Protection VDP, a backup and recovery solution used with its...

OpenJDK: improper re-use of NTLM authenticated connections (Networking, 8163520)

It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with...

OpenJDK: HTTP client insufficient check for newline in URLs (Networking, 8176751)

It was found that the HttpURLConnection and HttpsURLConnection classes in the Networking component of OpenJDK failed to check for newline characters embedded in URLs. An attacker able to make a Java application perform an HTTP request using an attacker provided URL could possibly inject additiona...

CVE-2017-4928

The flash-based vSphere Web Client 6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers toward...

Server side request forgery (ssrf)

The flash-based vSphere Web Client 6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers toward...

CVE-2017-4928

The flash-based vSphere Web Client 6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f i.e. not the new HTML5-based vSphere Client, contains SSRF and CRLF injection issues due to improper neutralization of URLs. An attacker may exploit these issues by sending a POST request with modified headers toward...

CVE-2017-4928

CVE-2017-4928 affects the Flash-based vSphere Web Client (not the HTML5 client). The issue stems from improper neutralization of URLs, enabling SSRF and CRLF injection that could allow an attacker to send a crafted POST request towards internal services and disclose information. Affected VMware p...