people.cs.kuleuven.be XSS vulnerability

Open Bug Bounty ID: OBB-607450 Description| Value ---|--- Affected Website:| people.cs.kuleuven.be Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

phpLiteAdmin Authentication Bypass Vulnerability

phpLiteAdmin is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PRTG Network Monitor < 18.1.39.1648 Stack Overflow Vulnerability

PRTG Network Monitor is prone to a stack overflow vulnerability which results in a denial of service DoS condition. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Ericson-LG iPECS NMS Authentication Bypass Vulnerability

The Ericsson-LG iPECS NMS is a network management solution from Ericson-LG in Korea. A security vulnerability exists in the web application in Ericsson-LG iPECS NMS version A.1Ac, which stems from the program using an incorrect access control mechanism. An attacker could exploit the vulnerability...

Atlassian JIRA < 4.2.1 Multiple Vulnerabilities

According to its self-reported version number, the version of Atlassian JIRA hosted on the remote web server is prior to 4.2.1. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported...

CVE-2018-10285

The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since the app does not use any sort of session ID, an attacker might bypass authentication...

Authentication flaw

The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since the app does not use any sort of session ID, an attacker might bypass authentication...

CVE-2018-10286

The CVE-2018-10286 case involves Ericsson-LG iPECS NMS A.1Ac Web App. It discloses sensitive data (NMS admin credentials and PostgreSQL credentials) to logged-in users via HTTP POST responses. Affected component: web application; root cause: credentials exposed in responses to authenticated reque...

CVE-2018-10285

CVE-2018-10285 affects the Ericsson-LG iPECS NMS A.1Ac web application. The root cause is incorrect access control: the app does not use a session ID, allowing an attacker to bypass authentication. Public details reference credential disclosure and exploitation attempts (cleartext credentials) in...

Addressing the Availability of the ACAEngine

In my experience as a Solutions Engineer, I've seen many companies strive for 100% uptime of enterprise applications. However, this is a goal that cannot happen by itself. Careful thought must be put into the underlying architecture that delivers these critical enterprise applications. Recently,...

Sensitive File Disclosure (HTTP)

The script attempts to identify files containing sensitive data at the remote web server. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Oracle E-Business Multiple Vulnerabilities (April 2018 CPU)

The version of Oracle E-Business installed on the remote host is missing the April 2018 Oracle Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities as noted in the April 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for...

Remote file inclusion

DISPUTED Glastopf 3.1.3-dev has SSRF, as demonstrated by the abc.php a parameter. NOTE: the vendor indicates that this is intentional behavior because the product is a web application honeypot, and modules/handlers/emulators/rfi.py supports Remote File Inclusion emulation...

CVE-2018-10220

Glastopf 3.1.3-dev has SSRF, as demonstrated by the abc.php a parameter. NOTE: the vendor indicates that this is intentional behavior because the product is a web application honeypot, and modules/handlers/emulators/rfi.py supports Remote File Inclusion emulation...

CVE-2018-10220

Glastopf 3.1.3-dev has a Server-Side Request Forgery (SSRF) vulnerability demonstrated via the abc.php?a parameter. The vendor states this behavior is intentional because Glastopf is a web application honeypot, and the distribution includes modules/emulators/rfi.py for Remote File Inclusion emula...

SAP BPC Web Application Information Disclosure Vulnerability

Talos Vulnerability Report SAP SAP BPC Web Application Information Disclosure Vulnerability April 19, 2018 CVE Number CVE-2017-16349 Summary An exploitable XML external entity vulnerability exists in the reporting functionality of SAP BPC. A specially crafted XML request can cause an XML external...

Drupal Cross Site Scripting Vulnerability (SA-CORE-2018-003) - Windows

Drupal is prone to a cross-site scripting XSS vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

ManageEngine Desktop Central <= 10.0.184 Multiple Vulnerabilities

ManageEngine Desktop Central is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Multiple TIBCO Products Spring web flows Component Information Disclosure Vulnerability

TIBCO JasperReports Server and so on are the products of the United States TIBCO Software Corporation.TIBCO JasperReports Server is a report generation and editing tools for the server version , TIBCO JasperReports Server Community Edition is its community edition. Spring web flows is one of the...

Seagate Personal Cloud SRN21C Arbitrary File Move

------------------------------------------------------------------------ Seagate Personal Cloud allows moving of arbitrary files ------------------------------------------------------------------------ Yorick Koster, September 2017...