Security Bulletin: Financial Transaction Manager for Corporate Payment Services for Multi-Platform is affected by a potential SQL Injection vulnerability CVE-2018-1819

Summary Financial Transaction Manager for Corporate Payment Services for Multi-Platform FTM CPS has addressed the following vulnerability: Potential SQL Injection CVE-2018-1819 Vulnerability Details CVEID: CVE-2018-1819 DESCRIPTION: IBM Financial Transaction Manager for Digital Payments for...

iWay Data Quality Suite Web Console 10.6.1.ga XML Injection

Exploit Title: iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20 a XML External Entity Injection Google Dork: N/A Date: 2018-09-27 Exploit Author: Sureshbabu Narvaneni Author Blog : https://nullnews.in Vendor Homepage: www.informationbuilders.co.uk Software Link:...

iWay Data Quality Suite Web Console 10.6.1.ga - XML External Entity Injection

Exploit Title: iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20 – XML External Entity Injection Google Dork: N/A Date: 2018-09-27 Exploit Author: Sureshbabu Narvaneni Author Blog : https://nullnews.in Vendor Homepage: www.informationbuilders.co.uk Software Link:...

iWay Data Quality Suite Web Console 10.6.1.ga - XML External Entity Injection

iWay Data Quality Suite Web Console 10.6.1.ga - XML External Entity Injection Exploit Title: iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20 – XML External Entity Injection Google Dork: N/A Date: 2018-09-27 Exploit Author: Sureshbabu Narvaneni Author Blog : https://nullnews.in Vendor...

iWay Data Quality Suite Web Console 10.6.1.ga - XML External Entity Injection Vulnerability

Exploit for windows platform in category web applications Exploit Title: iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20 – XML External Entity Injection Exploit Author: Sureshbabu Narvaneni Author Blog : https://nullnews.in Vendor Homepage: www.informationbuilders.co.uk Software Link:...

The vulnerability of web-based services of microprogramming software for programmable logic controllers from Schneider Electric—Modicon Premium, Modicon Quantum, and Modicon M340—allows a intruder to trigger a service failure.

The vulnerability of web-based services for microprogramming software-controlled Schneider Electric Modicon Premium, Modicon Quantum, and Modicon M340 devices lies in the fact that the operation data is stored outside of the buffer in memory. Exploiting this vulnerability allows a malicious actor...

DEBIAN-CVE-2018-15869

An Amazon Web Services AWS developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image A...

UBUNTU-CVE-2018-15869

An Amazon Web Services AWS developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image A...

cxf: Improper size validation in message attachment header for JAX-WS and JAX-RS services

Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service DoS attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack...

CVE-2018-8302

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka “Microsoft Exchange Memory Corruption Vulnerability.” This affects Microsoft Exchange Server. Recent assessments: zeroSteiner at March 20, 2020 1:04pm UTC...

Microsoft Edge Spoofing Vulnerability

A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could trick a user by redirecting the user to a specially crafted website. The specially crafted website could either spoof content or serve as a piv...

Microsoft Edge Spoofing Vulnerability

A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content. An attacker who successfully exploited this vulnerability could trick a user into believing that the user was on a legitimate website. The specially crafted website could either spoof content or serve as...

Cloudtoken Information Disclosure Vulnerability

Cloudtoken is a command line utility used in Unix environments to provide authentication capabilities. An information disclosure vulnerability exists in Cloudtoken versions 0.1.1 excluding version 0.1.1 through 0.1.24 excluding version 0.1.24, which can be exploited by an attacker to obtain...

PYSEC-2018-1

Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subnet to gain temporary AWS credentials for the users' roles...

CVE-2018-13390

Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subnet to gain temporary AWS credentials for the users' roles...

Qualys Cloud Platform 2.34 New Features

This release of the Qualys Cloud Platform version 2.34 includes updates and new features for Cloud Agent, EC2 Connector, Continuous Monitoring, Security Assessment Questionnaire, Web Application Scanning, and Web Application Firewall, highlights as follows. Cloud Agent Automatic Merge of Cloud...

The vulnerability of the WLS-Web Services component of the WebLogic Server application server allows a attacker to gain full control over the application.

The vulnerability of the WLS-Web Services component of the WebLogic Server application server is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full control over the application using the HTTP protocol...

USN-3718-1: Linux kernel regression

USN-3695-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. Unfortunately, the fix for CVE-2018-1108 introduced a regression where insufficient early entropy prevented services from starting, leading in some situations to a failure to boot, This update addresses the issue. We...

Oracle WebLogic Server Multiple Vulnerabilities (July 2018 CPU)

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - An unspecified vulnerability in the Spring Framework Sample Apps subcomponent in Oracle WebLogic allows an unauthenticated, remote attacker to takeover a WebLogic server. CVE-2018-1275 - ...

CVE-2018-2894

CVE-2018-2894 affects Oracle WebLogic Server (WLS - Web Services) in Oracle Fusion Middleware; vulnerable versions include 12.1.3.0, 12.2.1.2 and 12.2.1.3. The flaw enables unauthenticated, network-based attackers to execute code on the server via HTTP, potentially taking over the WebLogic Server...