CVE-2019-0241

The CVE concerns SAP Work and Inventory Manager (Agentry_SDK, before 7.0 and 7.1). The issue is a denial of service: an attacker can cause legitimate users to be unable to access a service by crashing or flooding it. The description does not specify the exact root cause or vulnerable component be...

CVE-2019-0241

SAP Work and Inventory Manager AgentrySDK , before 7.0, 7.1 allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...

CVE-2019-0241: Undefined Security Weakness

SAP Work and Inventory Manager AgentrySDK , before 7.0, 7.1 allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...

CVE-2018-19505

Remedy AR System Server in BMC Remedy 7.1 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the identity of a different user, because userdata.js in the WOI:WorkOrderConsole component allows a username substitution involving a...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale where the use of Local Read Only Cache (LROC) may result in directory corruption and undetected data corruption in regular files.

Summary After cached data is moved from memory to the LROC device, any changes to that data should trigger invalidation of the data stored in LROC. Due to a problem with invalidation logic, it is possible for invalidation of this LROC data to be skipped. This could lead to stale or incorrect data...

CVE-2018-16875

The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients a...

biggreenpurseatwork.com XSS vulnerability

Open Bug Bounty ID: OBB-705329 Description| Value ---|--- Affected Website:| biggreenpurseatwork.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

webERP Manufacturing Component SQL Injection Vulnerability

webERP is an open source inventory and financial management system ERP system. The system supports inventory management , rights role management , order management and financial management , etc. Manufacturing is one of the components . webERP 4.15 version of the Manufacturing component of the...

Heap Feng Shader: Exploiting SwiftShader in Chrome

Posted by Mark Brand, Google Project Zero On the majority of systems, under normal conditions, SwiftShader will never be used by Chrome - it’s used as a fallback if you have a known-bad “blacklisted” graphics card or driver. However, Chrome can also decide at runtime that your graphics driver is...

Workplace violence: the forgotten insider threat

Organizations are no stranger to insider threats. In fact, for those who have been around long before the Internet, workplace violence, alongside spying is a problem many businesses have seen before and sought to address. However, the adoption and use of the Internet completely changed the way...

Hardcoded credentials

Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The affected controllers utilize hard-coded credentials which may allow an attacker gain unauthorized access to the maintenance functions and obtain or modify information. This attack can be executed only...

seikoarchitecturalwall.com.sg XSS vulnerability

Open Bug Bounty ID: OBB-664522 Description| Value ---|--- Affected Website:| seikoarchitecturalwall.com.sg Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

What I expect from IT Asset Inventory

The main problem of vulnerability management, in my opinion, is that it is not always clear whether we know about ALL network hosts existing in our infrastructure or not. So, not the actual process of scanning and the detection of vulnerabilities, but the lack of knowledge what we should scan...

Phishing Campaign Steals Money From Industrial Companies

Industrial production companies are the targets in a large-scale spear-phishing email campaign aimed at installing legitimate remote administration software on victims’ systems. Researchers with Kaspersky Lab said that emails purporting to be commercial offers were the conduit to enabling attacke...

The First Step to Deploying Application Control

Application Control remains one of the best techniques for blocking the vast majority of malware threats; however, implementation often falters due to poor planning. Gartner How to Successfully Deploy Application Control Is Whitelisting Worth It? When it comes to preventing new attacks,...

Can we trust our online project management tools?

How would you feel about sharing confidential information about your company on Twitter or Facebook? That doesn’t sound right, does it? So, in a corporate life where we keep our work calendars online, and where we work together on projects using online flow-planners and online project management...

Information Disclosure in the PAN-OS Management Web Interface

A local privilege escalation vulnerability exists in the PAN-OS management web interface that allows the administrator to access the password hashes of local users by manipulating the HTML markup. Ref. PAN-91564; CVE-2018-9334 Successful exploitation of this issue requires the attacker to be...

CVE-2018-3760

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is...

GNU Binutils Denial of Service Vulnerability (CNVD-2018-12117)

GNU Binutils a.k.a. GNU Binary Utilities or binutils is a set of programming language utility programs developed by the GNU Project to work with target files in a variety of formats, with connectors, assemblers, and other tools for target files and archives.GNU libiberty is one of the GNU program...

GHSA-PR3H-JJHJ-573X Sprockets path traversal leads to information leak

Specially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately. Workaround:...