CVE-2018-19982

An issue was discovered on KT MC01507L Z-Wave S0 devices. It occurs because HPKP is not implemented. The communication architecture is APP Server Controller HUB Node products which are controlled by HUB. The prerequisite is that the attacker is on the same network as the target HUB, and can use I...

CVE-2018-19982

CVE-2018-19982 affects KT MC01507L Z-Wave S0 devices. The issue arises because HPKP is not implemented, enabling an attacker on the same network to use IP Changer to redirect packets destined for the Server to a proxy, allowing sniffing of cleartext between Server and Controller. The attacker can...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect z/TPF

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by the z/TPF system. z/TPF has addressed the applicable CVEs. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered with this product, you should evaluate your code to...

ZERO TRUST SECURITY - THREAT REPORT FOR EDUCATION

Originally Published: Generation Z and New Challenges in the Education Field The youth of Generation Z grew up with Windows 2000 and XP, and many played with iPhones, iPads, and Android products. Known as digital natives, they are an essential part of today's educational landscape -- where cloud,...

SUSE-SU-2018:3933-1 Security update for java-1_7_1-ibm

java-171-ibm was updated to Java 7.1 Service Refresh 4 Fix Pack 35 bsc1116574: Consumability - IJ10515 AIX JAVA 7.1.3.10 GENERAL PROTECTION FAULT WHEN ATTEMPTING TO USE HEALTH CENTER API Class Libraries - IJ10934 CVE-2018-13785 - IJ10935 CVE-2018-3136 - IJ10895 CVE-2018-3139 - IJ10932 CVE-2018-31...

CVE-2018-19556

zbsystem/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainer disputes that this is a vulnerability...

CVE-2018-19556

zbsystem/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainer disputes that this is a vulnerability...

Design/Logic Flaw

DISPUTED zbsystem/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainer disputes that this is a vulnerability...

CVE-2018-19556

CVE-2018-19556 affects Z-BlogPHP 1.5, specifically the endpoint zb_system/admin/index.php?act=UploadMng. The vulnerability description states that file preview handling in this endpoint mishandles previews, which could lead to content spoofing. The reports note that the software maintainer disput...

CVE-2018-19556

zbsystem/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainer disputes that this is a vulnerability...

Z-BlogPHP Content Spoofing Vulnerability

Z-BlogPHP is an open source PHP-based blogging system developed by the Z-Blog community. A security vulnerability exists in the zbsystem/admin/index.php?act=UploadMng URL in Z-BlogPHP version 1.5, which stems from the program not handling file previews correctly. An attacker can exploit the...

CVE-2018-19463

zbsystem/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zbsystem/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP b...

Authentication flaw

DISPUTED zbsystem/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zbsystem/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can...

CVE-2018-19463

zbsystem/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zbsystem/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP b...

CVE-2018-19463

Z-BlogPHP

CVE-2018-19463

zbsystem/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zbsystem/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP b...

PT-2018-14968 · Z Blogphp · Z-Blogphp

Name of the Vulnerable Software and Affected Versions: Z-BlogPHP versions prior to 1.5.1 Description: The issue allows remote attackers to execute arbitrary PHP code by uploading an image with the image/jpeg content type to the "zb system/admin/index.php?act=UploadMng" API endpoint. This requires...

z-i-g.de XSS vulnerability

Open Bug Bounty ID: OBB-697335 Description| Value ---|--- Affected Website:| z-i-g.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden until...

CVE-2018-12414

The CVE-2018-12414 entry affects TIBCO Rendezvous components (rvrd, rvrsd, rvsd, rvcache, rvdm) and related editions. A CSRF flaw exists that could let an attacker reconfigure messaging and potentially access all data routed by RV. Affected versions are: RV 8.4.5 and earlier, RV Developer Edition...

Security Bulletin: Open Source Apache CXF Vulnerabilities

Summary Apache CXF is vulnerable to a denial of service. By using a specially crafted message attachment header, a remote attacker could exploit this vulnerability to cause the AX-WS and JAX-RS services stop responding. Vulnerability Details CVEID: CVE-2017-12624 DESCRIPTION: Apache CXF is...