Monthly Archive: February 2020

MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm Date published : 2020-02-12 http://seclists.org/fulldisclosure/2014/Apr/21 https://exchange.xforce.ibmcloud.com/vulnerabilities/92352

Tube Map Live Underground for Android before 3.0.22 has an Information Disclosure Vulnerability Date published : 2020-02-12 http://www.securityfocus.com/bid/64039 https://exchange.xforce.ibmcloud.com/vulnerabilities/89849

IZON IP 2.0.2: hard-coded password vulnerability Date published : 2020-02-12 https://exchange.xforce.ibmcloud.com/vulnerabilities/88337 https://packetstormsecurity.com/files/cve/CVE-2013-6236

A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a remote malicious user execute arbitrary code. Date published : 2020-02-12 http://www.kb.cert.org/vuls/id/450646 http://www.securityfocus.com/bid/63463

A Code Execution vulnerability exists in select.py when using python-mode 2012-12-19. Date published : 2020-02-12 http://github.com/klen/python-mode/issues/162

A Denial of Service (infinite loop) vulnerability exists in Avira AntiVir Engine before 8.2.12.58 via an unspecified function in the PDF Scanner Engine. Date published : 2020-02-12 http://www.securityfocus.com/bid/60552 http://www.securitytracker.com/id/1028666

Simple Machines Forum (SMF) through 2.0.5 has XSS Date published : 2020-02-12 http://www.openwall.com/lists/oss-security/2013/10/01/8 http://www.openwall.com/lists/oss-security/2013/10/02/1

Varnish HTTP cache before 3.0.4: ACL bug Date published : 2020-02-12 https://www.varnish-cache.org/lists/pipermail/varnish-announce/2013-June/000684.html

Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution. Date published : 2020-02-12 http://www.john-jean.com/blog/securite-informatique/ipb-invision-power-board-all-versions-1-x-2-x-3-x-admin-account-takeover-leading-to-code-execution-742

A Privilege Escalation Vulnerability exists in Sprite Software Spritebud 1.3.24 and 1.3.28 and Backup 2.5.4105 and 2.5.4108 on LG Android smartphones due to a race condition in the spritebud daemon, which could let a...

A Code Execution Vulnerability exists in UMPlayer 0.98 in wintab32.dll due to insufficient path restrictions when loading external libraries. which could let a malicious user execute arbitrary code. Date published : 2020-02-12 https://exchange.xforce.ibmcloud.com/vulnerabilities/89262

A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote...

ZPanel through 10.1.0 has Remote Command Execution Date published : 2020-02-12 http://packetstormsecurity.com/files/134030/Zpanel-10.1.0-Remote-Unauthenticated-Code-Execution.html http://www.exploit-db.com/exploits/25519

WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability Date published : 2020-02-12 http://packetstormsecurity.com/files/130999/WordPress-W3-Total-Cache-PHP-Code-Execution.html http://www.exploit-db.com/exploits/25137