Blog

di Marina Glancy. Substituting URL in portfolios users can instantiate any class, this can also be exploited by users who are logged in as guests to create a DDoS attackSeverity/Risk:SeriousVersions affected:3.4 to 3.4.2, 3.3 to 3.3.5, 3.2 to 3.2.8, 3.1 to 3.1.11 and earlier unsupported versionsVersions fixed:3.5, 3.4.3, 3.3.6, 3.2.9 and 3.1.12Reported by:Brendan CoxWorkaround:Disable portfolios until the fix is applied. Portfolios are disabled by default in MoodleCVE More info: https://moodle.org/mod/forum/discuss.php?d=371204&parent=1496358

Type: Vulnerability. Microsoft Dynamics 365 is prone to a remote code-execution vulnerability; fixes are available. More info: http://www.symantec.com/security_response/vulnerability.jsp?bid=105894&om_rssid=sr-advisories

Type: Vulnerability. Microsoft Windows is prone to a local privilege-escalation vulnerability; fixes are available. More info: http://www.symantec.com/security_response/vulnerability.jsp?bid=105790&om_rssid=sr-advisories

Type: Vulnerability. Microsoft .NET Core is prone to a security-bypass vulnerability; fixes are available. More info: http://www.symantec.com/security_response/vulnerability.jsp?bid=105798&om_rssid=sr-advisories

Type: Vulnerability. Microsoft Windows is prone to a local information-disclosure vulnerability; fixes are available. More info: http://www.symantec.com/security_response/vulnerability.jsp?bid=105789&om_rssid=sr-advisories

Type: Vulnerability. Microsoft Windows is prone to a local information-disclosure vulnerability; fixes are available. More info: http://www.symantec.com/security_response/vulnerability.jsp?bid=105791&om_rssid=sr-advisories

More info: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10898&actp=RSS

Type: Vulnerability. Microsoft Skype for Business and Lync are prone to a remote denial-of-service vulnerability; fixes are available. More info: http://www.symantec.com/security_response/vulnerability.jsp?bid=105802&om_rssid=sr-advisories

Today, VMware has released the following new security advisory: “VMSA-2018-0028 (https://www.vmware.com/security/advisories/VMSA-2018-0028.html) – VMware vRealize Log Insight updates address an authorization bypass vulnerability” This documents the remediation of a moderate severity authorization bypass vulnerability (CVE-2018-6980 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6980) in VMware vRealize Log Insight. The issue exists due to improper authorization in the More info: https://blogs.vmware.com/security/2018/11/new-vmware-security-advisory-vmsa-2018-0028.html

https://wpvulndb.com/vulnerabilities/9147 More info: https://wpvulndb.com/vulnerabilities/9147