CVE-2017-5891

ASUS RT-AC and RT-N devices with firmware before 3.0.0.4.380.7378 have Login Page CSRF and Save Settings CSRF...

CVE-2017-5891

CVE-2017-5891 covers CSRF vulnerabilities in ASUS RT-AC* and RT-N* routers prior to firmware 3.0.0.4.380.7378, enabling login and settings changes via the router’s web interface from an attacker-controlled site. Affected models include RT-AC55U/56R/56S/56U/66U/66R/66W/66U family, RT-AC68K/R/U var...

CVE-2017-5891

ASUS RT-AC and RT-N devices with firmware before 3.0.0.4.380.7378 have Login Page CSRF and Save Settings CSRF...

PT-2017-16739

Name of the Vulnerable Software and Affected Versions ASUS RT-AC and RT-N devices with firmware prior to 3.0.0.4.380.7378 Description The issue affects the login page and save settings functionality, allowing for CSRF attacks. Recommendations For ASUS RT-AC and RT-N devices with firmware prior to...

CVE-2017-5891: Cross-Site Request Forgery (CSRF)

ASUS RT-AC and RT-N devices with firmware before 3.0.0.4.380.7378 have Login Page CSRF and Save Settings CSRF...

Gnulib Buffer Overflow Vulnerability

Gnulib is a GNU portability library that supports multi-system operation. A heap buffer overflow vulnerability exists in the saveabbr function of the timerz.c file in versions of Gnulib prior to 2017-04-26. An attacker can exploit this vulnerability to execute arbitrary code with the help of TZ...

OpenText Documentum Content Server "RPC save-command" elevation vulnerability

OpenText Documentum Content Server is a platform for managing content in a repository and consists of three parts: a content server, a relational database, and a location to store documents. OpenText Documentum Content Server "RPC save-command" has an elevation vulnerability that can be exploited...

PT-2017-17760

Name of the Vulnerable Software and Affected Versions Gnulib versions prior to 2017-04-26 Description The issue is related to a heap-based buffer overflow that occurs with the TZ environment variable. The error is specifically located in the save abbr function within the time rz.c file...

CVE-2017-7220

OpenText Documentum Content Server allows superuser access via sysobjsave or save of a crafted object, followed by an unauthorized "UPDATE dmdbo.dmusers SET userprivileges=16" command, aka an "RPC save-commands" attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-453...

CVE-2017-7220

OpenText Documentum Content Server has a vulnerability where an attacker can gain superuser access by saving a crafted object via sys_obj_save (or saving an object) and issuing an unauthorized UPDATE dm_dbo.dm_user_s SET user_privileges=16, i.e., the so‑called RPC save-commands attack. This CVE (...

PT-2017-17585

Name of the Vulnerable Software and Affected Versions OpenText Documentum Content Server affected versions not specified Description The issue allows superuser access via sys obj save or save of a crafted object, followed by an unauthorized "UPDATE dm dbo.dm user s SET user privileges=16" command...

CVE-2017-7220: Improper Input Validation

OpenText Documentum Content Server allows superuser access via sysobjsave or save of a crafted object, followed by an unauthorized "UPDATE dmdbo.dmusers SET userprivileges=16" command, aka an "RPC save-commands" attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-453...

Unitrends Enterprise Backup File Upload Vulnerability

Unitrends Enterprise Backup is backup software that incorporates cloud continuity services to ensure the recovery of your virtual, physical and cloud data, systems and applications. A file upload vulnerability exists in the createReportName and saveReport functions in Unitrends Enterprise Backup'...

Vtiger CRM Arbitrary File Upload Vulnerability Vulnerability

Vtiger CRM is a set of customer relationship management system CRM based on SugarCRM developed by American Vtiger. The management system provides management, collection and analysis of customer information and other functions. An arbitrary file upload vulnerability exists in the...

CVE-2016-4897

Multiple cross-site scripting XSS vulnerabilities in 1 filter/saveforward.cgi, 2 filter/save.cgi, 3 /man/search.cgi in Usermin before 1.690...

PT-2017-8594

Name of the Vulnerable Software and Affected Versions Usermin versions prior to 1.690 Description The issue concerns multiple cross-site scripting XSS vulnerabilities found in specific components of the software, including 1 filter/save forward.cgi, 2 filter/save.cgi, and 3 /man/search.cgi...

Code injection

In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/apptheme/libs/savefile.php" and then execute code...

PT-2017-17853

Name of the Vulnerable Software and Affected Versions Fiyo CMS versions 2.x through 2.0.7 Description The issue allows attackers to upload a webshell via the content parameter to the "/dapur/apps/app theme/libs/save file.php" API endpoint and then execute code. Recommendations For Fiyo CMS versio...

Citrix Store Front 3.0 Unable to save favourites in Store Front

Unable to save favourites in Store Front...

SQL Injection Vulnerability in catid_save.php File of Ohu Government System

Ohuhu government system is the government portal system of Shanghai Ohuhu Network Technology Co. A SQL injection vulnerability exists in the catidsave.php file of the Ohuhu government system. An attacker can exploit the vulnerability to execute arbitrary SQL statements and obtain sensitive...