619 matches found
UBUNTU-CVE-2018-3728
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data MAID vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existi...
CVE-2018-1000095
CVE-2018-1000095 is a stored XSS in oVirt 4.2.0–4.2.2 within the web admin UI's VM name/description. Root cause: HTML sanitization was not applied consistently across fields, enabling a VM Admin to inject script/HTML that could affect other VM/Cluster administrators. The issue is fixed in version...
CVE-2018-1000095
oVirt version 4.2.0 to 4.2.2 contains a Cross Site Scripting XSS vulnerability in the name/description of VMs portion of the web admin application. This vulnerability appears to have been fixed in version 4.2.3...
oVirt Cross-Site Scripting Vulnerability
Red Hat Ovirt is the United States Red Hat Red Hat company's set of open source virtualization management platform , is the RHEV enterprise virtualization platform of the open source version of the ovirt-node client and overt-engine management end of the composition of the Web admin application i...
IBM Spectrum Scale Information Disclosure Vulnerability (CNVD-2018-05069)
IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The solution supports helping clients reduce storage costs while improving security and management efficiency in...
CVE-2017-1654
IBM Spectrum Scale 4.1.1 and 4.2.0 - 4.2.3 could allow a local unprivileged user access to information located in dump files. User data could be sent to IBM during service engagements. IBM X-Force ID: 133378...
CVE-2018-2606
Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications subcomponent: Base. Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Hospitalit...
CVE-2017-1336
CVE-2017-1336 affects IBM BigInsights 4.2 (and IBM Open Platform 4.2). The description in the connected IBM bulletin and NVD entry states a remote code injection vulnerability that could allow an attacker to inject code and access restricted data and files. Root cause is a vulnerability in the Te...
Cross site scripting
IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning...
Cross site scripting
IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 13139...
CVE-2017-1554
IBM Infosphere BigInsights 4.2.0 and 4.2.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks...
CVE-2017-1554
IBM Infosphere BigInsights 4.2.0 and 4.2.5 are affected by CVE-2017-1554, a UI vulnerability where a remote attacker could hijack a victim’s click actions by enticing them to visit a malicious Web site. The issue is described as a click/action hijack that could enable further attacks within the v...
CVE-2017-1553
IBM Infosphere BigInsights exposes a cross‑site scripting vulnerability (CVE-2017-1553) in Web UI affecting versions 4.2.0 and 4.2.5. The issue allows embedding arbitrary JavaScript in the UI, potentially leading to credentials disclosure within a trusted session. Public details in connected sour...
CVE-2017-10372
Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications subcomponent: Base. Supported versions that are affected are 4.2.0 and 4.2.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...
Subrion CMS Cross-Site Request Forgery Vulnerability
Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a variety of extensions plug-ins and more. A cross-site request forgery vulnerability exists in Subrion CMS versions prior to 4.2.0 that stems from a...
CVE-2015-5284
ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable...
CVE-2015-1591
The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges...
DEBIAN-CVE-2015-1591
The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges...
Pivotal Spring Security Deserialization Remote Code Execution Vulnerability
Pivotal Spring Security is a suite of security frameworks from Pivotal Software that provide illustrative security protection for Spring-based applications. A remote code execution vulnerability exists in Pivotal Spring Security versions 4.2.0 through 4.2.2 and 5.0.0.M1. A remote attacker could...
Information disclosure
OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information...