Vulnerability fixed in ArcSight Enterprise Security Manager

Micro Focus has fixed a vulnerability in ArcSight Enterprise Security Manager ESM. An authenticated malicious person at remote user could potentially exploit the vulnerability to execute arbitrary execute arbitrary code under the application's privileges. Micro Focus shared few technical details...

CubeCoders AMP 安全漏洞

AMP is a software application. for tracking all issues and bugs within the CubeCoders AMP platform. A security vulnerability exists in CubeCoders AMP versions prior to 2.1.x series 2.1.1.2 that allows an authenticated remote user to open a port in the local system firewall by writing an HTTPS...

Code injection

PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code...

CVE-2020-24670

The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'type' attribute of 'dashboardXml' parameter...

Design/Logic Flaw

An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other users via enumeration...

CVE-2019-11826

Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users to upload arbitrary files via the name parameter...

CVE-2018-15762

Pivotal Operations Manager, versions 2.0.x prior to 2.0.24, versions 2.1.x prior to 2.1.15, versions 2.2.x prior to 2.2.7, and versions 2.3.x prior to 2.3.1, grants all users a scope which allows for privilege escalation. A remote malicious user who has been authenticated may create a new client...

CVE-2018-11078

Dell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions vulnerability. A remote authenticated malicious user could read from VPN configuration files on and potentially author a MITM attack on the VPN traffic...

HP Intelligent Management Center Arbitrary Code Execution Vulnerability (CNVD-2017-33287)

HP Intelligent Management Center IMC is a comprehensive management platform built from the ground up to support the Fault, Configuration, Accounting, Performance and Security FCAPS model. An arbitrary code execution vulnerability exists in HP Intelligent Management Center, where a remote...

CVE-2017-6338

Multiple Access Control issues in Trend Micro InterScan Web Security Virtual Appliance IWSVA 6.5 before CP 1746 allow an authenticated, remote user with low privileges like 'Reports Only' or 'Auditor' to change FTP Access Control Settings, create or modify reports, or upload an HTTPS Decryption...

UBUNTU-CVE-2016-9891

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

CVE-2016-5680

Stack-based buffer overflow in cgi-bin/cgimain in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary code via the sn parameter to the transferlicense command...

IBM Rational Publishing Engine Cross-Site Scripting Vulnerability

IBM Rational Publishing Engine is the U.S. IBM company's set of specialized for the product development process involves documents, reports for automated generation, publishing tools. A cross-site scripting vulnerability exists in ifix002 versions of IBM Rational Publishing Engine prior to 2.0.1,...

CVE-2016-2219

Cross-site scripting XSS vulnerability in the management interface in Palo Alto Networks PAN-OS 7.x before 7.0.8 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

The vulnerability of the MySQL database management system allows unauthorized users, after passing authentication, to affect the accessibility of data.

The Oracle MySQL Server database management system contains a vulnerability that allows remote users who have passed authentication to influence the accessibility of data by using a subcomponent called Partition...

The vulnerability of the PostgreSQL database management system allows remote users who have passed authentication to elevate their privileges levels.

The vulnerability of the PostgreSQL database management system relates to errors that occur when calling a function written in another language, or which the user cannot call directly due to established access restrictions. Exploiting this vulnerability in functions of PostgreSQL’s procedural...

HPE Insight Control server deployment information disclosure vulnerability (CNVD-2016-03947)

HPE Insight Control server deployment is a set of server management configuration tools from Hewlett Packard Enterprise HPE. An information disclosure vulnerability exists in HPE Insight Control server deployment, which could allow an authenticated remote user to obtain sensitive information or...

HPE Network Node Manager Denial of Service Vulnerability

HP Network Node Manager i-series NNMi software delivers powerful out-of-the-box features to help your network operations team efficiently manage networks of any size. A security vulnerability exists in HPE Network Node Manager i NNMi versions 9.20, 9.23, 9.24, 9.25, 10.00, 10.01 that could allow ...

Cisco Unified Communications Domain Manager Cross-Site Scripting Vulnerability (CNVD-2016-01927)

Cisco Unified Communications Manager is an enterprise-class IP telephony call processing system. Cisco Unified Communications Domain Manager CDM 8.11 suffers from a cross-site scripting vulnerability in its implementation, which can be exploited by an authenticated remote user to inject arbitrary...

NHN PlayArt LINE Denial of Service Vulnerability

NHN PlayArt LINE is a suite of live chat software from the Japanese company NHN PlayArt. A denial of service vulnerability exists in NHN PlayArt LINE version 4.3.1 and prior versions, which allows a remote, authenticated user to cause a denial of service application crash by exploiting the...