CVE-2017-6698

A vulnerability in the Cisco Prime Infrastructure PI and Evolved Programmable Network Manager EPNM SQL database interface could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries, aka SQL Injection. More...

CVE-2017-6717

A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface. More Information: CSCvc38801. Known Affected Releases: 6.0.1.3 6.2.1. Known Fixed Releases: 6.2...

PT-2017-17270 · Cisco · Cisco Firepower Management Center

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center Software Releases prior to 6.0.0.0 Description: A stored cross-site scripting XSS attack can be conducted by an authenticated, remote attacker against a user of the web interface of an affected system, due to...

PT-2017-2506 · Cisco · Cisco Ios +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS and IOS XE Software affected versions not specified Description: The Simple Network Management Protocol SNMP subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote...

CVE-2017-7522

OpenVPN is affected by CVE-2017-7522. OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to a denial-of-service caused by an authenticated remote attacker sending a certificate with an embedded NULL character. The issue is described in multiple connected sources as part of a set of vu...

UBUNTU-CVE-2016-7508

Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL commands by using a certain character when the database is configured to use Big5 Asian encoding...

Cisco Elastic Services Controller Information Disclosure Vulnerability

Cisco Elastic Services Controller is a cloud and systems management solution. Cisco Elastic Services Controllers have a security vulnerability in the web interface implementation that could allow an authenticated, remote attacker to gain access to sensitive information on affected systems...

Cisco Elastic Services Controller Arbitrary Command Execution Vulnerability

Cisco Elastic Services Controller is a cloud and systems management solution. A security vulnerability in the esclistener.py script in Cisco Elastic Services Controllers could allow an authenticated, remote attacker to run arbitrary commands as the tomcat user on an affected system...

CVE-2017-6697

A vulnerability in the web interface of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to access sensitive system credentials that are stored in an affected system. More Information: CSCvd76339. Known Affected Releases: 2.29.76...

CVE-2017-6691

A vulnerability in the ConfD CLI of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to access sensitive information on an affected system. More Information: CSCvd29403. Known Affected Releases: 2.32...

CVE-2017-6682

A vulnerability in the ConfD CLI of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to run arbitrary commands as the Linux tomcat user on an affected system. More Information: CSCvc76620. Known Affected Releases: 2.29.76...

CVE-2017-6668

Vulnerabilities in the web-based GUI of Cisco Unified Communications Domain Manager CUCDM could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. More Information: CSCvc52784 CSCvc97648. Known Affected...

CVE-2017-6684

A vulnerability in Cisco Elastic Services Controllers could allow an authenticated, remote attacker to log in to an affected system as the Linux admin user, aka an Insecure Default Credentials Vulnerability. More Information: CSCvc76651. Known Affected Releases: 21.0.0...

CVE-2017-6668

CVE-2017-6668 affects the web-based GUI of Cisco Unified Communications Domain Manager (CUCDM). The issue is an SQL Injection caused by insufficient validation of user-supplied input in HTTP request parameters, allowing an authenticated, remote attacker to impact confidentiality by executing arbi...

Xxe

XXE vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Replication Manager before 8.5.2-00 allows authenticated remote users to read arbitrary files...

CVE-2017-9295

XXE vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Replication Manager before 8.5.2-00 allows authenticated remote users to read arbitrary files...

CVE-2017-8913

The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity XXE attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security Note 2386873...

IBM MQ 8.x < 8.0.0.3 Multiple Information Disclosure (credentialed check)

The version of IBM MQ formerly IBM WebSphere MQ 8.x installed on the remote Windows host is missing fix pack 8.0.0.3 or later. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the Advanced Message Security policy when a JMS client application sends a message to the...

CVE-2017-2098

Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors...

CVE-2017-6619

A vulnerability in the web-based GUI of Cisco Integrated Management Controller IMC 3.01c could allow an authenticated, remote attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software does not sufficiently sanitize user-supplied HTTP inpu...