9648 matches found
Server: Incorrect setup of external storage
The external storage functionality as implemented in ownCloud 9.0.x before 9.0.2 is improperly setting up external storages when multiple groups have been granted access to an external storage and a user is member of both groups. The storage class is setup without any setup information, leading t...
Unrestricted Arbitrary File Deletion Vulnerability in the Call Center of Shenzhen Jishu Communication Co.
The call center of Shenzhen Jishu Communication Co., Ltd. is a new generation of enterprise-level call center system. A security vulnerability exists in the 'showDeleteContactTempFile' method in the 'userweb/php/index/mobileApi.class.php' of the call center of Shenzhen Tibus Communications Co. Du...
IPS Community Suite PHP Code Injection Vulnerability
IPS Community Suite also known as Invision Power Board, IPB or Power Board is a PHP and MySQL based Web forum program from Invision Power Services IPS. The program makes it easy to create and manage online forums. A PHP code injection vulnerability exists in IPS Community Suite 4.1.12.3 and earli...
CVE-2016-3762
The sockets subsystem in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to gain privileges via a crafted application that uses 1 the AFMSMIPC socket class or 2 another socket class that is unrecognized by SELinux, aka internal bug 28612709...
IPS Community Suite 4.1.12.3 - PHP Code Injection
IPS Community Suite 4.1.12.3 - PHP Code Injection --------------------------------------------------------------------------- IPS Community Suite contentclass ; 39. 40. if ! classexists $class or ! inarray 'IPS\Content', classparents $class 41. 42. \IPS\Output::i-error 'nodeerror', '2S226/2', 404...
IPS Community Suite 4.1.12.3 - PHP Code Injection
Exploit for php platform in category web applications --------------------------------------------------------------------------- IPS Community Suite contentclass ; 39. 40. if ! classexists $class or ! inarray 'IPS\Content', classparents $class 41. 42. \IPS\Output::i-error 'nodeerror', '2S226/2',...
The vulnerability of the iOS operating system, which allows a malicious actor to trigger a service failure
The vulnerability in the CoreTelephony component allows a remote attacker to trigger a service failure by sending specially crafted Class 0 SMS messages...
The vulnerability of the implementation of the getClass method in the CookieInterceptor class of the Apache Struts software framework allows a hacker to execute arbitrary code.
The vulnerability of the CookieInterceptor class implementation in the Apache Struts software platform is related to deficiencies in access control when processing the cookiesName value with a placeholder. Exploiting this vulnerability could allow an attacker to execute arbitrary code by sending ...
The vulnerability of the Cisco IOS operating system allows a malicious individual to establish a network connection using the TELNET protocol.
The Cisco IOS operating system of telecommunications equipment does not recognize the keyword “vrf-also” during the execution of the “access-class” command. This allows a malicious intruder to establish a network connection using the TELNET protocol...
The vulnerability of the Firefox browser, which allows a malicious actor to trigger a service failure
The Mozilla Firefox browser contains a vulnerability related to errors in class implementation. Exploiting this vulnerability allows a malicious actor to trigger a service failure for an application through the onbeforeunload event, causing JavaScript to run in the background...
The vulnerability of the Thunderbird email client, which allows a malicious individual to execute arbitrary code or trigger a service failure.
Mozilla Thunderbird’s email client contains a vulnerability related to the use of memory after it is freed in the JavaScript engine when working with the TypeObject class. Exploiting this vulnerability allows malicious actors to execute arbitrary code, resulting in excessive memory consumption...
The vulnerability of the Mozilla SeaMonkey software package, which allows a malicious individual to trigger a service failure
Mozilla SeaMonkey software contains a vulnerability related to class implementation errors. Exploiting this vulnerability allows a malicious actor to trigger a service failure in an application through the onbeforeunload event, causing JavaScript to run in the background...
The vulnerability of the Mozilla SeaMonkey software package, which allows a malicious individual to execute arbitrary code or trigger a service denial.
Mozilla SeaMonkey software contains a vulnerability related to the use of memory after it is freed in the JavaScript engine when working with the TypeObject class. Exploiting this vulnerability allows malicious actors to execute arbitrary code, resulting in excessive memory consumption during...
CVE-2016-3092
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service CPU consumption via a long boundary string...
Design/Logic Flaw
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service CPU consumption via a long boundary string...
CVE-2016-3092
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service CPU consumption via a long boundary string...
CVE-2016-5833
CVE-2016-5833 is a cross-site scripting (XSS) vulnerability in WordPress affecting WordPress core prior to 4.5.3. The issue resides in the column_title function of wp-admin/includes/class-wp-media-list-table.php, which allows remote attackers to inject arbitrary script or HTML via a crafted attac...
CVE-2016-5833: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the columntitle function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834...
PHP memory misreference vulnerability (CNVD-2016-04368)
PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. A memory misreference vulnerability exists in PHP's GC algorithm and unserialize function, which can be exploited by remote attackers to execute...
