CVE-2017-1000021: Improper Restriction of XML External Entity Reference

LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents...

CVE-2017-1000023

LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document...

CVE-2017-1000021

LogicalDoc Community Edition 7.5.3 and earlier is vulnerable to an XML External Entity (XXE) issue when indexing XML documents. The CNVD-entry CNVD-2017-24536 identifies this as an XML injection vulnerability affecting the same version range; CNVD-2017-24537 covers a related cross-site scripting ...

CVE-2017-1000022

The CVE-2017-1000022 entry concerns LogicalDoc Community Edition 7.5.3 and earlier, where an incorrect access control issue can lead to privilege escalation. Public references across NVD and CNVD describe the vulnerability as an elevation of privileges due to improper rights management within the...

CVE-2017-1000023

Affected software : LogicalDoc Community Edition (Java-based DMS) prior to 7.5.3. Vulnerability : Cross-site scripting (XSS) in the HTML document preview feature. Root cause: improper sanitization/execution of user-controlled content in the preview flow (document HTML preview). Impact : attacker ...

PT-2017-10731

Name of the Vulnerable Software and Affected Versions LogicalDoc Community Edition versions prior to 7.5.3 Description The issue allows for XXE XML External Entity attacks when indexing XML documents. Recommendations For versions prior to 7.5.3, update to a version that contains a fix for this...

PT-2017-10733

Name of the Vulnerable Software and Affected Versions LogicalDoc Community Edition versions 7.5.3 and prior Description The issue allows for an XSS attack when the preview function is used on HTML documents. Recommendations For versions 7.5.3 and prior, update to a version that contains a fix for...

PT-2017-10732

Name of the Vulnerable Software and Affected Versions LogicalDoc Community Edition versions 7.5.3 and prior Description The issue is related to incorrect access control, which could lead to privilege escalation. Recommendations For versions 7.5.3 and prior, update to a version that contains a fix...

CVE-2017-5529: Exposure of Sensitive Information to an Unauthorized Actor

JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition versions 6.4.0 and below, TIBCO JasperReports...

GSM Community Edition and lagging OpenVAS Plugin Feed

As I already wrote in "Installing OpenVAS 9 from the sources", since May 2017 OpenVAS 9 is available in a form of free virtual appliance. It is called GSM Community Edition GCE and is based on Greenbone commercial product GSM ONE. What's the difference between GSM ONE and free GCE? GSM Community...

CVE-2016-5072

OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community...

Cross site request forgery (csrf)

OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community...

CVE-2016-5072

OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community...

PT-2017-9672

Name of the Vulnerable Software and Affected Versions HPE Operations Orchestration versions prior to 10.70 Description A remote code execution issue was discovered, allowing for the deserialization of untrusted data. This issue affects HPE Operations Orchestration Community edition and Enterprise...

Teradata Virtual Machine Community Edition Elevation of Privilege Vulnerability

Teradata Virtual Machine Community Edition is a Teradata virtual container packaged with the SUSE Linux Enterprise Server SLES operating system and Teradata databases to run in a virtualized environment on third-party hardware. A security vulnerability exists in Teradata Virtual Machine Community...

Teradata Virtual Machine Community Edition 15.10 Insecure File Permission Vulnerability

Teradata Virtual Machine Community Edition version 15.10 suffers from an insecure file permission vulnerability. Title: Teradata Virtual Machine Community Edition v15.10 has insecure file permission Author: Larry W. Cashdollar, @larry0 Date: 2016-10-01 Download Site:...

CVE-2016-7489

Teradata Virtual Machine Community Edition v15.10's perl script /opt/teradata/gsctools/bin/t2a.pl creates files in /tmp in an insecure manner, this may lead to elevated code execution...

CVE-2016-7489

Teradata Virtual Machine Community Edition v15.10's perl script /opt/teradata/gsctools/bin/t2a.pl creates files in /tmp in an insecure manner, this may lead to elevated code execution...

Code injection

Teradata Virtual Machine Community Edition v15.10's perl script /opt/teradata/gsctools/bin/t2a.pl creates files in /tmp in an insecure manner, this may lead to elevated code execution...

CVE-2016-7489

Teradata Virtual Machine Community Edition v15.10 is affected by an insecure file-creation flaw in the perl script /opt/teradata/gsctools/bin/t2a.pl, which creates temporary files in /tmp. The root cause is insecure handling of /tmp files, enabling a local user to inject/execute commands (e.g., b...