FreePlane XML External Entity Injection Vulnerability

FreePlane is a set of free open source mind mapping tools. mindmap loader is one of the mind map loader. XML Parser is one of the XML file parser. An XML external entity injection vulnerability exists in the XML Parser of the mindmap loader in FreePlane 1.5.9 and earlier versions. An attacker can...

CVE-2017-0914

Gitlab Community and Enterprise Editions version 10.1, 10.2, and 10.2.4 are vulnerable to a SQL injection in the MilestoneFinder component resulting in disclosure of all data in a GitLab instance's database...

Orbitz Warns 880,000 Payment Cards Suspected Stolen

Expedia-owned travel site Orbitz said Tuesday a possible breach of both its consumer and partner platforms may have led to the disclosure of 880,000 payment cards. According to Expedia, criminals had access to Orbitz consumer and business partner platforms, but not the Orbitz.com website. The...

The vulnerability of the Audioserver component in the Android operating system allows a hacker to disclose protected information.

The vulnerability of the Audioserver component in the Android operating system is related to the writing of data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...

abvd.shh.mpg.de XSS vulnerability

Open Bug Bounty ID: OBB-582466 Description| Value ---|--- Affected Website:| abvd.shh.mpg.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Information disclosure

Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeration as well as data from the /etc/ajenti/config.yml file. This attack appears to be exploitable via network connectivity to the web application...

Western Bridge Cobub Razor SQL Injection Vulnerability

Western Bridge Cobub Razor is an open source mobile application analytics system. The system can provide users with detailed multi-dimensional reports and monitor their mobile applications and applications user behavior statistics. A SQL injection vulnerability exists in Western Bridge Cobub Razo...

CVE-2016-0268

XML external entity XXE vulnerability in IBM Financial Transaction Manager FTM for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager FTM for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager FTM fo...

CVE-2017-1625

IBM Pulse for QRadar 1.0.0–1.0.3 discloses sensitive information to unauthorized users, enabling potential follow-on attacks. Affected product: IBM Pulse for QRadar; vulnerable component: information disclosure pathway within the Pulse app. Root cause is described as information exposure without ...

NetApp SnapCenter Information Disclosure Vulnerability

NetApp SnapCenter is a suite of applications from NetApp, Inc. that provide the ability to back up, validate, clone, and restore NetApp storage systems.NetApp SnapCenter Server is a server version... A security vulnerability exists in NetApp SnapCenter versions 2.0 through 3.0.1. A remote attacke...

NVIDIA SHIELD TV Security Engine Deterministic Random Bit Generator Information Disclosure Vulnerability

NVIDIA SHIELD TV is a gaming console device from NVIDIA.Security Engine is one of the security engines.Deterministic Random Bit Generator DRBG is one of the... A security vulnerability exists in DRBG of Security Engine in NVIDIA SHIELD TV SE 6.2 and prior versions, which arises from the program...

robertosanchezehijo.com.ar XSS vulnerability

Open Bug Bounty ID: OBB-575801 Description| Value ---|--- Affected Website:| robertosanchezehijo.com.ar Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Piwigo cross-site scripting vulnerability (CNVD-2018-06553)

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time, and more. A cross-site scripting vulnerability exists in the admin panel in Piwigo version 2.9.3. A remote attacker can exploit th...

CVE-2017-6284

NVIDIA Security Engine contains a vulnerability in the Deterministic Random Bit Generator DRBG where the DRBG does not properly initialize and store or transmits sensitive data using a weakened encryption scheme that is unable to protect sensitive data which may lead to information disclosure.Thi...

PT-2018-3407 · Dovecot +3 · Dovecot +3

Name of the Vulnerable Software and Affected Versions: Dovecot affected versions not specified Description: The issue is related to an out of bounds read that can be triggered by a specially crafted email message delivered over SMTP and passed on to Dovecot by MTA. This can result in potential...

DEBIAN-CVE-2018-0489

Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this...

Microsoft Windows Multiple Vulnerabilities (KB4074598)

This host is missing a critical security update according to Microsoft KB4074598 SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2017-17723

In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp. Remote attackers can exploit this vulnerability to disclose memory data or cause a denial of service via a crafted TIFF file...

jeecms version 9.2 has xml external entity injection vulnerability

JEECMS is Jiangxi Jinlei Technology Development Co., Ltd. developed a support for WeChat small program, WeChat public number / service number, column model, content model cross-customization, as well as with the payment and financial settlement of the content of the e-commerce as one of the conte...

The vulnerability of the Media Framework component of the Android operating system, which allows for the disclosure of protected information

The vulnerability of the Media Framework component decoder/impeg2dapimain.c in the Android operating system is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...