jBPM Migration XML External Entity Injection Vulnerability

jBPM Migration is a migration tool. jBPM Migration is implemented with an XML external entity injection vulnerability that can be exploited by remote attackers to submit a special request, obtain sensitive information, or conduct a denial of service attack...

The vulnerability of the Apache ActiveMQ software platform lies in the improper limitation of XML references to external objects. This allows attackers to disclose sensitive information, cause service failures, or have other adverse effects.

The vulnerability of the Apache ActiveMQ software platform is related to an improper limitation on XML references to external objects. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information, cause service failures, or have other adverse effects through special...

Microsoft Exchange Spoofing Vulnerability

Microsoft Exchange Server 2016 is a suite of email service programs from Microsoft USA that provides email access, storage, forwarding, voicemail, email filtering and screening, etc. CU6 and CU7 are 2 of the cumulative updates. A security vulnerability exists in Microsoft Exchange Server 2016 CU6...

CVE-2017-1507

IBM Jazz Foundation Products could disclose sensitive information during a scan that could lead to further attacks against the system. IBM X-Force ID: 129619...

CVE-2017-11273

An issue was discovered in Adobe Digital Editions 4.5.6 and earlier versions. Adobe Digital Editions parses crafted XML files in an unsafe manner, which could lead to sensitive information disclosure...

Google Android Media framework information disclosure vulnerability (CNVD-2017-38460)

Android on Google Pixel and Nexus is a Linux-based open source operating system for the Google Pixel and Nexus smartphones developed by Google and the Open Handset Alliance OHA, of which the Media framework is a part. Media framework is one of the multimedia development framework. An information...

AZL-44070 CVE-2017-15275 affecting package samba for versions less than 4.18.3-1

Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory...

Privilege escalation

INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE...

CVE-2017-15099

CVE-2017-15099 involves an information-disclosure and access-restriction bypass in PostgreSQL through faulty checks in the PostgreSQL engine when using "INSERT … ON CONFLICT DO UPDATE". Affected versions are PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10. The vulnerabili...

Design/Logic Flaw

Invalid jsonpopulaterecordset or jsonbpopulaterecordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory...

CVE-2017-4929

VMware NSX Edge 6.2.x before 6.2.9 and 6.3.x before 6.3.5 contains a moderate Cross-Site Scripting XSS issue which may lead to information disclosure...

USN-3477-1 firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, obtain sensitive information, bypass same-origin restrictions, bypass CSP...

CVE-2017-5738

Escalation of privilege vulnerability in admin portal for Intel Unite App versions 3.1.32.12, 3.1.41.18 and 3.1.45.26 allows an attacker with network access to cause a denial of service and/or information disclosure...

Huawei Enjoy 6 MTK Platform Arbitrary Memory Access Vulnerability

The Huawei Enjoy 6 is a smartphone from the Chinese company Huawei Huawei. The Huawei Enjoy 6 MTK platform suffers from an arbitrary memory access vulnerability, which can be used by attackers to trick users into installing malicious apps, which can be exploited to send specific parameters leadin...

CVE-2017-11835

CVE-2017-11835 affects the Microsoft Windows Embedded OpenType (EOT) font engine. The vulnerability exists in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, where specially crafted embedded fonts parsed by the EOT font engine can allow a local attacker who logs on and opens a document to read...

Microsoft Windows Multiple Vulnerabilities (KB4048968)

This host is missing an important security update according to Microsoft KB4048968 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

The vulnerability of the Media Framework component of the Android operating system, which allows a hacker to disclose confidential information

The vulnerability of the Media Framework component in the Android operating system is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to disclose confidential information remotely...

Asterisk: Multiple vulnerabilities

Background A Modular Open Source PBX System. Description Multiple vulnerabilities have been discovered in Asterisk. Please review the referenced CVE identifiers for details. Impact A remote attacker could execute arbitrary code, cause a denial of service condition, or cause an unauthorized data...

CVE-2017-1220

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 123860...

keycloak: CSRF token fixation

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks...