CVE-2017-12862

In modules/imgcodecs/src/grfmtpxm.cpp, the length of buffer AutoBuffer src is small than expected, which will cause copy buffer overflow later. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier...

CVE-2017-11279

Adobe Digital Editions 4.5.4 and earlier has an exploitable use after free vulnerability. Successful exploitation could lead to arbitrary code execution...

UBUNTU-CVE-2017-7798

The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code. In the worst case, this could allow arbitrary code execution when opening a malicious page with the style editor tool. This vulnerability affects Firefox ESR 52.3 and...

Apache Wink XML External Entity Vulnerability

Apache Wink is a U.S. Apache Apache Software Foundation for building RESTful Web services framework , which consists of a server module and the client module for the development of RESTful Web services . An XML external entity injection vulnerability exists in Apache Wink 1.1.1 and earlier...

Moxa SoftNVR-IA Live Viewer DLL Local Arbitrary Code Execution Vulnerability

Moxa SoftNVR-IA Live Viewer is a video surveillance software package developed by Moxa for industrial automation systems. A DLL local arbitrary code execution vulnerability exists in Moxa SoftNVR-IA Live Viewer 3.30.3122 and earlier versions, which stems from the program failing to properly filte...

OpenCV Denial of Service Vulnerability (CNVD-2017-24179)

OpenCV is an open source, cross-platform, lightweight computer vision library. A denial of service vulnerability exists in the 'icvCvtBGRA2BGR8uC4C3R' function in OpenCV 3.3 and earlier versions. An attacker can exploit this vulnerability to cause a denial of service read across boundaries...

Pegasystem PEGA Platform Cross-Site Scripting Vulnerability

Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications for BPM Business Process Management, Case Management, Real Time Decision Making and CRM Customer Relationship Management. A cross-site scripting vulnerability...

Oracle MySQL Server Denial of Service Vulnerability (CNVD-2017-24326)

Oracle MySQL is an open source relational database management system from Oracle. A security vulnerability exists in the X Plugin subcomponent of the MySQL Server component in Oracle MySQL, version 5.7.16 and earlier. A remote attacker could exploit this vulnerability to cause a denial of service...

CVE-2017-7007

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the "EventKitUI" component. It allows remote attackers to cause a denial of service resource consumption and application crash...

EMC RSA Authentication Manager Cross-Site Scripting Vulnerability (CNVD-2017-24569)

EMC RSA Authentication Manager is a centralized binary authentication software from EMC. The software centralizes the management of binary authentication, security tokens, methods and users across physical sites. A cross-site scripting vulnerability exists in EMC RSA Authentication Manager 8.2 SP...

JVN#77412145: SONY Portable Wireless Server WG-C10 fails to restrict access permissions

Portable Wireless Server WG-C10 provided by Sony Corporation fails to restrict access permissions CWE-284. Impact An authenticated attacker may obtain or alter information stored in the external storage connected to product. Solution Apply a Workaround The following workarounds may mitigate the...

UBUNTU-CVE-2017-3650

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: C API. Supported versions that are affected are 5.7.18 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attack...

FileCapsule Deluxe Portable Insecure Dynamic Loading Vulnerability (CNVD-2017-23962)

FileCapsule Deluxe Portable is a file encryption software. A security vulnerability exists in FileCapsule Deluxe Portable 1.0.5.1 and earlier versions. The vulnerability can be exploited to execute arbitrary code...

FileCapsule Deluxe Portable Insecure Dynamic Loading Vulnerability

FileCapsule Deluxe Portable is a file encryption software. A security vulnerability exists in FileCapsule Deluxe Portable 2.0.9 and earlier versions. The vulnerability can be exploited to execute arbitrary code...

FileCapsule Deluxe Portable Insecure Dynamic Loading Vulnerability (CNVD-2017-23961)

FileCapsule Deluxe Portable is a file encryption software. A security vulnerability exists in Encrypted Files in Self-Decryption Format in FileCapsule Deluxe Portable 1.0.4.1 and earlier versions. The vulnerability can be exploited to execute arbitrary code...

Cross site scripting

Adobe Connect versions 9.6.1 and earlier have a reflected cross-site scripting vulnerability. Successful exploitation could lead to a reflected cross-site scripting attack...

Atutor Elevation of Privilege Vulnerability

ATutor is an open source Web-based learning content management system LCMS developed by the ATutor team. The system includes teaching content management, forums, chat rooms and other modules. A security vulnerability exists in ATutor 2.2.1 and previous versions. An attacker can exploit the...

PT-2017-19200 · Cairo +3 · Cairo +3

Name of the Vulnerable Software and Affected Versions: cairo versions 1.15.6 and earlier Description: The issue allows remote attackers to cause a denial of service due to an out-of-bounds read. This is because of mishandling of an unexpected malloc0 call in the cairo-truetype-subset.c file...

PT-2017-15636 · Microsoft +2 · Internet Explorer +2

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 26.0.0.131 and earlier Description: A security bypass issue in Adobe Flash Player allows attackers to obtain sensitive information. This issue is related to the Flash API used by Internet Explorer. Successful...

CVE-2017-2227

Untrusted search path vulnerability in The installer of Charamin OMP Version 1.1.7.4 and earlier, Version 1.2.0.0 Beta and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...