JVN#77412145: SONY Portable Wireless Server WG-C10 fails to restrict access permissions

Portable Wireless Server WG-C10 provided by Sony Corporation fails to restrict access permissions CWE-284. Impact An authenticated attacker may obtain or alter information stored in the external storage connected to product. Solution Apply a Workaround The following workarounds may mitigate the...

EMC RSA Authentication Manager Cross-Site Scripting Vulnerability (CNVD-2017-24569)

EMC RSA Authentication Manager is a centralized binary authentication software from EMC. The software centralizes the management of binary authentication, security tokens, methods and users across physical sites. A cross-site scripting vulnerability exists in EMC RSA Authentication Manager 8.2 SP...

UBUNTU-CVE-2017-3650

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: C API. Supported versions that are affected are 5.7.18 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attack...

FileCapsule Deluxe Portable Insecure Dynamic Loading Vulnerability (CNVD-2017-23962)

FileCapsule Deluxe Portable is a file encryption software. A security vulnerability exists in FileCapsule Deluxe Portable 1.0.5.1 and earlier versions. The vulnerability can be exploited to execute arbitrary code...

FileCapsule Deluxe Portable Insecure Dynamic Loading Vulnerability

FileCapsule Deluxe Portable is a file encryption software. A security vulnerability exists in FileCapsule Deluxe Portable 2.0.9 and earlier versions. The vulnerability can be exploited to execute arbitrary code...

FileCapsule Deluxe Portable Insecure Dynamic Loading Vulnerability (CNVD-2017-23961)

FileCapsule Deluxe Portable is a file encryption software. A security vulnerability exists in Encrypted Files in Self-Decryption Format in FileCapsule Deluxe Portable 1.0.4.1 and earlier versions. The vulnerability can be exploited to execute arbitrary code...

Cross site scripting

Adobe Connect versions 9.6.1 and earlier have a reflected cross-site scripting vulnerability. Successful exploitation could lead to a reflected cross-site scripting attack...

Atutor Elevation of Privilege Vulnerability

ATutor is an open source Web-based learning content management system LCMS developed by the ATutor team. The system includes teaching content management, forums, chat rooms and other modules. A security vulnerability exists in ATutor 2.2.1 and previous versions. An attacker can exploit the...

PT-2017-19200 · Cairo +3 · Cairo +3

Name of the Vulnerable Software and Affected Versions: cairo versions 1.15.6 and earlier Description: The issue allows remote attackers to cause a denial of service due to an out-of-bounds read. This is because of mishandling of an unexpected malloc0 call in the cairo-truetype-subset.c file...

PT-2017-15636 · Microsoft +2 · Internet Explorer +2

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 26.0.0.131 and earlier Description: A security bypass issue in Adobe Flash Player allows attackers to obtain sensitive information. This issue is related to the Flash API used by Internet Explorer. Successful...

CVE-2017-2227

Untrusted search path vulnerability in The installer of Charamin OMP Version 1.1.7.4 and earlier, Version 1.2.0.0 Beta and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2239

CVE-2017-2239 affects Marp v0.0.10 and earlier, where JavaScript in Markdown contents can access local resources/files due to improper access control. The JVN entry confirms impact: local files may be read and leaked. Remediation is to update to Marp v0.0.11, which restricts JavaScript from acces...

CVE-2017-10974

Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about use of an initial /%5C sequence to defeat traversal protection mechanisms; the initial /%5C sequence was apparently not discussed in earlier research on thi...

Huawei OceanStor UDS Code Injection Vulnerability

Huawei OceanStor UDS is a high-density storage node and distributed storage system based on ARM architecture from Huawei, China. A security vulnerability exists in Huawei OceanStor UDS V100R002C01SPC101 and earlier versions. A remote attacker can exploit the vulnerability by injecting SHELL scrip...

Soffid IAM console arbitrary code execution vulnerability

Soffid IAM console is a distributed Identity Manager console program that supports SQL-based and file-based authentication for both web and natively-based applications. A security vulnerability exists in Soffid IAM console version 1.7.4 and earlier. A remote attacker can exploit the vulnerability...

Xen has multiple vulnerabilities (CNVD-2017-21732)

Xen is an open source virtual machine monitor product developed at the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in t...

CVE-2017-3087

Adobe Captivate versions 9 and earlier have an information disclosure vulnerability resulting from abuse of the quiz reporting feature in Captivate...

CVE-2017-1000373

The OpenBSD qsort function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort to deterministically recurse N/4 times. This allows attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in...

CVE-2017-1000366

glibc contains a vulnerability that allows specially crafted LDLIBRARYPATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap...

Critical: glibc

Issue Overview: Glibc contains a vulnerability that allows specially crafted LDLIBRARYPATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation o...