CVE-2017-14923

The CVE-2017-14923 issue affects Tine 2.0 Community Edition prior to 2017.08.4, exposing a Stored XSS via an IMG element in the Leadname field. An authenticated user can inject JavaScript that is mishandled when rendered by admins and other users. CVSS data in the records indicates a MEDIUM base ...

CVE-2017-14925

CVE-2017-14925 affects Tiki Wiki before certain versions (16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, 15 LTS before 15.5 LTS). The vulnerability is a Cross-Site Request Forgery (CSRF) via an IMG element, related to tiki-objectpermissions.php, enabling an authenticated user to edit global per...

CVE-2017-14921

Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users...

CVE-2017-14924

Cross-Site Request Forgery CSRF vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element, related to...

CVE-2017-14744

UEditor 1.4.3.3 has XSS via the SRC attribute of an IFRAME element...

Sql injection

Faleemi FSC-880 00.01.01.0048P2 devices allow unauthenticated SQL injection via the Username element in an XML document to /onvif/deviceservice, as demonstrated by reading the admin password...

Broadcom 802.11r (FT) Reassociation Response Overflows Vulnerability

Broadcom suffers from multiple overflow vulnerabilities when handling 802.11r FT Reassociation Response. Broadcom: Multiple overflows when handling 802.11r FT Reassociation Response CVE-2017-11121 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. Thes...

CVE-2017-14629

In sam2p 0.49.3, the inxpmreader function in inxpm.cpp has an integer signedness error, leading to a crash when writing to an out-of-bounds array element...

CVE-2017-14482

Removed by vendor...

CVE-2017-14482

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe...

The vulnerability in the “tab setup” function of the console program Newsbeuter, for versions 0.7 to 2.9 of the Debian GNU/Linux operating system, allows a hacker to inject code.

The vulnerability of the “tab setup” function in the Newsbeuter console program, for versions 0.7 to 2.9 of the Debian GNU/Linux operating system, is related to insufficient elimination of special elements in the operating system’s data queries. Exploiting this vulnerability allows a malicious...

The vulnerability of the Ultra Services Framework Element Manager’s network management tool, related to errors in managing registration data, allows a perpetrator to gain access to the system with superuser privileges.

The vulnerability of the Ultra Services Framework Element Manager network management tool is related to errors in managing registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the system with superuser privileges...

Rockstar Games: Blind SSRF in emblem editor (2)

Hello, As per your recommendation in 233301, I'm submitting a PoC for another blind SSRF in the emblem editor. To oversight here is allowing absolute url values for the fill attribute: path fill="urlhttps://requestb.in/15rxmgv1test" stroke="a1a1a1" ... Upon publishing an emblem containing such an...

CVE-2017-12717

An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.220170817. A maliciously crafted dll file placed earlier in the search path may allow an attacker to execute code within the context of the application...

CVE-2017-12717

Technical details about CVE-2017-12717 are not provided in the connected documents. The initial description notes an uncontrolled search path element in Advantech WebAccess before V8.2_20170817, but no further details are available here. Monitor for updates.

AzeoTech DAQFactory

CVSS v3 7.1 ATTENTION: Local access and user-level privileges are required to exploit these vulnerabilities Vendor: AzeoTech Equipment: DAQFactory Vulnerabilities: Incorrect Default Permissions, Uncontrolled Search Path Element AFFECTED PRODUCTS AzeoTech reports that the vulnerabilities affect th...

GraphicsMagick Denial of Service Vulnerability (CNVD-2017-237198)

GraphicsMagick is a simple set of image processing tools. The tool provides resizing, rotating, highlighting and other functions to images. A denial of service vulnerability exists in the 'SVGStartElement' function of the coders/svg.c file in GraphicsMagick version 1.3.26. A remote attacker can...

UBUNTU-CVE-2017-13065

GraphicsMagick 1.3.26 has a NULL pointer dereference vulnerability in the function SVGStartElement in coders/svg.c...

DEBIAN-CVE-2017-13065

GraphicsMagick 1.3.26 has a NULL pointer dereference vulnerability in the function SVGStartElement in coders/svg.c...

CVE-2017-12979

DokuWiki through 2017-02-19c has stored XSS when rendering a malicious language name in a code element, in /inc/parser/xhtml.php. An attacker can create or edit a wiki with this element to trigger JavaScript execution...