UBUNTU-CVE-2017-12979

DokuWiki through 2017-02-19c has stored XSS when rendering a malicious language name in a code element, in /inc/parser/xhtml.php. An attacker can create or edit a wiki with this element to trigger JavaScript execution...

CVE-2017-12979

DokuWiki through 2017-02-19c has stored XSS when rendering a malicious language name in a code element, in /inc/parser/xhtml.php. An attacker can create or edit a wiki with this element to trigger JavaScript execution...

CVE-2017-12980

DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php. An attacker can create or edit a wiki that uses RSS or Atom data from an attacker-controlled server to trigger JavaScript execution. The JavaScript can be in an author field, as...

CVE-2017-12979

DokuWiki through 2017-02-19c has stored XSS when rendering a malicious language name in a code element, in /inc/parser/xhtml.php. An attacker can create or edit a wiki with this element to trigger JavaScript execution...

CVE-2017-6710

A vulnerability in the Cisco Virtual Network Function VNF Element Manager could allow an authenticated, remote attacker to elevate privileges and run commands in the context of the root user on the server. The vulnerability is due to command settings that allow Cisco VNF Element Manager users to...

CVE-2017-6710

A vulnerability in the Cisco Virtual Network Function VNF Element Manager could allow an authenticated, remote attacker to elevate privileges and run commands in the context of the root user on the server. The vulnerability is due to command settings that allow Cisco VNF Element Manager users to...

Design/Logic Flaw

A vulnerability in the Cisco Virtual Network Function VNF Element Manager could allow an authenticated, remote attacker to elevate privileges and run commands in the context of the root user on the server. The vulnerability is due to command settings that allow Cisco VNF Element Manager users to...

CVE-2017-6710

A vulnerability in the Cisco Virtual Network Function VNF Element Manager could allow an authenticated, remote attacker to elevate privileges and run commands in the context of the root user on the server. The vulnerability is due to command settings that allow Cisco VNF Element Manager users to...

CVE-2017-6710

CVE-2017-6710 affects Cisco’s Virtual Network Function (VNF) Element Manager. A vulnerability in command settings allows authenticated, remote attackers to elevate privileges and execute arbitrary commands as root on the server. This stems from how the VNF Element Manager handles user-specified c...

Cisco Patches Privilege Escalation Bugs in APIC

Cisco patched two high-severity vulnerabilities in its Cisco Application Policy Infrastructure Controller APIC that could allow an attacker to elevate privileges on the host machine. The product automates and manages the APIC fabric, optimizing application performance and provisioning for physica...

Cisco Virtual Network Function Element Manager Arbitrary Command Execution Vulnerability

Cisco Virtual Network Function Element Manager is the virtual network function element manager. A security vulnerability in the Cisco Virtual Network Function Element Manager command settings allows remote attackers to exploit the vulnerability to submit a special request to execute arbitrary...

Cisco Virtual Network Function Element Manager Arbitrary Command Execution Vulnerability

A vulnerability in the Cisco Virtual Network Function VNF Element Manager could allow an authenticated, remote attacker to elevate privileges and run commands in the context of the root user on the server. The vulnerability is due to command settings that allow Cisco VNF Element Manager users to...

CVE-2017-9646

An Uncontrolled Search Path Element issue was discovered in Solar Controls Heating Control Downloader HCDownloader Version 1.0.1.15 and prior. An uncontrolled search path element has been identified, which could allow an attacker to execute arbitrary code on a target system using a malicious DLL...

CVE-2017-9648

An Uncontrolled Search Path Element issue was discovered in Solar Controls WATTConfig M Software Version 2.5.10.1 and prior. An uncontrolled search path element has been identified, which could allow an attacker to execute arbitrary code on a target system using a malicious DLL file...

CVE-2017-9648

The CVE-2017-9648 issue affects Solar Controls WATTConfig M Software, versions 2.5.10.1 and earlier. It stems from an Uncontrolled Search Path Element (CWE-427) that could allow arbitrary code execution via a malicious DLL file on the target system. Affected product: WATTConfig M Software for Win...

CVE-2017-9646

CVE-2017-9646 affects Solar Controls HCDownloader (Heating Control Downloader) versions 1.0.1.15 and earlier. Root cause: Uncontrolled Search Path Element (CWE-427) could allow arbitrary code execution via a malicious DLL loaded on the target. Documented impact is high (CVE CVSSv3 base 7.8; local...

Solar Controls WATTConfig M Software

CVSS v3 7.8 ATTENTION: Low skill level to exploit. Vendor: Solar Controls Equipment: WATTConfig M Software Vulnerability: Uncontrolled Search Path Element AFFECTED PRODUCTS The following versions of Solar Controls’ WATTConfig M Software for Windows 2.5.10 for M SSR/MAX PLCs are affected: WATTConf...

CVE-2017-7802

A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If these elements have been freed due to a lack of strong references, a potentially exploitable crash may occur when the freed elements are accessed. This vulnerability affects...

CVE-2017-7802

A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If these elements have been freed due to a lack of strong references, a potentially exploitable crash may occur when the freed elements are accessed. This vulnerability affects...

WebKit: use-after-free in WebCore::InputType::element(CVE-2017-7042)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= var runcount = 0; function go runcount++; ifruncount 2 return; i.type = "foo"; i.select; i.type =...