Design/Logic Flaw

Linux foundation ONOS 1.9.0 allows unauthenticated use of websockets...

Open redirect

Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user web login function resulting in unauthorized account access...

CVE-2017-1000081

CVE-2017-1000081 affects Linux Foundation ONOS 1.9.0 and is due to unauthenticated upload of applications (.oar), enabling remote code execution. Primary sources (NVD) cite high/critical impacts (CVSSv2: 7.5/Partial partial integrity and availability; CVSSv3.1: 9.8 with high impact and network at...

CVE-2017-1000027

CVE-2017-1000027 concerns Koozali Foundation SME Server (versions 8.x–10.x). The vulnerability is an open URL redirect in the user web login function, enabling unauthorized account access. The available connected documents confirm the affected product family and the open redirect flaw as the root...

CVE-2017-1000079

Linux foundation ONOS 1.9.0 is vulnerable to a DoS...

CVE-2017-1000081

Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications .oar resulting in remote code execution...

CVE-2017-1000078

Linux foundation ONOS 1.9 is vulnerable to XSS in the device. registration...

CVE-2017-1000079

The provided connected documents confirm a denial-of-service vulnerability in Linux Foundation ONOS 1.9.0 (CVE-2017-1000079). Details explicitly present: affected product (ONOS 1.9.0), vulnerability class (DoS), and vendor/repository context. The CNVD entry states a DoS exists; NVD data lists CVS...

CVE-2017-1000080

Linux foundation ONOS 1.9.0 allows unauthenticated use of websockets...

CVE-2017-1000080

CVE-2017-1000080 affects Linux Foundation ONOS 1.9.0. The vulnerability allows unauthenticated use of the websocket protocol, enabling an attacker to interact with ONOS WS endpoints without authentication. Associated sources (CNVD-2017-19578, NVD entry) describe exploitation as unauthenticated WS...

JVN#81676004: Installers of Mozilla Firefox and Thunderbird for Windows may insecurely load Dynamic Link Libraries

Installers of Mozilla Firefox and Thunderbird for Windows provided by Mozilla Foundation contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer...

Apache Struts 2 remote command execution vulnerability(S2-048)

Vulnerability overview Struts is a Apache Software Foundation ASF sponsored an open source project. By using JavaServlet/JSP technology, is implemented based on the Java EEWeb application of the MVC design pattern application framework, MVC is a classic design pattern in a classic product. But in...

CVE-2016-9987

IBM Jazz Foundation Reporting Service JRS 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

CVE-2016-9988

IBM Jazz Foundation Reporting Service JRS 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

CVE-2016-9986

IBM Jazz Foundation Reporting Service JRS 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

CVE-2016-9989

IBM Jazz Foundation Reporting Service JRS 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

Information disclosure

IBM Jazz Foundation could allow an authenticated attacker to obtain sensitive information from error message stack traces. IBM X-Force ID: 119528...

CVE-2016-9700

IBM Jazz Foundation could allow an authenticated attacker to obtain sensitive information from error message stack traces. IBM X-Force ID: 119528...

CVE-2016-9700

IBM Jazz Foundation could allow an authenticated attacker to obtain sensitive information from error message stack traces. IBM X-Force ID: 119528...

Cross site scripting

IBM Jazz Foundation Reporting Service JRS 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...