CVE-2017-3561

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM...

CVE-2017-3622

CVE-2017-3622 originally describes a local privilege-escalation in Solaris CDE (EXTREMEPARR) affecting Solaris 10; the related exploitability details show a directory-traversal in dtappgather that allows a local user to create a user-owned directory and, via loading a shared object, gain root pri...

CVE-2017-3614

Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks...

CVE-2017-3614

CVE-2017-3614 affects Oracle Berkeley DB Data Store. Affected are Data Store instances using libdb prior to 6.2.32 (e.g., libdb versions such as 5.3.28-6/7); patched versions are available (e.g., 5.3.28-7 and newer 6.2.32+). The vulnerability allows a user with logon to the host running Data Stor...

CVE-2017-3561

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM...

CVE-2017-3558

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily "exploitable" vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM...

CVE-2017-3589

Removed by vendor...

Get a Single View of WAF Events with the Imperva AppSecurity View App for Splunk Enterprise

Enterprises are adopting a hybrid infrastructure model to take advantage of rapid deployment of cloud-based services and higher computing power. A compilation of analyst predictions by SecureWorks, shows that the cloud continues to gain momentum as organizations embrace and benefit from new ways ...

KLA11028 A read/write local files vulnerability in Oracle VM Virtual Box

An unspecified vulnerability was found in Oracle VM VirtualBox. By exploiting this vulnerability low priveleged malicious users with logon to the infrastructure, where OracleVM VirtualBox is executed, can write to some of Oracle VM VirtualBox accessible data and read a subset of Oracle VM...

Oracle Automatic Service Request Local Vulnerability

Automatic Service Request ASR is an "Oracle Support Service" that provides automatic case generation in the event of common hardware component failures. A local security vulnerability exists in Oracle Automatic Service Request. It allows an attacker to log in to the Automatic Service Request ASR...

CVE-2017-6611

A vulnerability in the web framework code of Cisco Prime Infrastructure 2.22 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of some...

CVE-2017-6611

A vulnerability in the web framework code of Cisco Prime Infrastructure 2.22 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of some...

Cross site scripting

A vulnerability in the web framework code of Cisco Prime Infrastructure 2.22 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of some...

CVE-2017-6611

CVE-2017-6611 affects Cisco Prime Infrastructure 2.2(2). The root cause is insufficient input validation in the web framework code, enabling an unauthenticated, remote attacker to perform a cross-site scripting (XSS) attack on users of the web interface. Exploitation could allow execution of arbi...

CVE-2017-6611

A vulnerability in the web framework code of Cisco Prime Infrastructure 2.22 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of some...

The vulnerability of the Cisco Prime Infrastructure lifecycle management software and the Cisco Evolved Programmable Network Manager network service management software allows a hacker to gain access to confidential data.

The vulnerability of the Cisco Prime Infrastructure network lifecycle management software interface and the Cisco Evolved Programmable Network Manager network service management software is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious...

The vulnerability of the Cisco Prime Infrastructure network lifecycle management software allows a hacker to carry out a cross-site scripting attack.

The vulnerability in the HTTP web interface of the Cisco Prime Infrastructure network lifecycle management software exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

Cisco Prime Infrastructure Web Framework Code Cross-Site Scripting Vulnerability (cisco-sa-20170419-cpi)

A vulnerability in the web framework code of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might...

Cisco Prime Infrastructure Web Framework Code Cross-Site Scripting Vulnerability

A vulnerability in the web framework code of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of some...

Internet Bug Bounty: Mercurial can be tricked into granting authorized users access to the Python debugger

I reported this bug privately to Mercurial and they produced an out of band release to fix the bug here: https://www.mercurial-scm.org/wiki/WhatsNewMercurial4.1.3.282017-4-18.29 I produced a very detailed proof of concept with a Metasploit exploit module, which can be seen publicly here:...