CVE-2018-5474

Philips Intellispace Portal all versions 7.0.x and 8.0.x have an input validation vulnerability that could allow a remote attacker to execute arbitrary code or cause the application to crash...

The vulnerability of the HPE Intelligent Management Center PLAT software platform, related to insufficient validation of input data, allows a perpetrator to execute arbitrary code.

The vulnerability of the HPE Intelligent Management Center PLAT software is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

The vulnerability of the faultEventSelectFactWithRecover.xhtml component in the HPE Intelligent Management Center PLAT software platform allows a attacker to execute arbitrary code.

The vulnerability of the faultEventSelectFactWithRecover.xhtml component in the HPE Intelligent Management Center PLAT software platform is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to execute arbitrary code using...

CVE-2018-0113

A vulnerability in an operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the daemon user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by posting...

The vulnerability of Blink rendering module in Google Chrome browsers allows attackers to trigger false browser messages.

The vulnerability of Google Chrome’s Blink engine exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to trigger false browser messages using a specially created HTML page...

Multiple Huawei products cross-border read vulnerability (CNVD-2017-34419)

Huawei RP200 and TE series are Huawei's all-in-one desktop and high-definition videoconferencing products for high-end customers. The out-of-bounds read vulnerability exists in several Huawei products, as the devices fail to adequately verify user input. A remote attacker could exploit this...

CVE-2017-12284

A vulnerability in the web interface of Cisco Jabber for Windows Client could allow an authenticated, local attacker to retrieve user profile information, which could lead to the disclosure of confidential information. The vulnerability is due to a lack of input- and validation-checking mechanism...

The vulnerability of the delivery interface component in NetScaler SD-WAN applications allows a attacker to execute arbitrary shell commands.

The vulnerability of the control interface component for NetScaler SD-WAN applications exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary shell commands with root privileges, using the CGISESSID cookie file...

The vulnerability of the `ff_amf_get_field_value` function in the `libavformat/rtmppkt.c` multimedia library of FFmpeg allows a attacker to cause a service failure.

The vulnerability of the ffamfgetfieldvalue function in the libavformat/rtmppkt.c file of the FFmpeg multimedia library exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failure segmentation fault a...

The vulnerability of the get_process_ttyname function in the Sudo system administration program allows a malicious actor to execute arbitrary commands and gain access to sensitive information.

The vulnerability of the getprocessttyname function in the Sudo system administration program exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely and gain access to sensitive information...

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CNVD-2017-02006)

Cisco Unified Communications Manager CUCM, Unified CM is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. A cross-site scripting vulnerability exists i...

CVE-2016-0265

IBM Campaign is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL ...

The vulnerability of the Apache Struts software platform, which allows a hacker to execute arbitrary code

The vulnerability of the REST plugin for the Apache Struts software platform exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created expression...

The vulnerability of the console-based graphic editor ImageMagick, which allows a hacker to execute arbitrary code.

The vulnerability of the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT command-line graphic editors based on ImageMagick exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using metasymbols within a speciall...

squid: multiple issues in ESI processing

Buffer overflow and input validation flaws were found in the way Squid processed ESI responses. If Squid was used as a reverse proxy, or for TLS/HTTPS interception, a remote attacker able to control ESI components on an HTTP server could use these flaws to crash Squid, disclose parts of the stack...

The vulnerability of Xen hypervisors, which allows a malicious actor to trigger a service failure

The vulnerability of Xen hypervisors exists due to insufficient validation of input data. Exploiting this vulnerability can allow a local attacker to cause a service failure abnormal termination of operations...

The vulnerabilities of BIG-IP Advanced Firewall Manager, BIG-IP Application Acceleration Manager for application delivery, BIG-IP Access Policy Manager for access control and remote authentication, BIG-IP Application Security Manager for application protection, BIG-IP Analytics for infrastructure status analysis, BIG-IP Policy Enforcement Manager for network traffic control and management, BIG-IP Link Controller for internet traffic balancing, and BIG-IP Local Traffic Manager for local traffic balancing – allow attackers to trigger service interruptions.

The vulnerability of BIG-IP Advanced Firewall Manager, BIG-IP Application Acceleration Manager for application delivery, BIG-IP Access Policy Manager for access control and remote authentication, BIG-IP Application Security Manager for application protection, BIG-IP Analytics for infrastructure...

The vulnerability of the microprogramming software of the Cisco TelePresence Video Communication Server allows a intruder to trigger a service failure.

The vulnerability of the microprogramming software of the Cisco TelePresence Video Communication Server exists due to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause a service failure disabling VoIP services by usi...

The vulnerability of the SolarWinds Storage Manager data management software allows a hacker to upload and execute arbitrary files.

The vulnerability of the ProcessFileUpload.jsp component in the SolarWinds Storage Manager data management software exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to remotely upload and execute arbitrary files...

The software for managing VMware vCenter Server is vulnerable, allowing attackers to cause a system failure.

The vulnerability of the Host Heartbeat service for VMware software that manages virtual infrastructure exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to trigger an emergency shutdown of the service by sending a specially crafted UDP...