CVE-2017-5071

Removed by vendor...

CVE-2017-5092

Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page...

CVE-2017-5097

CVE-2017-5097 affects Google Chrome on Linux, via Skia. Vulnerable component: Skia in Chrome; root cause: insufficient validation of untrusted input leading to an out-of-bounds memory read when processing crafted HTML pages. Impact: potential memory read with partial confidentiality and integrity...

Digium Asterisk app_minivm Caller-ID Command Execution (CVE-2017-14100)

A command execution vulnerability exists in Digium Asterisk. The vulnerability is due to insufficient validation of Caller-IDs within SIP requests when the MinivmNotify dialplan function is used with an external notification program. A remote, authenticated attacker could exploit this vulnerabili...

The vulnerability of the skb_flow_dissect function in the flow_dissector.c file of the kernel’s Linux operating system allows a attacker to cause a service failure or execute arbitrary code.

The vulnerability of the skbflowdissect function in the flowdissector.c file of the Linux kernel’s network subsystem is related to insufficient input validation. The function returns a value of true for the keycontrol protocol without setting values for nproto, ipproto, and thoff. Exploiting this...

CVE-2017-6776

A vulnerability in the web framework of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface. The vulnerability is due to insufficient validation of user-supplied input by the affecte...

Cross site scripting

A vulnerability in the web framework of Cisco Elastic Services Controller ESC could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface. The vulnerability is due to insufficient validation of user-supplied input by the affecte...

Cisco Prime Collaboration Provisioning licensestatus.jsp Arbitrary File Deletion (CVE-2017-6635)

An arbitrary file deletion exists in Cisco Prime Collaboration Provisioning. The vulnerability is due to insufficient validation on user-supplied paths before using them in file operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted request to the targe...

Cisco Identity Services Engine Guest Portal Cross-Site Scripting Vulnerability (cisco-sa-20170705-ise2)

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected device. SPDX-FileCopyrightText: 2017 Greenbone AG Some...

CVE-2017-7669

In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root...

CVE-2017-6654

A vulnerability in the web-based management interface of Cisco Unified Communications Manager 10.5 through 11.5 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerabilit...

CVE-2017-9067

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...

Input validation

A vulnerability in the Plug-and-Play PnP subsystem of the Cisco Aironet 1800, 2800, and 3800 Series Access Points running a Lightweight Access Point AP or Mobility Express image could allow an unauthenticated, adjacent attacker to execute arbitrary code with root privileges. The vulnerability is...

Input validation

A vulnerability in the Internet Key Exchange Version 1 IKEv1 XAUTH code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of an affected system. The vulnerability is due to insufficient validation of the IKEv1 XAUTH parameters passed during an IKEv1 negotiation...

Huawei LogCenter Denial of Service Vulnerability

Huawei LogCenter is a set of log management software from Huawei, China. A denial of service vulnerability exists in Huawei LogCenter version V100R001C10, which stems from the program's lack of legitimacy checking of incoming device information data. An attacker can exploit this vulnerability to...

[ASA-201704-3] mediawiki: multiple issues

Arch Linux Security Advisory ASA-201704-3 ========================================= Severity: High Date : 2017-04-07 CVE-ID : CVE-2017-0361 CVE-2017-0362 CVE-2017-0363 CVE-2017-0364 CVE-2017-0365 CVE-2017-0366 CVE-2017-0367 CVE-2017-0368 CVE-2017-0369 CVE-2017-0370 CVE-2017-0372 Package : mediawi...

Cisco IOS XE L2TP Parsing DoS (cisco-sa-20170322-l2tp)

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in its Layer 2 Tunneling Protocol L2TP parsing function due to insufficient validation of L2TP packets. An unauthenticated, remote attacker can exploit...

CVE-2016-4927

CVE-2016-4927 affects Junos Space (pre-15.2R2). The root cause is insufficient validation of SSH keys during Space-to-managed-device communications, enabling MITM-style attacks. Impact is partial confidentiality/integrity/availability according to CVSS, with network access and no authentication r...

WordPress Plugin Flash Rotator Gallery SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers set up a personal blog site.Flash Rotator Gallery is one of the plug-ins to add flash effects to the picture. A SQL injection vulnerability exist...

CVE-2017-6596

partclone.chkimg in partclone 0.2.89 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone image header. An attacker may be able to launch a 'Denial of Service attack' in the context of the user running the affected application...