CVE-2017-15297

CVE-2017-15297 concerns SAP Hostcontrol where the SOAP SAPControl endpoint does not require authentication, enabling unauthenticated access. The vulnerability is documented in SAP Security Note 2442993. According to the NVD entry, the affected component is the SAP Hostcontrol SOAP interface, with...

Design/Logic Flaw

The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service service crash via a crafted request, aka SAP Security Note 2389181...

CVE-2017-14581

The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service service crash via a crafted request, aka SAP Security Note 2389181...

CVE-2017-14581

The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service service crash via a crafted request, aka SAP Security Note 2389181...

CVE-2017-14581

The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service service crash via a crafted request, aka SAP Security Note 2389181...

CVE-2017-14511

An issue was discovered in SAP E-Recruiting aka ERECRUIT 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email address. However, this measure can be bypassed and attackers can register and...

Code injection

An issue was discovered in SAP E-Recruiting aka ERECRUIT 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email address. However, this measure can be bypassed and attackers can register and...

CVE-2017-14511

An issue was discovered in SAP E-Recruiting aka ERECRUIT 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receives a link by email to confirm access to the provided email address. However, this measure can be bypassed and attackers can register and...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the 1 CompanyName, 2 CompanyAddress, 3 CompanyZip, 4 CompanyTown, 5 Fax, 6 EMail, 7 Web, 8 ManagingDirectors, 9 Note, 10 Capital, 11 ProfId1, 12...

PT-2017-7287

Name of the Vulnerable Software and Affected Versions Drupal Stickynote module versions prior to 7.x-1.3 Description A cross-site scripting XSS issue allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin...

CVE-2015-7879: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page...

Apache Software Foundation Releases Security Update

The Apache Software Foundation has released a security update to address a vulnerability in Struts 2. A remote attacker could exploit this vulnerability to take control of an affected system. US-CERT encourages users and administrators to review the Apache Security Bulletin and Vulnerability Note...

DEBIAN-CVE-2017-14032

ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL...

UBUNTU-CVE-2017-14032

ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL...

OS Identification : OUI

This plugin attempts to identify the operating system by examining the MAC address OUI. C Tenable, Inc. include"compat.inc"; if description scriptid102821; scriptversion"2.9"; scriptsetattributeattribute:"pluginmodificationdate", value:"2025/06/23"; scriptnameenglish:"OS Identification : OUI";...

Analysis of Ronggolawe Ransomware and How to Block It

In the last few years ransomware attacks have been significantly on the rise. This infamous trend began by targeting end point users’ machines, such as personal desktop and laptops. Later, it evolved and broadened the attack surface to target mobile phones and servers. Web Servers Not Immune to...

GNU Binutils 'bfd/elf.c' Remote Buffer Overflow Vulnerability

GNU Binutils a.k.a. GNU Binary Utilities or binutils is a set of programming language utility programs developed by the GNU Project to work with target files in a variety of formats, with connectors, assemblers, and other tools for target files and archives. A security vulnerability exists in the...

CVE-2017-12637

SAP NetWeaver Application Server Java 7.5 is affected by a local/file read vulnerability (CVE-2017-12637) in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows remote attackers to read arbitrary server files via a .. in the query string. The issue is confirmed in multiple connected s...

Information disclosure

DISPUTED An issue was discovered in SMA Solar Technology products. When signed into Sunny Explorer with a wrong password, it is possible to create a debug report, disclosing information regarding the application and allowing the attacker to create and save a .txt file with contents to his liking...

TiMidity++ 'insert_note_steps' Function Denial of Service Vulnerability

TiMidity++ is an open source audio file converter and player that can convert MIDI files to other formats. A security vulnerability exists in the 'insertnotesteps' function of the readmidi.c file in TiMidity++ version 2.14.0. A remote attacker can exploit this vulnerability to cause a denial of...