Schneider Electric Triconex Tricon Unauthorized Operation Vulnerability (CNVD-2018-08449)

Triconex Tricon 3008 is a network equipment product from Schneider Electric France. An unauthorized operation vulnerability exists in the Schneider Electric Triconex Tricon. When a system call is made, registers are stored to a fixed storage location. Modifying the data in this location could all...

Microsoft Office: Show OneDrive Sign In

This test checks the setting for policy OpenVAS Vulnerability Test $Id: office2013skydrivesignin.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Show OneDrive Sign In Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is free...

JVN#52695336: EC-CUBE vulnerable to session fixation

EC-CUBE provided by LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a session fixation vulnerability CWE-384. Impact A remote attacker impersonating a logged in user may perform an unintended operation with the user's privilege. Solution Update the Softwa...

ATI Systems Emergency Mass Notification Systems False Alert Vulnerability (CNVD-2018-07875)

ATI Systems designs, builds and installs mass notification systems for the community, campus, industrial and military markets.Emergency Mass Notification Systems is an emergency mass notification system. An unauthorized operation vulnerability exists in ATI Systems Emergency Mass Notification...

Atlassian JIRA Server Security Bypass Vulnerability

Atlassian JIRA Server is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all kinds of problems and defects in the work. A security vulnerability exists in Atlassian JIRA Server including JIRA Core versions 7.6.0, 7.7.0, and 7.8.0 in a...

Denial of Service Vulnerability in Tengen Controls T920 PLCs

T-920 Programmable Logic Controller PLC is a product in the T9 series Programmable Logic Controller PLC series of China TengControl Technology TENGCONTROL TECHNOLOGY. The product is widely used in tobacco, petrochemical, water and other important industrial control site. A denial of service...

Cybozu Garoon Operation Limit Bypass Vulnerability (CNVD-2018-08812)

Cybozu Garoon is an office software with Chinese, Japanese, and English languages. An operation restriction bypass vulnerability exists in the login authentication settings in Cybozu Garoon 3.0.0 through 4.2.6. The vulnerability can be exploited by users logging in to the product with...

JVN#65268217: Multiple vulnerabilities in Cybozu Garoon

Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. SQL injection in the application "Address" CWE-89 - CVE-2018-0530 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N| Base Score: 6.5 CVSS v2| AV:N/AC:L/Au:S/C:P/I:N/A:N|...

Error: "This Operation Cannot be Performed Because a VDI is in Use by Some Other Operation"

Starting vm fail unable to find the disk OR Unable to start a VM error : "this operation cannot be performed because a VDI is in use by some other operation" OR Unable to start a VM , error : "The SR failed to complete the operation" OR Unable to start the VM , error : "This operation cannot be...

Improper access control

An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information,...

CVE-2017-14469

An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information,...

CVE-2018-6248

NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape where the software uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer...

CVE-2018-0537

Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quizop.cgi...

The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser, caused by an operation that goes beyond the buffer in memory, allows attackers to execute arbitrary code.

The vulnerability of the JavaScript script handler ChakraCore in the Microsoft Edge browser is caused by an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2018-8809

In radare2 2.4.0, there is a heap-based buffer over-read in the dalvikop function of analdalvik.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted dex file...

Microsoft Windows - Desktop Bridge VFS Privilege Escalation

Windows: Windows: Desktop Bridge VFS EoP Platform: Windows 1709 not tested earlier version Class: Elevation of Privilege Summary: The handling of the VFS for desktop bridge applications can allow an application to create virtual files in system folder which can result in EoP. Description: The...

Improper Access Control

unboundid-ldapsdk is vulnerable to improper access control. The vulnerability exists due to the lack of check for password in the synchronous process operation found in SimpleBindRequest...

Code injection

The select component in bui through 2018-03-13 has XSS because it performs an escape operation on already-escaped text, as demonstrated by workGroupList text...

CVE-2018-8108

CVE-2018-8108 affects the bui library’s select component. The issue is an XSS vulnerability caused by escaping text that has already been escaped, demonstrated by workGroupList text. Affected: bui’s select component (front-end), with roots in the escape operation being applied redundantly. Impact...

QQQ SYSTEMS vulnerable to cross-site scripting

Overview QQQ SYSTEMS provided by Gundam Cult QQQ is a CGI script to create quiz pages. quizop.cgi of QQQ SYSTEMS contains a cross-site scripting vulnerability CWE-79. When a user accesses a malicious page and is redirected to a page created with the product, an arbitrary script may be executed on...