CVE-2017-14799

A cross site scripting attack in handling the ESP login parameter handling in NetIQ Access Manager before 4.3.3 could be used to inject javascript code into the login page...

CVE-2017-8124

The UMA product with software V200R001 has a privilege elevation vulnerability due to insufficient validation or improper processing of parameters. An attacker could craft specific packets to exploit these vulnerabilities to gain elevated privileges...

PT-2017-17794

Name of the Vulnerable Software and Affected Versions Ansible versions 2.3.x through 2.3.2 Ansible versions 2.4.x through 2.4.0 Description A flaw was found in the way Ansible passed certain parameters to the jenkins plugin module, allowing remote attackers to expose sensitive information from a...

Action Pack contains database-query restrictions bypass

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to...

Action Pack contains database-query restrictions bypass

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to...

actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...

Buffer overflow vulnerability in multiple Huawei phones (CNVD-2017-19194)

Huawei honor 6x and honor 5C are both a smartphone from Chinese company Huawei Huawei. A buffer overflow vulnerability exists in the driver in previous versions of the Huawei honor 6x Berlin-L21HNC432B360 and honor 5C NEM-AL10C00B356, which stems from the program's failure to adequately detect...

CVE-2017-8566

Microsoft Windows 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to Windows Input Method Editor IME improperly handling parameters in a method of a DCOM class, aka "Windows IME Elevation of Privilege Vulnerability"...

niushop_b2c Pay.php has xml entity injection vulnerability

Niushop open source mall National first commercial free four-in-one completely open source 100% open source The country's first set of B2B2C multi-user mall + micro letter micro-distribution + e-commerce platform investment operation + iOS, Android multi-platform client PHP open source e-commerce...

CVE-2017-10804

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer. This occurs because Psycopg 2.x before...

USN-3272-1 ghostscript vulnerabilities

It was discovered that Ghostscript improperly handled parameters to the rsdparams and eqproc commands. An attacker could use these to craft a malicious document that could disable -dSAFER protections, thereby allowing the execution of arbitrary code, or cause a denial of service application crash...

DEBIAN-CVE-2016-6317

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing...

CVE-2016-6317

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing...

CVE-2016-6317

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing...

CVE-2016-6317

The CVE-2016-6317 entry affects Ruby on Rails 4.2.x before 4.2.7.1, where Active Record and JSON parameter handling differences can allow remote attackers to bypass query restrictions and trigger NULL checks or missing WHERE clauses via crafted requests (e.g., [nil]). Root cause is inconsistent p...

Cisco IOS Smart Install Packet Image List Parameter Handling DoS (cisco-sa-20160323-smi)

According to its self-reported version, the Cisco IOS software running on the remote device is affected by a denial of service vulnerability in the Smart Install client feature due to improper handling of image list parameters. An unauthenticated, remote attacker can exploit this issue, via craft...

PHP 5.5.x < 5.5.34 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 5.5.x prior to 5.5.34. It is, therefore, affected by multiple vulnerabilities : - A buffer over-write condition exists in the finfoopen function due to improper validation of magic files. An unauthenticated, remote...

Multiple Cisco FireSight Management Center Cross-Site Scripting Vulnerabilities

Cisco FireSight Management Center is a holistic visibility security management platform from Cisco. This security management console and data repository product provides centralized event and policy management to enable secure operations. A cross-site scripting vulnerability exists in multiple...

Apple Mac EFI Unauthorized Access Vulnerability

OS X formerly Mac OS X is the latest version of Apple's proprietary operating system for the Macintosh computer. Apple OS X versions prior to 10.11.1 and other products and Apple Mac versions prior to EFI 2015-002 improperly handle parameters and contain a security vulnerability that can be...

Apple iOS Memory Information Disclosure Vulnerability (CNVD-2015-04250)

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A memory management vulnerability exists in Apple iOS's handling of HFS parameters, allowing an attacker to run a malicious application to obtain memory layout information...