XSS Vulnerability in mlecms V2.3

mlecms is a multi-language, free and open source content management system. An XSS vulnerability exists in mlecms V2.3. An attacker can exploit this vulnerability to obtain sensitive information such as user cookies...

Pulse Connect Secure 'logout.cgi' Cross-Site Request Forgery Vulnerability

Pulse Connect Secure aka PCS, formerly known as Juniper Junos Pulse is a suite of SSL VPN solutions from Pulse Secure, a US-based company. A cross-site request forgery vulnerability in the logout.cgi file in PCS version 8.3R1 exists because the program fails to protect the administrator panel wit...

Fortinet FortiWLM Command Execution Vulnerability

Fortinet FortiWLM is a wireless network device management platform developed by the U.S. Fiat Fortinet. A security vulnerability exists in the hard-coded password account named 'upgrade' in Fortinet FortiWLM 8.3.0 and prior versions. A remote attacker could exploit this vulnerability to execute...

CVE-2017-4997

EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could potentially be exploited by malicious users to compromise the affected system...

CVE-2017-5529

JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition versions 6.4.0 and below, TIBCO JasperReports...

CVE-2017-1234

IBM QRadar 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123913...

EMC VASA Provider Virtual Appliance Remote Code Execution Vulnerability

EMC VASA Provider Virtual Appliance is a virtual program for VASA from EMC Corporation USA. The program provides communication capabilities between vSphere and storage arrays. A remote code execution vulnerability exists in the EMC VASA Provider Virtual Appliance 8.3.x and prior versions. A remot...

DEBIAN-CVE-2017-9324

In Open Ticket Request System OTRS 3.3.x through 3.3.16, 4.x through 4.0.23, and 5.x through 5.0.19, an attacker with agent permission is capable of opening a specific URL in a browser to gain administrative privileges / full access. Afterward, all system settings can be read and changed. The URL...

Zend Framework Cross-Site Request Forgery Vulnerability

Zend Framework ZF is the United States Zend company developed a set of open source PHP5 development framework , it is mainly used for the development of Web programs and services. A cross-site request forgery vulnerability exists in Zend/Validator/Csrf in version 2.3.x prior to ZF 2.3.6. A remote...

Evolution Script CMS Cross-Site Scripting Vulnerability

Evolution Script is managed by a team of professionals specializing in pay-per-click software development. A cross-site scripting vulnerability exists in the "status" parameter of the "Ticket Support" module of Evolution Script CMS version 5.3, which can be exploited by remote attackers to inject...

CVE-2017-6027

An Arbitrary File Upload issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following versions of CODESYS Web Server, part of the CODESYS WebVisu web browser visualization software, are affected: CODESYS Web Server Versions 2.3 and prior. A specially crafted web serv...

EMC RSA Adaptive Authentication Cross-Site Scripting Vulnerability

EMC RSA Adaptive Authentication On-Premise is a comprehensive, risk-based authentication and fraud detection platform from EMC Corporation. The platform enables real-time monitoring of online activity and authentication by correlating behavioral analytics, device configuration information...

PT-2017-10691 · Nextcloud · Nextcloud Server

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 11.0.3 Description: The issue is related to inadequate escaping, leading to a XSS vulnerability in the search module. A user must write or paste malicious content into the search dialogue for it to be...

Apple Safari and iOS JavaScriptCore Memory Misreference Vulnerability

Apple Safari and iOS are both products of Apple Inc. Apple Safari is a web browser that is the default browser that comes with Mac OS X and iOS operating systems. iOS is a set of operating systems developed for mobile devices. JavaScriptCore is one of the frameworks. A memory misreference...

CVE-2017-2137

ProSAFE Plus Configuration Utility prior to 2.3.29 allows remote attackers to bypass access restriction and change configurations of the switch via SOAP requests...

NetIQ Access Manage Cross-Site Scripting Vulnerability

NetIQ Access Manager NAM is a resource access control solution from NetIQ, USA. The solution provides multiple authentication, data encryption, single sign-on and SSL VPN for local and remote users. A cross-site scripting vulnerability exists in the /NAGErrors URI in NAM versions 4.2 and 4.3, whi...

CVE-2017-3469

Vulnerability in the MySQL Workbench component of Oracle MySQL subcomponent: Workbench: Security : Encryption. Supported versions that are affected are 6.3.8 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise...

UBUNTU-CVE-2017-3469

Vulnerability in the MySQL Workbench component of Oracle MySQL subcomponent: Workbench: Security : Encryption. Supported versions that are affected are 6.3.8 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise...

CVE-2017-5191

An XSS vulnerability on the /NAGErrors URI in NetIQ Access Manager 4.2 and 4.3 exists because Access Gateway Error pages do not validate the HTTP Referer header...

ARM Trusted Firmware Integer Overflow Vulnerability

ARM Trusted Firmware is a set of interface standards that provide an ARMv8-A secure software implementation. A security vulnerability exists in ARM Trusted Firmware versions 1.2 and 1.3. An attacker could exploit the vulnerability to copy larger data to secure memory...