Pragyan CMS SQL Injection Vulnerability (CNVD-2017-34576)

Pragyan CMS is a multi-user, modular PHP and MySQL based Content Management System CMS. The system supports custom built-in frameworks, user group rights management, search engine optimization and more. A SQL injection vulnerability exists in Pragyan CMS version 3.0. A remote attacker can exploit...

Diving Log dive.xml File Information Disclosure Vulnerability

Diving Log is a dive log management software. The software supports data import, log printing and log sharing. A security vulnerability exists in Diving Log version 6.0. A remote attacker can exploit this vulnerability to view local files with the help of a specially crafted dive.xml file...

Secure Mail does not sync emails after upgrading to version 10.6.0

Emails are not syncing for users after the Secure Mail update to 10.6.0. We will see the following Socket errors in the logs: 2017-07-25T06:17:37.266-0400 AGTunneler INFO 4 -AGSocket connect:withPort: -AGSocket connect:withPort:: CallOriginalconnect errno = 36 - 'Operation now in progress', fd = ...

VX Search Enterprise Buffer Overflow Vulnerability

VX Search Enterprise is an automated, rule-based file search solution. A buffer overflow vulnerability exists in the web server service in VX Search Enterprise version 10.0.14. A remote attacker can exploit this vulnerability to execute arbitrary code via a specially crafted GET request...

CVE-2016-2969

IBM Sametime Meeting Server 8.5.2 and 9.0 may send replies that contain emails of people that should not be in these messages. IBM X-Force ID: 113850...

CVE-2016-2970

IBM Sametime 8.5 and 9.0 meetings server may provide detailed information in an error message that may provide details about the application to possible attackers. IBM X-Force ID: 113851...

IBM Sametime Meetings Server Denial of Service Vulnerability (CNVD-2017-26407)

IBM Sametime is a set of next-generation social communication tools from IBM in the United States. The tool helps users realize real-time business collaboration by integrating audio voice, data, and video.Sametime Meeting Server is one of the Web conferencing components used in Sametime chat and...

libgig Denial of Service Vulnerability (CNVD-2017-27701)

libgig is a C++ library for loading, modifying existing and creating new Gigasampler .gig files and DLS downloadable sound Level 1/2 files, KORG sample instruments .KSF and .KMP files, SoundFont v2 .sf2 files and AKAI sampler data. A denial of service vulnerability exists in the function LoadStri...

SQL Injection Vulnerability in Xiaowei OA v2.0

Xiaowei OA system is Beijing Xiaowei Help Technology Co., Ltd. to provide mobile office platform for small and medium-sized enterprises. SQL injection vulnerability exists in Xiaowei OA v2.0, which can be exploited by attackers to obtain sensitive information from the database...

Fortinet FortiManager Cross-Site Scripting Vulnerability (CNVD-2017-237899)

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices and can group devices into different management domains ADOM to further simplify multi-device security deployment and managemen...

CVE-2017-1431

IBM InfoSphere Streams 4.0, 4.1, and 4.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127632...

CVE-2017-10173

Vulnerability in the Oracle Retail Open Commerce Platform component of Oracle Retail Applications subcomponent: Website. Supported versions that are affected are 5.0, 5.1, 5.2, 5.3, 6.0, 6.1, 15.0 and 15.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via...

CVE-2017-10123

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Container. The supported version that is affected is 12.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server...

CVE-2017-10049

Vulnerability in the Siebel Core CRM component of Oracle Siebel CRM subcomponent: Search. Supported versions that are affected are 16.0 and 17.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Core CRM. Successful attacks require...

Liferay Portal CE Cross-Site Scripting Vulnerability

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses EJB as well as JMS and other technologies , and can be used as a Web publishing and sharing workspaces , enterprise collaboration platforms , social networks and so on. A cross-site scripting vulnerability exists ...

Trend Micro InterScan Messaging Security Virtual Appliance Command Injection Vulnerability

Trend Micro InterScan Messaging Security Virtual Appliance IMSVA is an email gateway security appliance from Trend Micro that integrates anti-virus, anti-spyware and anti-phishing technologies to provide comprehensive protection for email applications. A command injection vulnerability exists in...

Reflective Cross-Site Scripting Vulnerability in Coremail Mail System

Coremail mail system is a large-scale enterprise mail system independently researched and developed by Yingshi Company, with mature system technology, stable and efficient performance, which can give full play to the performance of mail server. Reflection type cross-site scripting vulnerability...

ImageMagick 'ReadMATImage' function memory leak vulnerability

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. The coders/mat.c file in ImageMagick versions 6.9.9-3 and earlier and versions 7.x through 7.0.6-3 has a A memory leak...

Trend Micro Control Manager cmdHandlerTVCSCommander.dll File SQL Injection Vulnerability

Trend Micro Control Manager TMCM is an integrated threat detection and data protection management center software from Trend Micro. A SQL injection vulnerability exists in TMCM version 6.0, which stems from the cmdHandlerTVCSCommander.dll file failing to adequately validate user input. A remote...

IBM iNotes Cross-Site Scripting Vulnerability (CNVD-2017-21250)

IBM iNotes also known as IBM Lotus iNotes is a set of Web-based e-mail software from IBM in the United States. The software helps different types of users online and offline users to effectively manage business-critical information and collaboration. A cross-site scripting vulnerability exists in...