1245 matches found
WordPress WebDorado Form Maker by WD CSV Injection Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . WebDorado Form Maker by WD is used in one of the responsive form builder plugin . A security vulnerability exis...
Design/Logic Flaw
When installing Nessus to a directory outside of the default location, Nessus versions prior to 7.0.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the installation location...
CVE-2018-7707
Cross-site scripting XSS vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via an HTML-formatted e-mail message...
chromium-browser: integer overflow in v8
Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
CVE-2018-1220
EMC RSA Archer, versions prior to 6.2.0.8, contains a redirect vulnerability in the QuickLinks feature. A remote attacker may potentially exploit this vulnerability to redirect genuine users to phishing websites with the intent of obtaining sensitive information from the users...
UBUNTU-CVE-2018-7711
HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This occurs because of a dependency on PHP...
K7 Antivirus Premium elevation of privilege vulnerability (CNVD-2018-02143)
K7 Antivirus Premium is a suite of anti-virus software from K7 Computing India. A security vulnerability exists in versions prior to K7 Antivirus Premium 15.1.0.53. A local attacker can exploit the vulnerability to gain privileges by sending a specific IOCTL...
CVE-2017-17848
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be...
Quest NetVault Backup SQL Injection Vulnerability (CNVD-2017-37630)
Quest NetVault Backup is a suite of data backup software from Quest Software, USA. A SQL injection vulnerability exists in the handling of NVBUBackup Get method requests in Quest NetVault Backup versions prior to 11.4.5, which stems from the program failing to properly detect user-submitted strin...
TeamPass roles.queries.php Access Control Vulnerability
TeamPass is a dedicated password manager for Apache, MySQL and PHP. An access control vulnerability exists in versions prior to TeamPass 2.1.27.9 that stems from the program failing to properly enforce administrator access control. An attacker can exploit the vulnerability by gaining administrato...
CVE-2017-2735
TIT-AL00 smartphones with software versions earlier before TIT-AL00C583B214 have a exposed system interface vulnerability. The software provides a system interface for interaction with external applications, but calling the interface is not properly restricted. An attacker could trick the user in...
collectd SNMP Plugin Denial of Service Vulnerability
collectd is a set of open source running on Linux, Unix system under the system information collection tools. SNMP plugin is one of the simple network management plugin . A denial of service vulnerability exists in the 'csnmpreadtable' function of the snmp.c file of the SNMP plugin in versions of...
CVE-2017-13810
An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Kernel" component. It allows local users to obtain sensitive information by leveraging an error in packet counters...
CVE-2017-10825
Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...
CVE-2017-5064
Incorrect handling of DOM changes in Blink in Google Chrome prior to 58.0.3029.81 for Windows allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
Apple iOS Time has an unspecified vulnerability
Apple iOS is an operating system developed by Apple Inc. for mobile devices.Time component is one of the time components. A security vulnerability exists in the Time component of Apple iOS prior to version 11, which arises from the possibility that the program fails to properly handle the use of...
Huawei Vicky-AL00 FRP Bypass Vulnerability
The Huawei Vicky-AL00 is a smartphone product from the Chinese company Huawei Huawei. A security vulnerability exists in versions prior to Huawei Vicky-AL00 Vicky-AL00AC00B172D. During the process of entering FRP to reset the phone, an attacker can exploit the vulnerability to enter Talkback mode...
OpenHPI Denial of Service Vulnerability
OpenHPI is a set of open source graphical tools for managing computer hardware. A security vulnerability exists in the openhpi/Makefile.am file in versions of OpenHPI prior to 3.6.0. A local attacker could exploit this vulnerability to cause a denial of service disk consumption...
