8202 matches found
CVE-2017-1000107
Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection...
The vulnerability of the software for managing Vmware vSphere Client lies in the improper limitation of XML references to external objects, which allows an attacker to access confidential information.
The vulnerability of the software for managing Vmware vSphere Client is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information by convincing users to connect to the malicious...
Vulnerabilities include the browser of the event log, settings of distributed switches, and the content library of the management server for virtual infrastructure VMware vCenter Server, which allows attackers to access confidential information.
The vulnerability of the event log browser, distributed switch configuration settings, and the content library of the VMware vCenter Server management server is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability can allow a malicious actor to...
FLIR Systems FLIR Thermal Camera F/FC/PT/D Multiple Information Disclosures
Summary FLIR's PT-Series of high-performance, multi-sensor pan/tilt cameras bring thermal and visible-light imaging together in a system that gives you video and control over both IP and analog networks. The PT-Series' precision pan/tilt mechanism gives you accurate pointing control while providi...
WordPress Responsive Image Gallery 1.1.8 SQL Injection
============================================= MGC ALERT 2017-006 - Original release date: September 01, 2017 - Last revised: September 25, 2017 - Discovered by: Manuel GarcAa CA!rdenas - Severity: 7,1/10 CVSS Base Score - CVE-ID: CVE-2017-14125 ============================================= I...
USN-3424-1: libxml2 vulnerabilities
It was discovered that a type confusion error existed in libxml2. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. CVE-2017-0663 It was discovered that libxml2 did not properly validate parsed entity references. An...
USN-3424-1 libxml2 vulnerabilities
It was discovered that a type confusion error existed in libxml2. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. CVE-2017-0663 It was discovered that libxml2 did not properly validate parsed entity references. An...
Ubuntu: Security Advisory (USN-3424-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Nokogiri gem, via libxml, is affected by DoS and RCE vulnerabilities
The version of libxml2 packaged with Nokogiri contains several vulnerabilities. Nokogiri has mitigated these issues by upgrading to libxml 2.9.5. It was discovered that a type confusion error existed in libxml2. An attacker could use this to specially construct XML data that could cause a denial ...
The vulnerability of the XML parser in the SAP NetWeaver software integration platform allows a hacker to read arbitrary files or cause service failures.
The vulnerability of the XML parser in the SAP NetWeaver software integration platform arises from an incorrect limitation on XML references to external objects. Exploiting this vulnerability allows a malicious actor, operating remotely, to read arbitrary files or cause service failures...
Xxe
XML external entity XXE vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing entity references which reference files from the Beaker server's file system...
CVE-2015-3160
XML external entity XXE vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing entity references which reference files from the Beaker server's file system...
Concrete CMS: 'cnvID' parameter vulnerable to Insecure Direct Object References
Installation Information === IIS 8, PHP 5.5, Concrete5 5.7.5.7 Default install Issue POC An unauthenticated user can enumerate comments from all blog posts by POSTing requests to /index.php/tools/required/conversations/viewajax with incremental 'cnvID' integers. 1. An example blog with permission...
CVE-2017-12708
An Improper Restriction Of Operations Within The Bounds Of A Memory Buffer issue was discovered in Advantech WebAccess versions prior to V8.220170817. Researchers have identified multiple vulnerabilities that allow invalid locations to be referenced for the memory buffer, which may allow an...
Design/Logic Flaw
Untrusted search path vulnerability in ZTE Datacard MF19 0V1.0.0B04 allows local users to gain privilege by modifying the 'Ucell Internet' directory to reference a malicious mmsdllr.dll or mediaplayerdll.dll...
Legal Robot: Email Length Verification
Hi Team, Hope you are good. I found your website app.legalrobot.com vulnerable to this vulnerability. Bug: Improper authentication - generic Description: Dont know much about the websites that how they stored email address.Email addresses are stored as VARCHAR128 But here your website legalrobot...
Backdrop CMS 1.7.1 Cross Site Scripting
============================================= MGC ALERT 2017-005 - Original release date: July 11, 2017 - Last revised: August 18, 2017 - Discovered by: Manuel Garcia Cardenas - Severity: 4,8/10 CVSS Base Score ============================================= I. VULNERABILITY -----------------------...
CVE-2017-0746
A elevation of privilege vulnerability in the Qualcomm ipa driver. Product: Android. Versions: Android kernel. Android ID: A-35467471. References: QC-CR2029392...
