Google Chrome Omnibox Reference Policy Bypass Vulnerability

Google Chrome is a web browser developed by Google, Inc. and Omnibox is a real-time search engine. A security vulnerability exists in Omnibox in versions of Google Chrome prior to 67.0.3396.62. A remote attacker can exploit the vulnerability with the help of a specially crafted website to bypass...

Design/Logic Flaw

BA SYSTEMS BAS Web on BAS920 devices with Firmware 01.01.00, HTTPserv 00002, and Script 02. and ISC2000 devices allows remote attackers to obtain sensitive information via a request for isc/getsidjs.aspx or isc/getsid.aspx, as demonstrated by obtaining administrative access by subsequently using...

Design/Logic Flaw

MitraStar GPT-2541GNAC HGU 1.00VNJ0b1 and DSL-100HN-T1 ES113WJY0b16 devices allow remote authenticated users to obtain root access by specifying /bin/sh as the command to execute...

Circle with Disney Remote Access Vulnerability

Circle with Disney is a set of network monitoring and management devices for monitoring children's online behavior from Circle Media, Inc. in the United States. A remote access vulnerability exists in the remote control feature of Circle with Disney version 2.0.1. A remote attacker can exploit th...

The vulnerability of the FileUploadServlet class in the software for managing workstations through the ManageEngine Desktop Central web interface allows a malicious individual to upload and execute any file they desire.

The vulnerability of the FileUploadServlet class in the software for managing workstations through the web interface of ManageEngine Desktop Central is related to the lack of restrictions on file uploads. Exploiting this vulnerability allows an unauthorized intruder, operating remotely, to upload...

CVE-2017-14421

CVE-2017-14421 affects D-Link DIR-850L Rev. B up to firmware FW208WWb02. It stems from a hardcoded Alphanetworks account password (wrgac25_dlink.2013gui_dir850l), enabling remote attackers to obtain root access via TELNET. Severity is high/critical (CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)...

BUFFALO WAPM-1166D and WAPM-APG600H Authentication Bypass Vulnerabilities

The BUFFALO WAPM-1166D and WAPM-APG600H are both wireless LAN access point devices from BUFFALO Japan. A security vulnerability exists in the WAPM-1166D using firmware version 1.2.7 and earlier and the WAPM-APG600H using firmware version 1.16.1 and earlier. A remote attacker can exploit this...

UBUNTU-CVE-2017-10135

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: JCE. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with...

UBUNTU-CVE-2017-3639

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: DML. Supported versions that are affected are 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2017-0107

Microsoft SharePoint Server fails to sanitize crafted web requests, allowing remote attackers to run cross-script in local security context, aka "Microsoft SharePoint XSS Vulnerability."...

CVE-2017-6343

The vulnerability CVE-2017-6343 affects Dahua DHI-HCVR7216A-S3 devices and is realized via the web interface, enabling remote authentication bypass by using knowledge of the MD5 Admin Hash to gain login access without the password. Affected components include NVR firmware 3.210.0001.10, Camera fi...

D-Link DWR-932B Arbitrary File Read Vulnerability

The D-Link DWR-932B is a popular router device. The D-Link DWR-932B handles... A security vulnerability exists in %2f that allows remote attackers to submit a special request to read the contents of arbitrary files...

CVE-2016-9285

framework/modules/addressbook/controllers/addressController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via a modified id number, as demonstrated by address/edit/id/1, related to an "addresses, countries, and regions" issue...

Default Password 'anko' for 'root' Account

The account 'root' on the remote host has the default password 'anko'. A remote attacker can exploit this issue to gain administrative access to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "root"; password = "anko"; include'deprecatednasllevel.inc';...

Buffer overflow

Unspecified vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component in Oracle Financial Services Applications 12.0.0 and 12.1.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors...

CVE-2016-7031

The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL...

CVE-2016-5081

The CVE-2016-5081 entry affects ZModo ZP-NE14-S and ZP-IBH-13W devices (DVR/cameras) due to hard-coded credentials that enable root access via an always-on TELNET service. The root cause is use of undocumented hard-coded credentials and TELNET hardening bypass, allowing remote attackers to obtain...

Microprogramming software for Siemens SIPROTEC 4 relay protection microprocessors

The vulnerability of the software of the Siemens SIPROTEC 4 relay protection micro-processor terminal allows a remote attacker to cause a malfunction of the micro-processor terminal by sending a specially crafted UDP packet to port 50000. This causes the micro-processor terminal to cease...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the accessibility of protected information

The Linux-headers-2.6.18-6-vserver-powerpc64 package of the Debian GNU/Linux operating system has multiple vulnerabilities. Exploitation of these vulnerabilities may result in the compromise of protected information. These vulnerabilities can be exploited remotely...

The vulnerability of the PowerDNS Recursor software allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.

Overfilling the buffer in the PowerDNS Recursor allows malicious actors operating remotely to cause service failures abrupt termination of the daemon or execute arbitrary code using specially crafted packages...