USN-3706-1 libjpeg-turbo vulnerabilities

It was discovered that libjpeg-turbo incorrectly handled certain malformed JPEG images. If a user or automated system were tricked into opening a specially crafted JPEG image, a remote attacker could cause libjpeg-turbo to crash, resulting in a denial of service, or possibly execute arbitrary cod...

CVE-2017-1248

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124628...

UBUNTU-CVE-2018-13112

getl2len in common/get.c in Tcpreplay 4.3.0 beta1 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via crafted packets, as demonstrated by tcpprep...

Nagios Fusion Cross-Site Scripting Vulnerability

Nagios Fusion is a suite of IT infrastructure visualization and monitoring solutions from the US-based Nagios Corporation. The solution supports centralized management of decentralized Nagios monitoring servers and provides a visual interface. A cross-site scripting vulnerability exists in Nagios...

Mozilla Firefox Out-of-Bounds Memory Read Vulnerability

Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A security vulnerability exists in Mozilla Firefox versions prior to 61, Firefox ESR versions pri...

The vulnerability of the Microsoft Exchange Server mail server arises from a transaction that occurs outside the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Exchange Server arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code with SYSTEM-level privileges by sending a specially crafted email to the...

Natus Xltek NeuroWorks Buffer Overflow Vulnerability (CNVD-2018-12131)

Natus Xltek NeuroWorks is a suite of versatile software platforms for EEG testing, long-term monitoring, ICU monitoring and sleep studies from Natus Medical, USA. A buffer overflow vulnerability exists in the NewProducerStream feature in Natus Xltek NeuroWorks version 9. A remote attacker could...

CA Privileged Access Manager Log Poisoning Vulnerability

CA Privileged Access Manager is a privileged access manager from CA USA that centralizes privileged user policies across multiple physical and virtual environments and manages and controls access to IT resources. A log poisoning vulnerability exists in CA Privileged Access Manager 2.x. The...

BlackCat CMS Cross-Site Scripting Vulnerability (CNVD-2018-14549)

BlackCatCMS is an open source content management system CMS that supports both English and German. A cross-site scripting vulnerability exists in the backend/pages/modify.php file in BlackCatCMS version 1.3. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML v...

Open-AudIT Professional Cross-Site Scripting Vulnerability

Open-AudIT Professional is a network discovery and auditing program. The program intelligently scans networks and network devices and provides status reports. A cross-site scripting vulnerability exists in Open-AudIT Professional version 2.1.1. A remote attacker can exploit this vulnerability to...

Remarkable Cross-Site Scripting Vulnerability

Remarkable is a Markdown a markup language parser. A cross-site scripting vulnerability exists in Remarkable 1.6.2 and earlier versions. A remote attacker can exploit this vulnerability to execute JavaScript code...

Symfony Authentication Bypass Vulnerability

Sensio Labs Symfony is a French company Sensio Labs set of free , MVC-based PHP development framework , which provides commonly used functional components and tools , can be used to quickly create complex WEB programs . Ldap component is a lightweight directory access protocol component . A...

Knowage Cross-Site Scripting Vulnerability

Knowage formerly SpagoBI is an open source suite for modern business analytics on traditional resources and big data systems from Knowage Italy. A cross-site scripting vulnerability exists in Knowage version 6.1.1. A remote attacker can exploit the vulnerability by sending the name field to the...

Digium Asterisk Open Source Remote Authentication Session Vulnerability

Digium Asterisk Open Source is an open source telephone exchange PBX system software from Digium. The software supports voicemail, multi-party voice conferencing, interactive voice response IVR and so on. A security vulnerability exists in version 15.x of Digium Asterisk Open Source prior to...

Cloud EC E-commerce System v1.2 System SQL Injection Vulnerability

Cloud EC e-commerce system hereinafter referred to as Cloud EC is a set of open source e-commerce system software based on PHP + MYSQL independently developed by Yunmai E-commerce Co. Cloud EC e-commerce system version 1.2 SQL injection vulnerability, remote attackers can exploit the vulnerabilit...

SGIN.CN xiangyun Platform Cross-Site Scripting Vulnerability

SGIN.CN xiangyun platform is a set of micro-business distribution platform of China Sanjin SGIN network technology company. A cross-site scripting vulnerability exists in the login.php file in version 9.4.1 of the SGIN.CN xiangyun platform. A remote attacker can use the 'loginurl' parameter to...

Mozilla Firefox Reset Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 60. The vulnerability can be exploited by a remote attacker to reset the homepage by dragging and dropping hyperlinked text...

SeaCMS Cross-Site Scripting Vulnerability

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in SeaCMS version 6.61. A remote attacker can exploit this vulnerability to inject arbitrary web...

NUUO NVRmini 2 < 3.9.1 File Upload Vulnerability - Active Check

NUUO NVRmini 2 devices are prone to a file upload vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nuuo:nuuo";...

Huawei 1288H and 2288H Rack Server JSON Injection Vulnerability

Huawei 1288H V5 and 2288H V5 are both rack routers that can be widely used for cloud virtualization, database, big data and other loads. A JSON injection vulnerability exists in the V100R005C00 software of the Huawei 1288H V5 and 2288H V5. The vulnerability stems from the program failing to...