Mozilla Firefox Out-of-Bounds Memory Read Vulnerability

Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A security vulnerability exists in Mozilla Firefox versions prior to 61, Firefox ESR versions pri...

Microsoft Exchange Server Code Execution

The vulnerability of Microsoft Exchange Server arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code with SYSTEM-level privileges by sending a specially crafted email to the...

Natus Xltek NeuroWorks Buffer Overflow Vulnerability (CNVD-2018-12131)

Natus Xltek NeuroWorks is a suite of versatile software platforms for EEG testing, long-term monitoring, ICU monitoring and sleep studies from Natus Medical, USA. A buffer overflow vulnerability exists in the NewProducerStream feature in Natus Xltek NeuroWorks version 9. A remote attacker could...

CA Privileged Access Manager Log Poisoning Vulnerability

CA Privileged Access Manager is a privileged access manager from CA USA that centralizes privileged user policies across multiple physical and virtual environments and manages and controls access to IT resources. A log poisoning vulnerability exists in CA Privileged Access Manager 2.x. The...

Remarkable Cross-Site Scripting Vulnerability

Remarkable is a Markdown a markup language parser. A cross-site scripting vulnerability exists in Remarkable 1.6.2 and earlier versions. A remote attacker can exploit this vulnerability to execute JavaScript code...

Open-AudIT Professional Cross-Site Scripting Vulnerability

Open-AudIT Professional is a network discovery and auditing program. The program intelligently scans networks and network devices and provides status reports. A cross-site scripting vulnerability exists in Open-AudIT Professional version 2.1.1. A remote attacker can exploit this vulnerability to...

BlackCat CMS Cross-Site Scripting Vulnerability (CNVD-2018-14549)

BlackCatCMS is an open source content management system CMS that supports both English and German. A cross-site scripting vulnerability exists in the backend/pages/modify.php file in BlackCatCMS version 1.3. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML v...

Symfony Authentication Bypass Vulnerability

Sensio Labs Symfony is a French company Sensio Labs set of free , MVC-based PHP development framework , which provides commonly used functional components and tools , can be used to quickly create complex WEB programs . Ldap component is a lightweight directory access protocol component . A...

Cloud EC E-commerce System v1.2 System SQL Injection Vulnerability

Cloud EC e-commerce system hereinafter referred to as Cloud EC is a set of open source e-commerce system software based on PHP + MYSQL independently developed by Yunmai E-commerce Co. Cloud EC e-commerce system version 1.2 SQL injection vulnerability, remote attackers can exploit the vulnerabilit...

Knowage Cross-Site Scripting Vulnerability

Knowage formerly SpagoBI is an open source suite for modern business analytics on traditional resources and big data systems from Knowage Italy. A cross-site scripting vulnerability exists in Knowage version 6.1.1. A remote attacker can exploit the vulnerability by sending the name field to the...

Digium Asterisk Open Source Remote Authentication Session Vulnerability

Digium Asterisk Open Source is an open source telephone exchange PBX system software from Digium. The software supports voicemail, multi-party voice conferencing, interactive voice response IVR and so on. A security vulnerability exists in version 15.x of Digium Asterisk Open Source prior to...

SGIN.CN xiangyun Platform Cross-Site Scripting Vulnerability

SGIN.CN xiangyun platform is a set of micro-business distribution platform of China Sanjin SGIN network technology company. A cross-site scripting vulnerability exists in the login.php file in version 9.4.1 of the SGIN.CN xiangyun platform. A remote attacker can use the 'loginurl' parameter to...

Mozilla Firefox Reset Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 60. The vulnerability can be exploited by a remote attacker to reset the homepage by dragging and dropping hyperlinked text...

SeaCMS Cross-Site Scripting Vulnerability

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in SeaCMS version 6.61. A remote attacker can exploit this vulnerability to inject arbitrary web...

NUUO NVRmini 2 < 3.9.1 File Upload Vulnerability - Active Check

NUUO NVRmini 2 devices are prone to a file upload vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nuuo:nuuo";...

Huawei 1288H and 2288H Rack Server JSON Injection Vulnerability

Huawei 1288H V5 and 2288H V5 are both rack routers that can be widely used for cloud virtualization, database, big data and other loads. A JSON injection vulnerability exists in the V100R005C00 software of the Huawei 1288H V5 and 2288H V5. The vulnerability stems from the program failing to...

Dell EMC RecoverPoint and RecoverPoint for Virtual Machines Arbitrary File Read Vulnerability

Dell EMC RecoverPoint and RecoverPoint for Virtual Machines are both products of Dell Dell. The former is a suite of disaster recovery and data protection software, and the latter is a disaster recovery solution for VMware environments. An arbitrary file read vulnerability exists in Dell EMC...

GridGain Directory Traversal Vulnerability

GridGain is a suite of in-memory computing platforms from GridGain Systems.Visor GUI Console is one of the visualization consoles. A directory traversal vulnerability exists in the Visor GUI Console in GridGain. A remote attacker can exploit this vulnerability to read arbitrary files via speciall...

Oracle Java SE and Java SE Embedded Remote Vulnerability

Oracle Java SE and Java SE Embedded are both products of Oracle Corporation. Java SE Java Platform Standard Edition is used to develop and deploy Java applications for desktops, servers, as well as embedded devices and real-time environments; Java SE Embedded is a Java platform for the developmen...

Cybozu Mailwise Cross-Site Scripting Vulnerability (CNVD-2018-15282)

Cybozu Mailwise is a Web-based e-mail system from Cybozu, and System settings is one of the system settings components. A cross-site scripting vulnerability exists in System settings in Cybozu Mailwise versions 5.0.0 through 5.4.1. A remote attacker can use this vulnerability to inject arbitrary...