Command injection

Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 and possibly in-between versions web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a...

Apache Fineract SQL Injection Vulnerability

Apache Fineract is a set of open source digital financial services platform of the U.S. Apache Apache Software Foundation. The platform can provide users with data management, loan and savings portfolio management and real-time financial data and other functions. A SQL injection vulnerability...

jBPM Migration XML External Entity Injection Vulnerability

jBPM Migration is a migration tool. jBPM Migration is implemented with an XML external entity injection vulnerability that can be exploited by remote attackers to submit a special request, obtain sensitive information, or conduct a denial of service attack...

PHP Scripts Mall Nearbuy Clone Script SQL Injection Vulnerability

PHP Scripts Mall Nearbuy Clone Script is a set of PHP based local deal and offer checking website scripts by PHP Scripts Mall India. A SQL injection vulnerability exists in PHP Scripts Mall Nearbuy Clone Script version 3.2. A remote attacker can exploit the vulnerability by sending the 'search'...

PHP Scripts Mall PHP Multivendor Ecommerce SQL Injection Vulnerability

PHP Scripts Mall PHP Multivendor Ecommerce is a set of PHP based ecommerce website scripts by PHP Scripts Mall India. A SQL injection vulnerability exists in PHP Scripts Mall PHP Multivendor Ecommerce version 1.0. A remote attacker can inject SQL by sending the 'sid' parameter to the...

IBM Sterling File Gateway Information Disclosure Vulnerability (CNVD-2017-37578)

IBM Sterling File Gateway is a suite of file transfer software from IBM in the United States. The software integrates different centers of file transfer activity and facilitates the secure exchange of file-based data over the Internet. An information disclosure vulnerability exists in IBM Sterlin...

Microsoft Internet Explorer and Edge CVE-2017-11894 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Attackers can exploit this issue to execute arbitrary code in the context of the currentl...

LilyPond lilypond-invoke-editor injection vulnerability

LilyPond is a set of open source audio editing software. lilypond-invoke-editor is one of the tools used to invoke the editor. A security vulnerability exists in lilypond-invoke-editor in LilyPond version 2.19.80, which stems from a failure to detect strings before starting the program. A remote...

Microsoft Internet Explorer and Edge CVE-2017-11912 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Attackers can exploit this issue to execute arbitrary code in the context of the currentl...

Microsoft Edge CVE-2017-11888 Remote Memory Corruption Vulnerability

Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Faile...

rsync access restriction bypass vulnerability

rsync is a data mirroring backup application for Unix-like systems developed by Australian software developers Andrew Tridgell and Paul Mackerras that synchronizes file and directory updates between two computers and uses differential encoding to reduce data transfers. A security vulnerability...

Libav ff_vc1_mc_4mv_chroma4 function denial of service vulnerability

Libav is an open source audio and video processing tools , providing for conversion , manipulation and streaming of various multimedia formats and protocols cross-platform tools and libraries . A denial of service vulnerability exists in the ffvc1mc4mvchroma4 function in libavcodec/vc1mc.c in Lib...

[ASA-201711-42] lib32-libxcursor: arbitrary code execution

Arch Linux Security Advisory ASA-201711-42 ========================================== Severity: High Date : 2017-11-30 CVE-ID : CVE-2017-16612 Package : lib32-libxcursor Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-532 Summary ======= The package...

OpenJDK: incorrect privilege use when handling unreferenced objects (RMI, 8174966)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

CVE-2017-2722

DP300 V500R002C00,TE60 with software V100R001C01, V100R001C10, V100R003C00, V500R002C00 and V600R006C00,TP3106 with software V100R001C06 and V100R002C00,ViewPoint 9030 with software V100R011C02, V100R011C03,eCNS210TD with software V100R004C10,eSpace 7950 with software V200R003C00 and...

Lantronix Devices Unprotected Access (HTTP)

The Lantronix device web interface is accessible via an unprotected HTTP connection. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

SSL/TLS: Known Untrusted / Dangerous Certificate Authority (CA) Detection

The service is using an SSL/TLS certificate from a known untrusted and/or dangerous certificate authority CA. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier...

[ASA-201711-26] lib32-icu: arbitrary code execution

Arch Linux Security Advisory ASA-201711-26 ========================================== Severity: Critical Date : 2017-11-20 CVE-ID : CVE-2017-14952 Package : lib32-icu Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-507 Summary ======= The package lib32-icu...

Microsoft Edge Scripting Engine Remote Memory Corruption Vulnerability (CNVD-2017-36629)

Microsoft Edge is a popular browser. A remote memory corruption vulnerability exists in the Microsoft Edge scripting engine, which allows remote attackers to exploit the vulnerability to build malicious WEB pages that can be parsed by the user with elevated privileges...

Microsoft Edge Scripting Engine CVE-2017-11836 Remote Memory Corruption Vulnerability

Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft ChakraCore Microsoft...