Design/Logic Flaw

Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source passwords by accessing flow.html and reading the HTML source code of the page reached in an Edit action for a Data Source connector...

CVE-2017-14941

Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source passwords by accessing flow.html and reading the HTML source code of the page reached in an Edit action for a Data Source connector...

CVE-2017-14941

Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source passwords by accessing flow.html and reading the HTML source code of the page reached in an Edit action for a Data Source connector...

CVE-2017-14941

CVE-2017-14941 affects JasperReports 4.7. The vulnerability stems from passwords stored in clear text for Data Source Connectors, enabling a remote, authenticated user to view stored Data Source passwords by accessing flow.html during an Edit operation for a Data Source. The attack relies on acce...

CVE-2017-13684

Unisys Libra 64xx and 84xx and FS601 class systems with MCP-FIRMWARE before 43.211 allow remote authenticated users to cause a denial of service program crash or have unspecified other impact via vectors related to incorrect literal handling, which trigger CPM stack corruption...

CVE-2017-11191

DISPUTED FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID for the same user account that had been created for an earlier session. NOTE: Vendor states that issue does not exist in...

CVE-2017-11191

FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID for the same user account that had been created for an earlier session. NOTE: Vendor states that issue does not exist in product and...

Xxe

Multiple XML external entity XXE vulnerabilities in the OpenText Documentum Webtop 6.8.0160.0073 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a 1 crafted DTD,...

Xxe

Multiple XML external entity XXE vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary files, cause a denial of service, or, on Windows, obtain Documentum user hashes via a 1 crafted DT...

Code injection

In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme...

CVE-2017-14764

In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a module...

Cross site scripting

Cross-site scripting XSS vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the filter parameter to module/modulefilters/index.php...

CVE-2017-14753

Cross-site scripting XSS vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the filter parameter to module/modulefilters/index.php...

CVE-2017-14753

Cross-site scripting XSS vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the filter parameter to module/modulefilters/index.php...

CVE-2017-14753

Cross-site scripting XSS vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the filter parameter to module/modulefilters/index.php...

PT-2017-11811 · Red Hat +1 · Freeipa +1

Name of the Vulnerable Software and Affected Versions: FreeIPA versions 4.x Description: The issue allows a remote authenticated user to bypass intended account-locking restrictions via an unlock action with an old session ID for the same user account that had been created for an earlier session...

GeniXCMS Arbitrary PHP Code Execution Vulnerability

GeniXCMS is a free, open-source content management system that is built using the PHP language and uses MySQL for its database. An arbitrary PHP code execution vulnerability exists in the "Upload Module" page of GeniXCMS, which can be exploited by a remote authenticated user to execute arbitrary...

Race condition

Race condition in Blizzard Overwatch 1.15.0.2 allows remote authenticated users to cause a denial of service season bans and SR losses for other users by leaving a competitive match at a specific time during the initial loading of that match...

CVE-2017-14748

Race condition in Blizzard Overwatch 1.15.0.2 allows remote authenticated users to cause a denial of service season bans and SR losses for other users by leaving a competitive match at a specific time during the initial loading of that match...

CVE-2017-13129

Cross-site request forgery CSRF vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrators for requests that add administrators by leveraging lack of anti-CSRF tokens...