18934 matches found
CVE-2017-2173
CVE-2017-2173 corresponds to a stored cross-site scripting (CWE-79) vulnerability in the IPA’s Empirical Project Monitor - eXtended. The linked CNVD/JVN records describe a cross-site scripting flaw that can allow arbitrary script execution in a user’s browser. The JVN entries indicate the vulnera...
samba: Flaws in Kerberos PAC validation can trigger privilege elevation
A flaw was found in the way Samba handled PAC Privilege Attribute Certificate checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process...
CVE-2017-3980
A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator ePO 5.9.0, 5.3.2, and 5.1.3 and earlier allows remote authenticated users to execute a command of their choice via an authenticated ePO session...
CVE-2017-3980
A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator ePO 5.9.0, 5.3.2, and 5.1.3 and earlier allows remote authenticated users to execute a command of their choice via an authenticated ePO session...
CVE-2017-4015
Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote authenticated users to inject arbitrary web script or HTML via HTTP response header...
CVE-2017-4012
Privilege Escalation vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote authenticated users to view confidential information via modification of the HTTP request...
Privilege escalation
Privilege Escalation vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote authenticated users to view confidential information via modification of the HTTP request...
CVE-2017-4014
CVE-2017-4014 affects McAfee Network Data Loss Prevention (NDLP) 9.3.x. The vulnerability is described as a session-side hijack in the server, allowing remote authenticated users to view, add, and remove users by modifying HTTP requests. Affected component is the server implementation of NDLP 9.3...
BSA-2017-294
Security Advisory ID : BSA-2017-294 Component : NTP Revision : 1.0: Interim Multiple buffer overflows in thectlput functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable. Affected Products Brocade is investigating i...
CVE-2017-7489
In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link...
CVE-2017-7489
In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link...
CVE-2017-7489
In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link...
CVE-2017-7489
CVE-2017-7489 affects Moodle 2.x and 3.x. The issue allows remote authenticated users to take ownership of arbitrary blogs by editing an external blog link. The connected sources reiterate Moodle as the affected software and the blog-edit capability as the vulnerability trigger; no explicit patch...
CVE-2017-2122
Cross-site scripting vulnerability in Nessus versions 6.8.0, 6.8.1, 6.9.0, 6.9.1 and 6.9.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2016-4877
Cross-site scripting vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...
Design/Logic Flaw
DISPUTED CMS Made Simple CMSMS 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug."...
CVE-2017-8912
CMS Made Simple CMSMS 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug...
Palo Alto Networks PAN-OS Information Disclosure Vulnerability (CNVD-2017-06852)
PAN-OS is a security-specific operating system designed to control Palo Alto Networks' firewalls with a rich set of firewall, management, and network features. An information disclosure vulnerability exists in the management web interface in Palo Alto Networks PAN-OS, which can be exploited by a...
business-central: Multiple stored XSS in task and process filters
JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sanitation of user input when creating new lists. Remote, authenticated attackers that have privileges to create lists can store scripts in them, which are not properly...