CVE-2015-8356

Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the 1 xlsprofile parameter to admin/mcartxlsimport.php or the 2 xlsiblockid, 3 xlsiblocksectionid, 4 firstRow, 5 titleRow, 6...

Sql injection

Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the 1 xlsprofile parameter to admin/mcartxlsimport.php or the 2 xlsiblockid, 3 xlsiblocksectionid, 4 firstRow, 5 titleRow, 6...

OpenSSH xauth Input Authentication Vulnerability

OpenSSH OpenBSD Secure Shell is a set of connection tools maintained by the OpenBSD Project Group for secure access to remote computers. OpenSSH has a security vulnerability. A remotely authenticated user can read or modify files on the target system and can execute the xauth command on the targe...

CVE-2016-10322

Synology Photo Station (pre-6.3-2958) is affected by CVE-2016-10322. Remote authenticated guest users can inject shell metacharacters in the X-Forwarded-For header to photo/login.php and execute arbitrary commands. Impact is described as remote code execution with the attacker in a low-privilege ...

CVE-2016-10310

Buffer overflow in the MobiLink Synchronization Server component in SAP SQL Anywhere 17 and possibly earlier allows remote authenticated users to cause a denial of service resource consumption and process crash by sending a crafted packet several times, aka SAP Security Note 2308778...

CVE-2016-10310

Summary: CVE-2016-10310 is a buffer overflow in the SAP SQL Anywhere MobiLink Synchronization Server component. The vulnerability affects SAP SQL Anywhere 17 and possibly earlier versions and can be triggered by specially crafted packets sent to the service, allowing remote authenticated users to...

CVE-2016-10304

The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of service out-of-memory error and service instability via a crafted serialized Java object, as demonstrated by serial.cc3, aka SAP Security Note 2315788...

CVE-2007-6760

Dataprobe iBootBar with 2007-09-20 and possibly later beta firmware allows remote attackers to bypass authentication, and conduct power-cycle attacks on connected devices, via a DCCOOKIE cookie...

CVE-2017-7400

OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping...

CVE-2017-2381

Summary: CVE-2017-2381 affects macOS prior to 10.12.4, involving the sudo component. An access/privilege-elevation issue could allow remote authenticated users to gain privileges by exploiting membership in the admin group on a network directory server. Root cause: permission checking flaw in sud...

CVE-2017-2381

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "sudo" component. It allows remote authenticated users to gain privileges by leveraging membership in the admin group on a network directory server...

DEBIAN-CVE-2017-6463

NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service daemon crash via an invalid setting in a :config directive, related to the unpeer option...

CVE-2017-6458

CVE-2017-6458 affects NTP where multiple buffer overflows in the ctl_put* functions exist in versions before 4.2.8p10 and 4.3.x before 4.3.94. An authenticated remote attacker could exploit these issues to crash the ntpd process or cause unspecified impact via a long variable. The available sourc...

CVE-2017-6369

Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'system' entrypoint from fbudf.so...

CVE-2017-6369

Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'system' entrypoint from fbudf.so...

CVE-2017-6971

AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context, or launch a reverse shell, via vectors involving the PHP session ID and the NfSen PHP code, aka AlienVault ID ENG-104862...

CVE-2017-5930

The CVE-2017-5930 issue affects PostfixAdmin's AliasHandler. The AliasHandler component before 3.0.2 permits remote authenticated domain admins to delete protected aliases via delete.php due to a missing permission check, enabling unintended alias deletion. Public sources confirm the fix is to up...

rabbitmq-server: DoS via lengths_age or lengths_incr parameter in the management plugin

A resource-consumption flaw was found in RabbitMQ Server, where the lengthsage or lengthsincr parameters were not validated in the management plugin. Remote, authenticated users with certain privileges could exploit this flaw to cause a denial of service by passing values which were too large...

Sql injection

SQL injection vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows remote authenticated users to obtain product information via a crafted HTTP request parameter...

CVE-2015-4407

CVE-2015-4407 affects Hikvision NVR models DS-76xxNI-E1/2 and DS-77xxxNI-E4. A buffer overflow in handling PSIA-enabled HTTP requests allows remote authenticated users to trigger a denial of service (service interruption). The vulnerability exists in devices prior to version 3.4.0; upgrading to 3...