Design/Logic Flaw

The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...

CVE-2017-9843

CVE-2017-9843 affects SAP NetWeaver AS ABAP 7.40. The issue is a denial-of-service via disp+work.exe triggered by remote authenticated users with certain privileges; the vulnerability is tied to SAP Security Note 2406841. Affected components include SAP Kernel 7.40 64-bit and disp+work.exe. Impac...

CVE-2017-4054

Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense ATD 3.10, 3.8, 3.6, 3.4 allows remote authenticated users to execute a command of their choice via a crafted HTTP request parameter...

CVE-2017-4057

The CVE-2017-4057 entry documents a Privilege Escalation in the web interface of McAfee Advanced Threat Defense (ATD) affecting versions 3.10, 3.8, 3.6 and 3.4. The vulnerability allows remote authenticated users to gain elevated privileges via the GUI or GUI terminal commands. The connected CNVD...

CVE-2017-10803

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because unpickle is used...

CVE-2017-10803

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because unpickle is used...

CVE-2017-10803

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because unpickle is used...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to unlock albums via a crafted request...

CVE-2016-4383

The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change...

PT-2017-2604

Name of the Vulnerable Software and Affected Versions U.motion Builder versions 1.2.1 and prior Description The issue is caused by the use of a hard-coded valid session ID in the system. This allows a remote attacker to bypass the authentication procedure by using a specially crafted user cookie...

FreeBSD : OpenVPN -- several vulnerabilities (9f65d382-56a4-11e7-83e3-080027ef73ec)

Samuli Seppanen reports : In May/June 2017 Guido Vranken threw a fuzzer at OpenVPN 2.4.2. In the process he found several vulnerabilities and reported them to the OpenVPN project. ... The first releases to have these fixes are OpenVPN 2.4.3 and 2.3.17. This is a list of fixed important...

Apache Thrift Client Library Denial of Service Vulnerability

Apache Thrift is an interface definition language and binary communication protocol for defining and creating services for multiple languages. The Apache Thrift client inventory is vulnerable to a denial of service. A remote authenticated user can cause a denial of service infinite recursion via ...

CVE-2015-3254

The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service infinite recursion via vectors involving the skip function...

Cisco Elastic Services Controller Security Restriction Bypass Vulnerability

Cisco Elastic Services Controller is a cloud and systems management solution. A security vulnerability in the implementation of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to log in as a Linux admin user on an affected system...

CVE-2016-9984

IBM Maximo Asset Management 7.5 and 7.6 could allow a remote authenticated attacker to execute arbitrary commands on the system as administrator. IBM X-Force ID: 120276...

CVE-2016-4910

Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to delete other operational administrators' MultiReport filters via unspecified vectors...

CVE-2017-2165

CVE-2017-2165 affects GroupSession versions ≤ 4.6.4. The root cause is a failure to restrict access permissions, allowing remote authenticated attackers to bypass access controls and obtain sensitive information such as emails via unspecified vectors. Documented impact is authenticated access to ...

CVE-2014-3498

The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands...

CVE-2014-3498

The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands...

Design/Logic Flaw

The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensitive information via a crafted XML document...