CVE-2016-8584

Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which allows remote attackers to bypass authentication by guessing the value...

Code injection

logquerydlp.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cacheid parameter...

CVE-2016-8588

The hotfixupload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file...

CVE-2017-2115

Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to obtain "customapp" information via unspecified vectors...

CVE-2017-2114

Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2115

CVE-2017-2115 affects Cybozu Office 10.0.0–10.5.0. It describes an access restriction bypass in the "+customapp" component, allowing remote authenticated attackers to obtain information from other logged-in users via unspecified vectors. The connected documents also reference related issues (CVE-...

Directory Traversal Vulnerability in Multiple IBM Devices

Tivoli is IBM's IT administrator management component specifically tailored for enterprise use of IBM products, which corresponds to the range of medium to large enterprise systems management platforms. A directory traversal vulnerability exists in multiple IBM devices. Allows remote authenticate...

CVE-2016-6903

lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands...

CVE-2016-3733

The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber...

UBUNTU-CVE-2016-3733

The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber...

CVE-2016-3733

CVE-2016-3733 affects Moodle versions: 3.0–3.0.3, 2.9–2.9.5, 2.8–2.8.11, 2.7–2.7.13, and earlier. Root cause: the Moodle “restore teacher” feature allows remote authenticated users to overwrite the course idnumber. Impact: enables modification of a course identifier by an authenticated actor. Exp...

CVE-2016-3729

CVE-2016-3729 affects Moodle complaints of improper access control: the user editing form in Moodle versions 3.0–3.0.3, 2.9–2.9.5, 2.8–2.8.11, and 2.7–2.7.13 (and earlier) allows remote authenticated users to edit profile fields that are supposed to be locked by the administrator. The connected a...

CVE-2016-1713

Unrestricted file upload vulnerability in the SettingsVtigerCompanyDetailsSaveAction class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension, then...

CVE-2017-7357

Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbitrary code by importing a file...

CVE-2016-4889

CVE-2016-4889 affects ManageEngine ServiceDesk Plus prior to 9.0. A vulnerability allows remote authenticated guest users to access functions that should be restricted, due to failure to enforce access controls on unknown functions. Impact is described as unspecified in some sources, but the comm...

Sql injection

Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the 1 xlsprofile parameter to admin/mcartxlsimport.php or the 2 xlsiblockid, 3 xlsiblocksectionid, 4 firstRow, 5 titleRow, 6...

CVE-2015-8356

Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the 1 xlsprofile parameter to admin/mcartxlsimport.php or the 2 xlsiblockid, 3 xlsiblocksectionid, 4 firstRow, 5 titleRow, 6...

OpenSSH xauth Input Authentication Vulnerability

OpenSSH OpenBSD Secure Shell is a set of connection tools maintained by the OpenBSD Project Group for secure access to remote computers. OpenSSH has a security vulnerability. A remotely authenticated user can read or modify files on the target system and can execute the xauth command on the targe...

CVE-2016-10322

Synology Photo Station (pre-6.3-2958) is affected by CVE-2016-10322. Remote authenticated guest users can inject shell metacharacters in the X-Forwarded-For header to photo/login.php and execute arbitrary commands. Impact is described as remote code execution with the attacker in a low-privilege ...

CVE-2016-10310

Buffer overflow in the MobiLink Synchronization Server component in SAP SQL Anywhere 17 and possibly earlier allows remote authenticated users to cause a denial of service resource consumption and process crash by sending a crafted packet several times, aka SAP Security Note 2308778...