4496 matches found
CVE-2016-5972
IBM Security Privileged Identity Manager ISPIM Virtual Appliance 2.x before 2.0.2 FP8 uses weak permissions for unspecified resources, which allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors...
CVE-2016-5972
CVE-2016-5972 affects IBM Security Privileged Identity Manager Virtual Appliance 2.0.x prior to 2.0.2 FP8, where permissions on a security‑critical resource are configured so that read/modify access can be obtained by unintended actors. Root cause: weak permissions on the resource. Impact per sou...
CVE-2016-6373
The web-based GUI in Cisco Cloud Services Platform CSP 2100 2.0 allows remote authenticated administrators to execute arbitrary OS commands as root via crafted platform commands, aka Bug ID CSCva00541...
DEBIAN-CVE-2016-6801
Cross-site request forgery CSRF vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the...
CVE-2016-4968
The linkreport/tmp/adminglobal page in Fortinet FortiWan formerly AscernLink before 4.2.5 allows remote authenticated users to discover administrator cookies via a GET request...
CVE-2016-4967
Fortinet FortiWan formerly AscernLink before 4.2.5 allows remote authenticated users to obtain sensitive information from 1 a backup of the device configuration via script/cfgshow.php or 2 PCAP files via script/system/tcpdump.php...
CVE-2016-4965
Fortinet FortiWan formerly AscernLink before 4.2.5 allows remote authenticated users with access to the nslookup functionality to execute arbitrary commands with root privileges via the graph parameter to diagnosiscontrol.php...
CVE-2016-4965
Fortinet FortiWan formerly AscernLink before 4.2.5 allows remote authenticated users with access to the nslookup functionality to execute arbitrary commands with root privileges via the graph parameter to diagnosiscontrol.php...
CVE-2016-4967
Fortinet FortiWAN (AscernLink) before 4.2.5 is affected by CVE-2016-4967: an authenticated non-admin user can disclose sensitive data by accessing /script/cfg_show.php to grab a device configuration backup or /script/system/tcpdump.php to obtain a PCAP. The issue is confirmed across multiple sour...
AlienVault Unified Security Management Remote Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication requirements on vulnerable installations of AlienVault Unified Security Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the logcheck function in session.inc. By providing a...
Cross site scripting
Cross-site scripting XSS vulnerability in EMC ViPR SRM before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...
PT-2016-6599 · Oracle +6 · Mysql Server +5
Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 5.5.51 and earlier Oracle MySQL versions 5.6.32 and earlier Oracle MySQL versions 5.7.14 and earlier Description: The issue allows remote authenticated users to affect availability via vectors related to GIS. It is an...
PT-2016-5513 · Oracle +6 · Mysql Server +5
Name of the Vulnerable Software and Affected Versions: Oracle MySQL versions 5.5.51 and earlier Oracle MySQL versions 5.6.32 and earlier Oracle MySQL versions 5.7.14 and earlier Description: The issue allows remote authenticated users to affect availability via vectors related to Server: Optimize...
Command injection
The certrevoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission...
DEBIAN-CVE-2016-1242
fileopen in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors...
PYSEC-2016-12
Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors...
CVE-2016-1241
Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors...
CVE-2016-1241
Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors...
CVE-2016-7108
Huawei UMA (Unified Maintenance Audit) before V200R001C00SPC200 SPH206 suffers an information disclosure where remote authenticated users can obtain MD5 hashes of arbitrary user passwords via unspecified vectors. The advisory HWPSIRT-2016-07051 notes a fix; apply Huawei software updates to mitiga...