PT-2017-3948

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.0.2m OpenSSL versions prior to 1.1.0g Description The issue is related to a carry propagating bug in the x86 64 Montgomery squaring procedure. This bug may allow a remote attacker to gain unauthorized access to...

PT-2017-4257 · Ruby +4 · Yajl-Ruby +4

Name of the Vulnerable Software and Affected Versions: yajl-ruby gem version 1.3.0 Description: The issue is related to insufficient processing of a format string in the yajl string decode function of the yajl encode.c component in the YAJL-ruby JSON library. When a crafted JSON file is supplied ...

PT-2017-14034 · E Sic · E-Sic

Name of the Vulnerable Software and Affected Versions: E-Sic version 1.0 Description: A SQL Injection issue exists in the password reset parameter, specifically the cpfcnpj parameter to the "/reset" URI. Recommendations: For E-Sic version 1.0, avoid using the cpfcnpj parameter in the /reset URI...

PT-2017-4232 · Mikrotik · Routeros +1

Name of the Vulnerable Software and Affected Versions: Mikrotik RouterOS versions prior to Stable 6.38.5 Mikrotik RouterOS versions prior to Long-term 6.37.5 Description: The issue is related to memory corruption in the Mikrotik RouterOS web server. A remote and unauthenticated user can trigger t...

PT-2017-3586 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.13.6 Description: A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel. The issue is related to the handling of fork failure when dealing with event messages. Failure to fork correctly can...

ProcessMaker Enterprise Core Code Execution Vulnerability(CVE-2016-9045)

Summary A code execution vulnerability exists in ProcessMarker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability. Tested...

PT-2017-13459 · D Link · D-Link Dir-850L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-850L REV. A versions through FW114WWb07 h2ab beta1 Description: The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the presence of a cross-site scripting XSS flaw in the action...

PT-2017-13460 · D Link · D-Link Dir-850L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-850L REV. A versions through FW114WWb07 h2ab beta1 Description: The issue concerns a problem where an attack can be performed. The estimated number of potentially affected devices worldwide is not available. Details about real-worl...

Unauthorized File Upload

typo3/cms is vulnerable to unauthorized file upload. The library does not restrict files with the pht extension, allowing a malicious user to upload a .pht file to the application and execute arbitrary PHP script...

PT-2017-2898 · D Link · D-Link Dir-850L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-850L REV. A versions through FW114WWb07 h2ab beta1 D-Link DIR-850L REV. B versions through FW208WWb02 Description: The issue is related to the DHCP service in the D-Link DIR-850L router's firmware, specifically with the handling of...

PT-2017-2800

Name of the Vulnerable Software and Affected Versions Subversion versions prior to 1.8.19 Subversion versions 1.9.x prior to 1.9.7 Subversion versions 1.10.0.x through 1.10.0-alpha3 git-annex versions prior to 6.20170818 Description A maliciously constructed URL could cause Subversion clients to...

PT-2017-17056

Name of the Vulnerable Software and Affected Versions libmspack version 0.5alpha ClamAV version 0.99.2 Description The issue allows remote attackers to cause a denial of service, resulting in a heap-based buffer overflow and application crash, or possibly have other unspecified impacts. This is...

PT-2017-19217 · Sma Solar Technology · Sunny Tripower +3

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products affected versions not specified Sunny Boy versions TLST-21 and TL-21 Sunny Tripower versions TL-10 and TL-30 Description: An issue was discovered in SMA Solar Technology products where sending nonsense data or...

PT-2017-19223 · Sma Solar Technology · Sunny Tripower +3

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products affected versions not specified Sunny Boy versions TLST-21 and TL-21 Sunny Tripower versions TL-10 and TL-30 Description: The SMAdata2+ communication protocol in SMA Solar Technology products does not properly us...

PT-2018-1896 · Openssh +5 · Openssh +5

Name of the Vulnerable Software and Affected Versions: OpenSSH versions prior to 7.4 Description: The issue is related to a denial of service caused by a NULL pointer dereference and daemon crash in OpenSSH. This can be triggered by remote attackers via an out-of-sequence NEWKEYS message, as...

GLPI 'entity_restrict' parameter SQL injection vulnerability

GLPI is an open source IT resource management suite maintained by the Indepnet Association. The suite includes features such as device status management, asset inventory storage, management processes and work log management. An SQL injection vulnerability exists in versions of GLPI prior to 9.1.5...

UBUNTU-CVE-2017-11329

GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entityrestrict parameter that is not a list of integers...

Add possibility to disable public access to JIRA

As an Administrator I would like to be able to disable public access to JIRA, so the users will have to login before they can browse projects, search issues or navigate to system dashboard. Workaround: In JIRA 7.2.10 the possibility to disable public access for anonymous users was added, however ...

PT-2017-3886 · Freeware +1 · Faad2 +1

Name of the Vulnerable Software and Affected Versions: Freeware Advanced Audio Decoder 2 FAAD2 version 2.7 Description: The issue is caused by a buffer overflow in the mp4ff read stsd function, located in common/mp4ff/mp4atom.c, which can lead to a denial of service. This can be triggered by a...

PT-2017-3908 · Freeware +1 · Faad2 +1

Name of the Vulnerable Software and Affected Versions: Freeware Advanced Audio Decoder 2 FAAD2 version 2.7 Description: The issue is related to the mp4ff read stco function, which can lead to a denial of service due to excessive CPU consumption caused by a large loop. This can be triggered by a...