ProcessMaker Enterprise Core Code Execution Vulnerability(CVE-2016-9045)

Summary A code execution vulnerability exists in ProcessMarker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability. Tested...

PT-2017-13459 · D Link · D-Link Dir-850L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-850L REV. A versions through FW114WWb07 h2ab beta1 Description: The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the presence of a cross-site scripting XSS flaw in the action...

PT-2017-13460 · D Link · D-Link Dir-850L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-850L REV. A versions through FW114WWb07 h2ab beta1 Description: The issue concerns a problem where an attack can be performed. The estimated number of potentially affected devices worldwide is not available. Details about real-worl...

Unauthorized File Upload

typo3/cms is vulnerable to unauthorized file upload. The library does not restrict files with the pht extension, allowing a malicious user to upload a .pht file to the application and execute arbitrary PHP script...

PT-2017-2898 · D Link · D-Link Dir-850L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-850L REV. A versions through FW114WWb07 h2ab beta1 D-Link DIR-850L REV. B versions through FW208WWb02 Description: The issue is related to the DHCP service in the D-Link DIR-850L router's firmware, specifically with the handling of...

PT-2017-2800

Name of the Vulnerable Software and Affected Versions Subversion versions prior to 1.8.19 Subversion versions 1.9.x prior to 1.9.7 Subversion versions 1.10.0.x through 1.10.0-alpha3 git-annex versions prior to 6.20170818 Description A maliciously constructed URL could cause Subversion clients to...

PT-2017-17056

Name of the Vulnerable Software and Affected Versions libmspack version 0.5alpha ClamAV version 0.99.2 Description The issue allows remote attackers to cause a denial of service, resulting in a heap-based buffer overflow and application crash, or possibly have other unspecified impacts. This is...

PT-2017-19217 · Sma Solar Technology · Sunny Tripower +3

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products affected versions not specified Sunny Boy versions TLST-21 and TL-21 Sunny Tripower versions TL-10 and TL-30 Description: An issue was discovered in SMA Solar Technology products where sending nonsense data or...

PT-2017-19223 · Sma Solar Technology · Sunny Tripower +3

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products affected versions not specified Sunny Boy versions TLST-21 and TL-21 Sunny Tripower versions TL-10 and TL-30 Description: The SMAdata2+ communication protocol in SMA Solar Technology products does not properly us...

PT-2017-4340

Name of the Vulnerable Software and Affected Versions: OpenCV Open Source Computer Vision Library versions 3.3 and earlier Description: The issue is related to an out-of-bounds write error in the FillColorRow8 function in utils.cpp when reading an image file using cv::imread. This can allow a...

PT-2018-1896

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 7.4 Description The issue is related to a denial of service caused by a NULL pointer dereference and daemon crash in OpenSSH. This can be triggered by remote attackers via an out-of-sequence NEWKEYS message, as...

GLPI 'entity_restrict' parameter SQL injection vulnerability

GLPI is an open source IT resource management suite maintained by the Indepnet Association. The suite includes features such as device status management, asset inventory storage, management processes and work log management. An SQL injection vulnerability exists in versions of GLPI prior to 9.1.5...

UBUNTU-CVE-2017-11329

GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entityrestrict parameter that is not a list of integers...

PT-2017-11928

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.1.5 Description The issue allows SQL injection via an "ajax/getDropdownValue.php" request with an entity restrict parameter that is not a list of integers. Recommendations For versions prior to 9.1.5, update to version...

Add possibility to disable public access to JIRA

As an Administrator I would like to be able to disable public access to JIRA, so the users will have to login before they can browse projects, search issues or navigate to system dashboard. Workaround: In JIRA 7.2.10 the possibility to disable public access for anonymous users was added, however ...

PT-2017-3886 · Freeware +1 · Faad2 +1

Name of the Vulnerable Software and Affected Versions: Freeware Advanced Audio Decoder 2 FAAD2 version 2.7 Description: The issue is caused by a buffer overflow in the mp4ff read stsd function, located in common/mp4ff/mp4atom.c, which can lead to a denial of service. This can be triggered by a...

PT-2017-3908 · Freeware +1 · Faad2 +1

Name of the Vulnerable Software and Affected Versions: Freeware Advanced Audio Decoder 2 FAAD2 version 2.7 Description: The issue is related to the mp4ff read stco function, which can lead to a denial of service due to excessive CPU consumption caused by a large loop. This can be triggered by a...

Debian DLA-986-1 : zookeeper security update

It was discovered that Zookeeper, a service for maintaining configuration information, didn't restrict access to the computationally expensive wchp/wchc commands which could result in denial of service by elevated CPU consumption. This update disables those two commands by default. The new...

Microsoft Windows Kernel 'Win32k.sys' CVE-2017-8484 Local Information Disclosure Vulnerability

Description Microsoft Windows is prone to a local information-disclosure vulnerability. A local attacker can leverage this issue to disclose sensitive information that may aid in further attacks. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Versi...

PT-2017-8337 · Pulp · Pulp

Name of the Vulnerable Software and Affected Versions: Pulp versions prior to 2.8.3 Description: The issue concerns a world-readable file containing the private key for the Node certificate, stored in the "/etc/pki/pulp/nodes/" directory. This allows local users to access sensitive data,...