PT-2018-10747 · Lutron · Stanza Lutron Integration Protocol

Name of the Vulnerable Software and Affected Versions: Stanza Lutron integration protocol versions Revision M through Revision Y Description: The issue allows attackers to gain total super user control of an IoT device through a TELNET session. This is made possible by default and unremovable...

PT-2018-10746 · Lutron · Lutron Radiora 2

Name of the Vulnerable Software and Affected Versions: Lutron RadioRA 2 versions Revision M through Revision Y Description: The issue allows attackers to gain total super user control of an IoT device through a TELNET session. Default and unremovable support credentials are used, with the usernam...

DRUPAL-CONTRIB-2018-025

Simple Taxonomy Revision module enables revisions for taxonomy terms for Drupal 8. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: . The securit...

tor/oss-fuzz-consensus: Heap-buffer-overflow in mock_crypto_pk_public_checksig__nocheck

Project: https://git.torproject.org/tor.git Detailed report: https://oss-fuzz.com/testcase?key=5170904637112320 Project: tor Fuzzer: libFuzzertoross-fuzz-consensus Fuzz target binary: oss-fuzz-consensus Job Type: libfuzzerasantor Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash...

Fixed in Apache Tomcat 7.0.82

Important: Remote Code Execution CVE-2017-12617 When running with HTTP PUTs enabled e.g. via setting the readonly initialisation parameter of the Default servlet to false it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any...

Fixed in Apache Tomcat 9.0.1

Important: Remote Code Execution CVE-2017-12617 When running with HTTP PUTs enabled e.g. via setting the readonly initialisation parameter of the Default servlet to false it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any...

CVE-2017-7734

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via 'Comments' while saving Config Revisions...

CVE-2017-7734

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via 'Comments' while saving Config Revisions...

Cross site scripting

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via 'Comments' while saving Config Revisions...

CVE-2017-7734

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via 'Comments' while saving Config Revisions...

CVE-2017-7734

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via 'Comments' while saving Config Revisions...

FreeBSD : drupal -- Drupal Core - Multiple Vulnerabilities (473b6a9e-8493-11e7-b24b-6cf0497db129)

Drupal Security Team : CVE-2017-6923: Views - Access Bypass - Moderately Critical CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical...

Entity access bypass for entities that do not have UUIDs or have protected revisions.

More info at https://www.drupal.org/SA-CORE-2017-004...

Entity access bypass for entities that do not have UUIDs or have protected revisions.

More info at https://www.drupal.org/SA-CORE-2017-004...

drupal -- Drupal Core - Multiple Vulnerabilities

Drupal Security Team: CVE-2017-6923: Views - Access Bypass - Moderately Critical CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical...

Fortinet FortiOS 5.2.x / 5.3.x / 5.4.x < 5.4.5 Multiple XSS (FG-IR-17-127)

The version of Fortinet FortiOS running on the remote device is 5.2.x, 5.3.x, or 5.4.x prior to 5.4.4. It is, therefore, affected by multiple cross-site scripting XSS vulnerabilities : - A cross-site scripting XSS vulnerability exists when saving configuration revisions due to improper validation...

Rockwell Automation PanelView Plus 6 700-1500

CVSS v3 8.6 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: Rockwell Automation Equipment: PanelView Plus 6 700-1500 Vulnerability: Missing Authorization AFFECTED PRODUCTS The following versions of PanelView Plus 6 700-1500, graphic terminals and logic module products, are...

Fastspot BigTree CMS Security Bypass Vulnerability

Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A security bypass vulnerability exists in Fastspot BigTree CMS versions 4.2.18 and earlier. An attacker can exploit this vulnerability by sending the 'force' parameter to t...

dlplibs: Heap-buffer-overflow in MsWksDBParser::readFormula

Detailed report: https://oss-fuzz.com/testcase?key=5753657637208064 Project: dlplibs Fuzzer: libFuzzerdlplibsclariswksfuzzer Fuzz target binary: clariswksfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x62e00000bd99 Crash State:...

Fixed in Apache Tomcat 7.0.78

Important: Security Constraint Bypass CVE-2017-5664 The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the...