CVE-2017-7145

CVE-2017-7145 affects iOS before 11 in the Time component, specifically the Time Zone setting that may misuse location data. The Apple security content entry notes a permissions issue in the time zone handling process, addressed by modifying permissions. Connected references corroborate the issue...

PT-2017-17540

Name of the Vulnerable Software and Affected Versions iOS versions prior to 11 Description An issue was discovered in certain Apple products, involving the "Time" component. The issue is related to the "Setting Time Zone" feature, which mishandles the possibility of using location data...

CVE-2017-7145: Undefined Security Weakness

An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Time" component. The "Setting Time Zone" feature mishandles the possibility of using location data...

HP ArcSight Enterprise Security Manager and Enterprise Security Manager Express Access Control Error Vulnerability (CNVD-2017-30913)

HP ArcSight ESM Enterprise Security Manager and ESM Express are both enterprise security management software with event correlation and security analysis capabilities from Hewlett Packard Enterprise HPE. The software collects, correlates and reports on enterprise-wide security events in real time...

Trend Micro Mobile Security for Enterprise change_ios_setting Device_DeviceId SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Mobile Security for Enterprise. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of the changeiossetting action. When parsing the...

Wordpress plugin image-gallery-with-slideshow 'imgid' parameter SQL injection vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the Wordpress plugin image-gallery-with-slideshow. A remote attacker can exploit the...

CVE-2017-1002014

Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/adminsetting.php via galleryname parameter...

CVE-2017-1002012

Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/adminsetting.php the following snippet of code does not sanitize input via the gid variable before passing it into an SQL statement...

CVE-2017-1002015

Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/adminsetting.php via selectMulGallery parameter...

openSUSE Security Update : salt (openSUSE-2017-1016)

This update for salt fixes the following issues : - Update to 2017.7.1 See https://docs.saltstack.com/en/develop/topics/releases/20 17.7.1.html for full changelog - CVE-2017-12791: crafted minion ID could lead directory traversal on the Salt-master boo1053955 - Run fdupes over all of /usr because...

Design/Logic Flaw

A vulnerability in the ability for guest users to join meetings via a hyperlink with Cisco Meeting Server could allow an authenticated, remote attacker to enter a meeting with a hyperlink URL, even though access should be denied. The vulnerability is due to the incorrect implementation of the...

CVE-2017-12224

A vulnerability in the ability for guest users to join meetings via a hyperlink with Cisco Meeting Server could allow an authenticated, remote attacker to enter a meeting with a hyperlink URL, even though access should be denied. The vulnerability is due to the incorrect implementation of the...

JVN#09769017: Multiple Fuji Xerox products may insecurely load Dynamic Link Libraries

Installers of multiple products, and DocuWorks self-extracting documents provided by Fuji Xerox Co.,Ltd. contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the administrative...

Unauthorized operation vulnerability in Hikvision webcam image setting interface

Hikvision DS-2CD2710F-I, DS-5C-I Series are network camera products developed by Hikvision China. An unauthorized operation vulnerability exists in the image setting interface of Hikvision network cameras, which fails to verify the legitimacy of parameters during reception and processing. An...

Firefox SVG Cross-Domain Cookie Setting (CVE-2016-9078)

A cross-domain Cookie vulnerability exists in Firefox. The vulnerability is due to the way that Firefox handles Cookie creation. A successful attack could lead to a execution of arbitrary code on the affected system...

PT-2017-19230 · Sma Solar Technology · Sunny Boy Tlst-21 +2

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products, specifically Sunny Boy TLST-21, TL-21, and Sunny Tripower TL-10, TL-30 Description: An issue allows an attacker to change the plant time without authentication, potentially affecting system time and making...

CVE-2017-11726

services/systemio/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery CSRF, as demonstrated by changing an e-mail address setting...

CVE-2017-11726: Cross-Site Request Forgery (CSRF)

services/systemio/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery CSRF, as demonstrated by changing an e-mail address setting...

Trend Micro Deep Discovery Email Inspector kdump_setting Denial of Service Vulnerability

This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of Trend Micro Deep Discovery Email Inspector. Authentication is not required to exploit this vulnerability. The specific flaw exists within kdumpsetting.php. The issue results from the lack of proper...

PT-2017-19431

Name of the Vulnerable Software and Affected Versions csd-datetime-setting affected versions not specified Description The issue is related to the SetDate DBUS function in csd-datetime-setting, which does not check for polkit authorization of the caller, unlike the SetTime function. Recommendatio...