JVN#17535578: Multiple vulnerabilities in Cybozu Office

Cybozu Office contains multiple vulnerabilities listed below. Cross-site scripting in the design setting screen CWE-79 - CVE-2017-2114 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N| Base Score: 5.4 CVSS v2| AV:N/AC:L/Au:S/C:N/I:P/A:N| Base Score: 4.0...

CS-Cart Japanese Edition fails to restrict access permissions

Overview CS-Cart is a system for creating online shopping websites. CS-Cart Japanese Edition fails to restrict access permissions CWE-425. Hirota Kazuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

JVN#14396697: CS-Cart Japanese Edition fails to restrict access permissions

CS-Cart is a system for creating online shopping websites. CS-Cart Japanese Edition fails to restrict access permissions CWE-425. Impact An unauthenticated remote attacker may obtain consumer's information such as its name and street address registered in the website. Solution Update the Software...

Tablacus Explorer vulnerable to script injection

Overview Tablacus Explorer is a tabbled file manager. Tablacus Explorer contains a script injection vulnerability due to improper handling of directory names. Touma Hatano reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

JVN#64451600: Tablacus Explorer vulnerable to script injection

Tablacus Explorer is a tabbled file manager. Tablacus Explorer contains a script injection vulnerability due to improper handling of directory names. Impact When a user accesses a crafted directory, an arbitrary script may be executed on Tablacus Explorer. As a result, an arbitrary OS command may...

CVE-2017-7450

AIRTAME HDMI dongle with firmware before 2.2.0 allows unauthenticated access to a big part of the management interface. It is possible to extract all information including the Wi-Fi password, reboot, or force a software update at an arbitrary time...

Design/Logic Flaw

AIRTAME HDMI dongle with firmware before 2.2.0 allows unauthenticated access to a big part of the management interface. It is possible to extract all information including the Wi-Fi password, reboot, or force a software update at an arbitrary time...

CVE-2017-7450

AIRTAME HDMI dongle with firmware before 2.2.0 allows unauthenticated access to a big part of the management interface. It is possible to extract all information including the Wi-Fi password, reboot, or force a software update at an arbitrary time...

Cisco Aironet 1830 Series and 1850 Series Access Points Mobility Express Default Credential Vulnerability

A vulnerability in Cisco Aironet 1830 Series and Cisco Aironet 1850 Series Access Points running Cisco Mobility Express Software could allow an unauthenticated, remote attacker to take complete control of an affected device. The vulnerability is due to the existence of default credentials for an...

OPENSUSE-SU-2017:0917-1 Recommended update for geotiff

This geotiff version update to 1.4.2 fixes the following issues: - Update to 1.4.2 boo1029595 update to EPSG v8.9 database cleanups and security fixes - Small packaging cleanup - Switched download link to OSGeo server - Fix Group tag...

DSA-3816-2 samba - regression update

Bulletin has no description...

MGASA-2017-0095 Updated deluge packages fix security vulnerability

Updated deluge package fixes a CSRF Cross-site request forgery vulnerability using upstream patch. Cross-Site Request Forgery CSRF is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target...

DLA-877-1 tiff - security update

Bulletin has no description...

MGASA-2017-0087 Updated flash-player-plugin packages fix security vulnerability

Updated flash-player-plugin installs latest version for the flash plugin from adobe. See the referenced security bulletin for details...

ICSMA-17-082-02_B. Braun Medical SpaceCom Open Redirect Vulnerability

OVERVIEW This advisory was originally posted to the NCCIC Portal on March 23, 2017, and is being released to the ICS-CERT web site. Marc Ruef and Rocco Gagliardi of scip AG have identified an open redirect vulnerability in B. Braun Medical’s SpaceCom module, which is integrated into the...

Cisco IOS XE Software Web User Interface Denial of Service Vulnerability

A vulnerability in the web user interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient resource handling by the affected software when the web user interface is under a high load. An attack...

Cisco IOx Data in Motion Stack Overflow Vulnerability

A vulnerability in the Data-in-Motion DMo process installed with the Cisco IOx application environment could allow an unauthenticated, remote attacker to cause a stack overflow that could allow remote code execution with root privileges in the virtual instance running on an affected device. The...

Cisco IOS XE Software for Cisco ASR 920 Series Routers Zero Touch Provisioning Denial of Service Vulnerability

A vulnerability in the DHCP code for the Zero Touch Provisioning feature of Cisco ASR 920 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a format string vulnerability when processing a crafted...

SUSE-SU-2017:0799-1 Security update for wget

This update for wget fixes the following issues: Security issue fixed: - CVE-2017-6508: urlparse: Reject control characters in host part of URL bsc1028301...

Security Advisory - Information Leak Vulnerability in Huawei Hilink APP

Huawei Hilink APP has an information leak vulnerability. An attacker may trick a user into installing a malicious application and application can access Hilink APP data. Vulnerability ID: HWPSIRT-2017-01092 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID:...