CVE-2017-10245: Undefined Security Weakness

Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite subcomponent: Account Hierarchy Manager. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with networ...

CVE-2017-6725

A vulnerability in the web framework code of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. More Information: CSCuw65833 CSCuw65837. Known Affected Releases: 2.22...

Row Seats Core <= 2.66 - Unauthenticated PHP Object Injection

The plugin row-seats insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. This vulnerability was patched in version 2.68, information is being released now as a disclosure period has expired. Attac...

Code injection

Vulnerability in the Automatic Service Request ASR component of Oracle Support Tools subcomponent: ASR Manager. The supported version that is affected is Prior to 5.7. Easily "exploitable" vulnerability allows unauthenticated attacker with logon to the infrastructure where Automatic Service Reque...

Design/Logic Flaw

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Fluid Core. Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

CVE-2017-2320

A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-based attacker to cause various denials of services leading to targeted information disclosure, modification of any component of the...

CVE-2017-3497: Undefined Security Weakness

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Remote Administration Daemon. The supported version that is affected is 11.3. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise...

CVE-2017-3583: Undefined Security Weakness

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite subcomponent: Web Access. Supported versions that are affected are 8.3, 8.4, 15.1, 15.2, 16.1 and 16.2. Easily "exploitable" vulnerability allows unauthenticated attacker with...

CVE-2017-3329: Undefined Security Weakness

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Thread Pooling. Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via...

CVE-2017-3450: Undefined Security Weakness

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Memcached. Supported versions that are affected are 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via multiple protocols to...

CVE-2017-3393: Undefined Security Weakness

Vulnerability in the Oracle Advanced Outbound Telephony component of Oracle E-Business Suite subcomponent: Interaction History. Supported versions that are affected are 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HT...

CVE-2017-6205: Undefined Security Weakness

D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28, and DGS-1510-20 Websmart devices with firmware before 1.31.B003 allow attackers to conduct Unauthenticated Command Bypass attacks via unspecified vectors...

Cross site scripting

XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /news-events/events date parameter...

Design/Logic Flaw

XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us/locations/index direction parameter...

CVE-2017-5877

XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us/locations/index direction parameter...

CVE-2017-5876

XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /news-events/events date parameter...

CVE-2017-5876

CVE-2017-5876 describes a cross-site scripting (XSS) vulnerability in dotCMS version 3.7.0. An unauthenticated attacker can exploit the vulnerability via the /news-events/events date parameter. The issue is documented across multiple sources (NVD, CNVD, OSV, OpenVAS, CVE lists). Affected software...

CVE-2017-5877

DotCMS 3.7.0 is affected by a cross-site scripting (XSS) vulnerability that can be triggered by an unauthenticated attacker via the /about-us/locations/index parameter. The issue is documented as CVE-2017-5877. NVD notes CVSS v2 base score 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) and CVSS v3 base score 6...

CVE-2017-5877: Improper Neutralization of Input During Web Page Generation

XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us/locations/index direction parameter...

CVE-2017-5876: Improper Neutralization of Input During Web Page Generation

XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /news-events/events date parameter...