CVE-2017-1000469

Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user...

PT-2018-1445

Name of the Vulnerable Software and Affected Versions Intel microprocessors affected versions not specified Description The issue concerns systems with microprocessors that use speculative execution and address translations, potentially allowing unauthorized disclosure of information from the L1...

PT-2018-1001

Name of the Vulnerable Software and Affected Versions Systems with microprocessors utilizing speculative execution and branch prediction affected versions not specified Description The issue is related to microprocessors utilizing speculative execution and branch prediction, which may allow...

Microsoft Edge Scripting Engine CVE-2018-0775 Remote Memory Corruption Vulnerability

Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft Edge Recommendations...

CVE-2017-17853

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service memory corruption or possibly have unspecified other impact by leveraging incorrect BPFRSH signed bounds calculations...

woocommerce-csvimport 3.3.6 – Authenticated Arbitrary File Deletion

Type user access: any user registered. $POST'filename' is not escaped. Code File: wp-content/plugins/woocommerce-csvimport/export/include/classes/woocsvExport.php Line:64 public function deleteexportfile if isset $POST'filename' @unlink $POST'filename' ; wpdie 0 ; Result: wp-config.php file delet...

Directory traversal

Directory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with Admin-User access to write to arbitrary files and consequently gain root privileges by uploadi...

CVE-2017-16788

Directory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with Admin-User access to write to arbitrary files and consequently gain root privileges by uploadi...

FreeBSD : GitLab -- multiple vulnerabilities (e72a8864-e0bc-11e7-b627-d43d7e971a1b)

GitLab reports : User without access to private Wiki can see it on the project page Matthias Burtscher reported that it was possible for a user to see a private Wiki on the project page without having the corresponding permission. E-mail address disclosure through member search fields Hugo Geoffr...

Meinberg LANTIME Web Configuration Utility 6.16.008 - Arbitrary File Read Vulnerability (2)

Exploit for cgi platform in category web applications Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Upload Path Traversal Author: Jakub Palaczynski CVE: CVE-2017-16788 Exploit was tested on: ====================== Meinberg LANTIME Web Configuration Utility 6.16.008...

Meinberg LANTIME Web Configuration Utility 6.16.008 - Arbitrary File Read

Meinberg LANTIME Web Configuration Utility 6.16.008 - Arbitrary File Read Title: Meinberg LANTIME Web Configuration Utility - Arbitrary File Read Author: Jakub Palaczynski CVE: CVE-2017-16787 Exploit tested on: ================== Meinberg LANTIME Web Configuration Utility 6.16.008 Vulnerability...

Microsoft Internet Explorer Scripting Engine CVE-2017-11901 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Internet Explorer 10 and 11 are...

Microsoft Edge Scripting Engine CVE-2017-11918 Remote Memory Corruption Vulnerability

Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft ChakraCore Microsoft...

Error: "One or more issues were detected with your licensing configuration" during XenApp/XenDesktop upgrade to 7.16

When upgrading a Delivery Controller to version 7.16, a Citrix licensing error message might appear "One or more issues were detected with your licensing configuration. If unresolved, such issues will affect users' ability to access applications and desktops after the site upgrade"...

CVE-2017-17471

TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service BSOD or possibly have unspecified other impact via a \.\Viragtlt DeviceIoControl request of 0x82732140...

CVE-2017-17471

TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service BSOD or possibly have unspecified other impact via a \.\Viragtlt DeviceIoControl request of 0x82732140...

CVE-2017-17448

net/netfilter/nfnetlinkcthelper.c in the Linux kernel through 4.14.4 does not require the CAPNETADMIN capability for new, get, and del operations, which allows local users to bypass intended access restrictions because the nfnlcthelperlist data structure is shared across all net namespaces...

Perspective ICM Investigation Case 5.1.1.16 - Privilege Escalation

Perspective ICM Investigation Case 5.1.1.16 - Privilege Escalation Exploit Title: Privilege Escalation - Perspective ICM Investigation & Case - 5.1.1.16 Date Reported to vendor: Jun 28, 2017 Date Accepted by vendor: Jun 11, 2017 Exploit Author: [email protected] Vendor Homepage:...

Design/Logic Flaw

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm...

The vulnerability of the ALEOS software, a wireless modem from Sierra Wireless, allows a hacker to gain access to the system by exploiting pre-installed credentials.

The vulnerability of the ALEOS software for the Sierra Wireless AirLink GX 440 wireless modem lies in the use of pre-set login credentials. Exploiting this vulnerability allows a malicious actor to gain access to the system with privileges of one of the users: admin, rauser, sconsole, or user, by...