Cross-site Scripting (XSS)

airflow is vulnerable to cross-site scripting XSS attacks. These attacks are possible through the variable view, when the variable template doesn't exist. When this happens, the input is returned to the user without being escaped...

SchoolCMS suffers from a variable override vulnerability (CNVD-2017-30716)

SchoolCMS is a school teaching management system based on PHP+MySQL. SchoolCMS suffers from a variable override vulnerability. An attacker can utilize the browser's TAB function to reset any user's password...

Variable Override Vulnerability in SchoolCMS

SchoolCMS is a school teaching management system based on PHP+MySQL. SchoolCMS suffers from a variable override vulnerability. An attacker can utilize the browser's TAB function to override access to user information...

WordPress surveys SQL injection vulnerability

WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.WordPress surveys is a polls plugin developed by Binny VA, an Indian software developer for Wordpress. A SQL injection...

CVE-2017-1002022

Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query...

CVE-2017-1002027

Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query in file ./rk-responsive-contact-form/include/rkuserlist.php...

CVE-2017-1002020

Vulnerability in wordpress plugin surveys v1.01.8, The code in surveyform.php does not sanitize the action variable before placing it inside of an SQL query...

The vulnerability of the TrustZone component of the Android operating system from the CAF repository, which allows a perpetrator to gain unauthorized access to protected memory.

The vulnerability of the TrustZone component of the Android operating system from the CAF repository relates to the use of an uninitialized variable during system calls. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected memor...

CVE-2017-12865

Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 and earlier allows remote attackers to cause a denial of service crash or execute arbitrary code via a crafted response query string passed to the "name" variable...

CVE-2017-13697

controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable...

CVE-2017-13697

controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable...

glibc, nscd security update

CentOS Errata and Security Advisory CESA-2017:1916 An update for glibc is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2017-13130

mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the RPATH variable begins with the .: substring...

Code injection

mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the RPATH variable begins with the .: substring...

CVE-2017-13130

mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the RPATH variable begins with the .: substring...

DEBIAN-CVE-2017-12960

There is a reachable assertion abort in the function dictrenamevar in data/dictionary.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote denial of service...

Design/Logic Flaw

In all Qualcomm products with Android releases from CAF using the Linux kernel, a variable is uninitialized in a TrustZone system call potentially leading to the compromise of secure memory...

CVE-2014-9979

In all Qualcomm products with Android releases from CAF using the Linux kernel, a variable is uninitialized in a TrustZone system call potentially leading to the compromise of secure memory...

phpMyAdmin Global Variable Scope Injection Vulnerability (PMASA-2013-7) - Linux

phpMyAdmin is prone to a global variable scope injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

openSUSE Security Update : openldap2 (openSUSE-2017-936)

This update for openldap2 fixes the following issues : - Let OpenLDAP read system wide certificate directory by default and avoid hiding the error if user specified CA location cannot be read boo1009470. - Fix CVE-2017-9287: openldap2: Double free vulnerability with patch boo1041764 - Fix an...