UBUNTU-CVE-2017-7480

rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remote code execution...

GLPI 'condition rule' SQL Injection Vulnerability

GLPI is an open source IT resource management suite maintained by the Indepnet Association. The suite includes features such as device status management, asset inventory storage, management processes and work log management. An SQL injection vulnerability exists in the condition rule field in GLP...

PT-2017-2537 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.3 Description: The issue is caused by a buffer overflow in the mp override legacy irq function, located in arch/x86/kernel/acpi/boot.c. This allows local users to gain privileges via a crafted ACPI table...

Dolibarr ERP/CRM Arbitrary File Upload Vulnerability

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A security vulnerability exists in Dolibarr ERP/CRM versions...

Google Chrome V8 Denial of Service Vulnerability (CNVD-2017-14350)

Google Chrome is the United States Google Google company developed a Web browser. v8 is one of the open source JavaScript engine. A denial of service vulnerability exists in V8 in versions of Google Chrome prior to 59.0.3071.104. An attacker can exploit this vulnerability to cause a denial of...

Flatpak Local Elevation of Privilege Vulnerability

Flatpak is a system for building and installing Linux desktop applications. A local elevation of privilege vulnerability exists in versions of Flatpak prior to 0.8.7. A local attacker could exploit this vulnerability to run the setuid executable...

Trihedral VTScada Denial of Service Vulnerability

Trihedral VTScada formerly known as VTS is a SCADA system from Trihedral Engineering, Canada, based on a Windows platform with a Web interface option. A denial of service vulnerability exists in versions of Trihedral VTScada prior to 11.2.26, which arises from the program failing to validate inpu...

Sophos Web Appliance Cross-Site Scripting Vulnerability

Sophos Web Appliance SWA is a suite of Web security gateway products from Sophos UK. The product supports real-time web threat protection, customized web filtering and dynamic control of applications. A cross-site scripting vulnerability exists in the FTP redirection page in SWA versions prior to...

CVE-2017-9523

The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342...

Google Chrome credit card editor memory misreference vulnerability

Google Chrome is a web browser developed by Google.Android is a Linux-based open source operating system developed by Google and the Open Handheld Alliance OHA.credit card editor is a credit card editor. A memory misreference vulnerability exists in the credit card editor in versions of Google...

Config-Model Security Bypass Vulnerability

Config-Model aka libconfig-model-perl is an open source tool for validating, migrating or editing configuration files, which can support a variety of user interfaces such as graphical and interactive commands. A security bypass vulnerability exists in the genclasspod implementation of the...

Juniper Networks Junos Space Information Disclosure Vulnerability

Juniper Networks Junos Space is a network management solution from Juniper Networks, Inc. The solution supports automated configuration, monitoring and troubleshooting of devices and services throughout their lifecycle. An information disclosure vulnerability exists in Juniper Networks Junos Spac...

Intel Solid State Drive Toolbox Local Elevation of Privilege Vulnerability

Intel Solid State Drive Toolbox is a driver management software from Intel USA for browsing SSD Solid State Drive information. A local elevation of privilege vulnerability exists in Intel Solid State Drive Toolbox versions prior to 3.4.5. A local attacker could exploit this vulnerability to load...

Huawei HedEx Lite Cross-Site Request Forgery Vulnerability

Huawei HedEx Lite is a document management software from Huawei China. A cross-site request forgery vulnerability exists in versions prior to Huawei HedEx Lite V200R006C00. An attacker can exploit this vulnerability with malicious scripts to modify the configuration and interfere with legitimate...

CVE-2017-2306

On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can execute code on the device...

CVE-2017-2305

On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can create privileged users, allowing privilege escalation...

CVE-2015-5381

Cross-site scripting XSS vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the mbox parameter to the default URI...

MODX Revolution Cross-Site Scripting Vulnerability (CNVD-2017-07466)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A cross-site scripting vulnerability exists in versions of MODX Revolution prior to 2.5.7. A remote...

Juniper Networks NorthStar Controller Application Command Injection Vulnerability

Juniper Networks NorthStar Controller Application is a traffic planning controller from Juniper Networks, Inc. The controller optimizes service provider transport networks by establishing open industry standard protocols. A command injection vulnerability exists in Juniper Networks NorthStar...

Mozilla Firefox Cross-Site Scripting Vulnerability (CNVD-2017-07063)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A cross-site scripting vulnerability exists in versions of Mozilla Firefox prior to 53. An attacker can exploit this vulnerability to conduct cross-site scripting attacks...