4750 matches found
UBUNTU-CVE-2017-7848
RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird 52.5.2...
Quest NetVault Backup SQL Injection Vulnerability (CNVD-2017-37633)
Quest NetVault Backup is a suite of data backup software from Quest Software, USA. A SQL injection vulnerability in the handling of NVBUBackup PluginList method requests in Quest NetVault Backup versions prior to 11.4.5 stems from the program's failure to properly detect user-submitted strings...
Synology MailPlus Server Disclaimer Cross-Site Scripting Vulnerability
Synology MailPlus Server is an email service suite from Synology. The product supports managing user accounts, email records, etc. Disclaimer is one of the disclaimer modules. A cross-site scripting vulnerability exists in Disclaimer in Synology MailPlus Server versions prior to 1.4.0-0415. A...
UrBackup Server Cross-Site Scripting Vulnerability
UrBackup is an easy to install open source client/server backup system . A cross-site scripting vulnerability exists in UrBackup Server before 2.1.20. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the action parameter...
CVE-2017-3104
Adobe RoboHelp has a cross-site scripting XSS vulnerability. This affects versions before RH12.0.4.460 and RH2017 before RH2017.0.2...
McAfee Network Security Manager Remote Authorization Bypass Vulnerability
McAfee Network Security Manager NSM is a network security solution from McAfee that enables real-time monitoring of deployed McAfee intrusion prevention systems across the network. A remote authorization bypass vulnerability exists in McAfee NSM versions prior to 8.2.7.71.1. A remote attacker cou...
CVE-2017-8137
HedEx Earlier than V200R006C00 versions has a dynamic link library DLL hijacking vulnerability due to calling the DDL file by accessing a relative path. An attacker could exploit this vulnerability to tamper with the DLL file, leading to DLL hijacking...
CVE-2017-2737
VCM5010 with software versions earlier before V100R002C50SPC100 has an arbitrary file upload vulnerability. The software does not validate the files that uploaded. An authenticated attacker could upload arbitrary files to the system...
private_address_check ruby gem server-side request forgery vulnerability
privateaddresscheck ruby gem is a Ruby-based checking tool for server-side request forgery attacks. A server-side request forgery vulnerability exists in versions of the privateaddresscheck ruby gem prior to 0.4.1. An attacker can exploit this vulnerability to bypass blacklists and perform...
jqueryFileTree directory traversal vulnerability
jqueryFileTree is a configurable AJAX file browser plugin with jQuery . A directory traversal vulnerability exists in jqueryFileTree 2.1.5 and earlier versions. No detailed vulnerability details are provided at this time...
Sanic Directory Traversal Vulnerability
Sanic is a Python based web server. A directory traversal vulnerability exists in versions of Sanic prior to 0.5.1. An attacker can exploit this vulnerability to read arbitrary files...
LibreNMS Arbitrary File Read Vulnerability
LibreNMS is an open source network monitoring system based on PHP and MySQL. The system features customizable alerts , auto-discovery of the network environment and automatic updates . A security vulnerability exists in the installation process in versions of LibreNMS prior to 2017-08-18. A remot...
Apache ActiveMQ 'CVE-2011-4905' Denial of Service Vulnerability - Linux
Apache ActiveMQ is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:activemq";...
CVE-2017-5105
Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name...
CVE-2017-5090
Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.115 for Mac allowed a remote attacker to perform domain spoofing via a crafted domain name containing a U+0620 character, aka Apple rdar problem 32458012...
PHPSUGAR PHP Melody SQL Injection Vulnerability (CNVD-2017-32539)
PHPSUGAR PHP Melody is a PHP-based content management system for video websites. A SQL injection vulnerability exists in PHPSUGAR PHP Melody versions prior to 2.7.3. A remote attacker can exploit this vulnerability by sending the 'image' parameter to the admin/editcategory.php file to inject SQL...
LetoDMS Cross-Site Request Forgery Vulnerability
LetoDMS is a document management system based on PHP+MySQL development. A cross-site request forgery vulnerability exists in LetoDMS versions prior to 3.3.8, which can be exploited by remote attackers to hijack a victim's authentication...
PYSEC-2017-43
Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 as used in Pallets Flask and other products allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message...
phpMyFAQ cross-site scripting vulnerability (CNVD-2017-33504)
phpMyFAQ is phpMyFAQ team developed a set of open source fully database-driven FAQ question and answer system . The system supports multiple languages, multiple databases, etc., and includes modules such as content management system and community. A cross-site scripting vulnerability exists in...
