unrar directory traversal vulnerability

unrar also known as unrar-free or unrar-gpl is a decompression software used in Linux. A directory traversal vulnerability exists in unrar version 0.0.1. An attacker can exploit this vulnerability to decompress RAR v2 archives into an upper level directory...

DEBIAN-CVE-2017-14120

unrar 0.0.1 aka unrar-free or unrar-gpl suffers from a directory traversal vulnerability for RAR v2 archives: pathnames of the form ../filename are unpacked into the upper directory...

UBUNTU-CVE-2017-13766

In Wireshark 2.4.0 and 2.2.0 to 2.2.8, the Profinet I/O dissector could crash with an out-of-bounds write. This was addressed in plugins/profinet/packet-dcerpc-pn-io.c by adding string validation...

Smartwebsites SmartCMS Cross-Site Scripting Vulnerability

Smartwebsites SmartCMS is a Content Management System CMS from Smartwebsites Cyprus. The system provides online content management, user management and document management. A cross-site scripting vulnerability exists in Smartwebsites SmartCMS version 2. A remote attacker can exploit this...

BSA-2017-363

Security Advisory ID : BSA-2017-363 Component : Apache Revision : 1.0: Interim A maliciously constructed HTTP/2 request could cause modhttp2 to dereference a NULL pointer and crash the server process. Affected Products Brocade is investigating its product lines to determine which products may be...

CloudBees Jenkins Git Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed tasks . Git Plugin is one of the plug-ins used to manage the...

SQL Injection Vulnerability in Xiaowei OA v2.0

Xiaowei OA system is Beijing Xiaowei Help Technology Co., Ltd. to provide mobile office platform for small and medium-sized enterprises. SQL injection vulnerability exists in Xiaowei OA v2.0, which can be exploited by attackers to obtain sensitive information from the database...

ToMAX R60G Cross-Site Request Forgery Vulnerability

The ToMAX R60G is an enterprise router device from China's Xinghongwang Technology ToMAX. A cross-site request forgery vulnerability exists in the ToMAX R60G V2-V2.0-v.2.6.3-170330 version. A remote attacker can exploit this vulnerability to perform unauthorized operations...

CVE-2017-12943

D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/showinfo.php?REQUIREFILE= absolute path traversal attack, as demonstrated by discovering the admin password...

CVE-2017-10207

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications subcomponent: Utilities. The supported version that is affected is 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality...

CVE-2017-10136

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications subcomponent: Import/Export. The supported version that is affected is 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality...

CVE-2017-10145

Vulnerability in the Java Advanced Management Console component of Oracle Java SE subcomponent: Server. The supported version that is affected is Java Advanced Management Console: 2.6. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

CVE-2017-9939

A vulnerability was discovered in Siemens SiPass integrated All versions before V2.70 that could allow an attacker with network access to the SiPass integrated server to bypass the authentication mechanism and perform administrative operations...

CVE-2017-9940

A vulnerability was discovered in Siemens SiPass integrated All versions before V2.70 that could allow an attacker with access to a low-privileged user account to read or write files on the file system of the SiPass integrated server over the network...

ShopsN v2.0 frontend CartController.class.php file order_form function has SQL injection vulnerability

ShopsN free version of the B2C e-commerce is a product of Shanghai Yisu Network Technology Co. An open source online store in line with enterprise-class commercial standards of the whole network system. In ShopsN v2.0 beta2 version of the front-end CartController.class.php in the orderform functi...

Oracle Hospitality Simphony Remote Vulnerability

Oracle Hospitality Applications is a suite of business applications, servers and storage solutions for hospitality management from Oracle Corporation. Oracle Hospitality Simphony is one of the cloud-based mobile food and beverage sales components of the solution, which provides human resource cos...

Oracle Hospitality Simphony Remote Vulnerability (CNVD-2017-26286)

Oracle Hospitality Applications is a suite of business applications, servers and storage solutions for hospitality management from Oracle Corporation. Oracle Hospitality Simphony is one of the cloud-based mobile food and beverage sales components of the solution, which provides human resource cos...

OpenExif 'ExifJpegHUFFTable::deriveTable' function denial of service vulnerability

OpenExif is an object-oriented library for accessing image files in Exif format. A security vulnerability exists in the 'ExifJpegHUFFTable::deriveTable' function of the ExifHuffmanTable.cpp file in OpenExif version 2.1.4. A remote attacker can exploit this vulnerability to cause a denial of servi...

Twibright Links 'put_chars' Function Denial of Service Vulnerability

Twibright Links is a text-only web browser developed by the Twibright Labs organization that renders graphics as well as font-size variations with antialiasing and supports JavaScript. A security vulnerability exists in the 'putchars' function of the htmlr.c file in version 2.14 of Twibright Link...

TiMidity++ 'insert_note_steps' Function Denial of Service Vulnerability

TiMidity++ is an open source audio file converter and player that can convert MIDI files to other formats. A security vulnerability exists in the 'insertnotesteps' function of the readmidi.c file in TiMidity++ version 2.14.0. A remote attacker can exploit this vulnerability to cause a denial of...