Flatpak Local Elevation of Privilege Vulnerability

Flatpak is a system for building and installing Linux desktop applications. A local elevation of privilege vulnerability exists in versions of Flatpak prior to 0.8.7. A local attacker could exploit this vulnerability to run the setuid executable...

Trihedral VTScada Denial of Service Vulnerability

Trihedral VTScada formerly known as VTS is a SCADA system from Trihedral Engineering, Canada, based on a Windows platform with a Web interface option. A denial of service vulnerability exists in versions of Trihedral VTScada prior to 11.2.26, which arises from the program failing to validate inpu...

Sophos Web Appliance Cross-Site Scripting Vulnerability

Sophos Web Appliance SWA is a suite of Web security gateway products from Sophos UK. The product supports real-time web threat protection, customized web filtering and dynamic control of applications. A cross-site scripting vulnerability exists in the FTP redirection page in SWA versions prior to...

CVE-2017-9523

The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342...

Google Chrome credit card editor memory misreference vulnerability

Google Chrome is a web browser developed by Google.Android is a Linux-based open source operating system developed by Google and the Open Handheld Alliance OHA.credit card editor is a credit card editor. A memory misreference vulnerability exists in the credit card editor in versions of Google...

Config-Model Security Bypass Vulnerability

Config-Model aka libconfig-model-perl is an open source tool for validating, migrating or editing configuration files, which can support a variety of user interfaces such as graphical and interactive commands. A security bypass vulnerability exists in the genclasspod implementation of the...

Huawei HedEx Lite Cross-Site Request Forgery Vulnerability

Huawei HedEx Lite is a document management software from Huawei China. A cross-site request forgery vulnerability exists in versions prior to Huawei HedEx Lite V200R006C00. An attacker can exploit this vulnerability with malicious scripts to modify the configuration and interfere with legitimate...

Intel Solid State Drive Toolbox Local Elevation of Privilege Vulnerability

Intel Solid State Drive Toolbox is a driver management software from Intel USA for browsing SSD Solid State Drive information. A local elevation of privilege vulnerability exists in Intel Solid State Drive Toolbox versions prior to 3.4.5. A local attacker could exploit this vulnerability to load...

Juniper Networks Junos Space Information Disclosure Vulnerability

Juniper Networks Junos Space is a network management solution from Juniper Networks, Inc. The solution supports automated configuration, monitoring and troubleshooting of devices and services throughout their lifecycle. An information disclosure vulnerability exists in Juniper Networks Junos Spac...

CVE-2017-2305

On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can create privileged users, allowing privilege escalation...

CVE-2017-2306

On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can execute code on the device...

CVE-2015-5381

Cross-site scripting XSS vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the mbox parameter to the default URI...

MODX Revolution Cross-Site Scripting Vulnerability (CNVD-2017-07466)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A cross-site scripting vulnerability exists in versions of MODX Revolution prior to 2.5.7. A remote...

Juniper Networks NorthStar Controller Application Command Injection Vulnerability

Juniper Networks NorthStar Controller Application is a traffic planning controller from Juniper Networks, Inc. The controller optimizes service provider transport networks by establishing open industry standard protocols. A command injection vulnerability exists in Juniper Networks NorthStar...

Mozilla Firefox Cross-Site Scripting Vulnerability (CNVD-2017-07063)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A cross-site scripting vulnerability exists in versions of Mozilla Firefox prior to 53. An attacker can exploit this vulnerability to conduct cross-site scripting attacks...

jasper: stack-based buffer overflow in jpc_dec_tileinit()

Stack-based buffer overflow in the jpctsfbgetbands2 function in jpctsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image...

jasper: reachable assertions in RAS encoder/decoder

The rasgetcmap function in rasdec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service assertion failure via a crafted image file...

DEBIAN-CVE-2016-7054

In OpenSSL 1.1.0 before 1.1.0c, TLS connections using -CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash. This issue is not considered to be exploitable beyond a DoS...

UDFclient Buffer Overflow Vulnerability

UDFclient is a user-implemented solution for the UDF file system defined by the OSTA group. A buffer overflow vulnerability exists in the custom strlcpy implementation in versions of UDFclient prior to 0.8.8. An attacker could exploit this vulnerability to cause a denial of service or execute...

WordPress WHIZ plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their own websites on servers that support PHP and MySQL databases. WordPress can also be used as a content management system CMS. A cross-site request forgery vulnerability in the WHIZ plugin for...