ncurses 'fmt_entry' function stack buffer overflow vulnerability

ncurses is a character terminal processing library , it can provide a series of functions for the user to call and generate text-based user interface . A stack buffer overflow vulnerability exists in the 'fmtentry' function in ncurses version 6.0. A remote attacker can exploit this vulnerability ...

SQL Injection Vulnerability in 'sex' parameter of ESPCMS Enterprise Website Management System

ESPCMS enterprise website management system is based on LAMP development and construction of enterprise website management system. A SQL injection vulnerability exists in the official version of ESPCMS V6.7.17.04.05 UTF8. The lack of filtering of the 'sex' parameter allows attackers to exploit th...

wildfly: Arbitrary file read via path traversal

It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal...

DEBIAN-CVE-2017-9353

In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed in epan/dissectors/packet-ipv6.c by validating an IPv6 address...

HPE Aruba ClearPass Policy Manager Security Bypass Vulnerability

HPE Aruba ClearPass Policy Manager is a network access control solution from Hewlett Packard Enterprise HPE. A security bypass vulnerability exists in versions of HPE Aruba ClearPass Policy Manager prior to 6.6.5. An attacker could exploit this vulnerability to bypass security restrictions...

CVE-2017-2301

On Juniper Networks products or platforms running Junos OS 11.4 prior to 11.4R13-S3, 12.1X46 prior to 12.1X46-D60, 12.3 prior to 12.3R12-S2 or 12.3R13, 12.3X48 prior to 12.3X48-D40, 13.2X51 prior to 13.2X51-D40, 13.3 prior to 13.3R10, 14.1 prior to 14.1R8, 14.1X53 prior to 14.1X53-D12 or...

QPDF 'libqpdf/QPDFObjectHandle.cc' Denial of Service Vulnerability

QPDF is a command line program capable of structuring PDFs. The program can encrypt PDF files, analyze or change the internal structure of PDF files. A denial of service vulnerability exists in the libqpdf.a file in QPDF version 6.0.0. A remote attacker can exploit this vulnerability to cause a...

CVE-2016-4900

Untrusted search path vulnerability in Evernote for Windows versions prior to 6.3 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory...

UBUNTU-CVE-2017-9074

The IPv6 fragmentation implementation in the Linux kernel through 4.11.1 does not consider that the nexthdr field may be associated with an invalid option, which allows local users to cause a denial of service out-of-bounds read and BUG or possibly have unspecified other impact via crafted socket...

The vulnerability of the ANI service in the Cisco IOS operating system allows a hacker to trigger a service failure and a device restart.

The vulnerability of the Cisco IOS operating system’s ANI service is related to incomplete validation of input data. Exploiting this vulnerability can allow a malicious actor to trigger a device reboot and a service failure using a specially crafted IPv6 packet...

WordPress MaxButtons plugin cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.MaxButtons and MaxButtons Pro are different versions of the Button Builder plugin. A cross-site scripting...

Stored Cross-Site Scripting Vulnerability in HDWiki

Interactive Wiki open source system HDwiki is Interactive Online Beijing Technology Co., Ltd. of an independent intellectual property rights of the Chinese Wiki Wiki system. HDWiki 6.0 version of the existence of stored cross-site scripting vulnerabilities , the system uses a blacklist mechanism ...

IBM UrbanCode DeployXML External Entity Injection Vulnerability

IBM UrbanCode Deploy UCD is a set of application automation deployment tools from IBM in the United States. The tool is based on an application deployment automation management information model, and through remote agent technology, to realize the automation of complex applications in different...

CVE-2017-1149

IBM UrbanCode Deploy UCD 6.0, 6.1, and 6.2 is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM...

Storage-based Cross-site Scripting Vulnerability in Cicada Knowledge Enterprise Portal System Version 6.1

Cicada Knowledge Enterprise Portal System is a web content management system. A stored cross-site scripting vulnerability exists in Cicada Knowledge Enterprise Portal System version 6.1 Commodity Purchase, Delivery Address. The vulnerability allows attackers to steal administrator COOKIE...

IBM Curam Social Program Management Information Disclosure Vulnerability

IBM Curam Social Program Management SPM is a suite of social program management solutions from IBM USA. The solution supports the process of end-to-end social program delivery. A security vulnerability exists in IBM Curam SPM versions 5.2, 6.0 and 7.0. An attacker could exploit the vulnerability ...

CVE-2017-3609

Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks...

CVE-2017-3611

Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks...

UBUNTU-CVE-2017-3469

Vulnerability in the MySQL Workbench component of Oracle MySQL subcomponent: Workbench: Security : Encryption. Supported versions that are affected are 6.3.8 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise...

Cisco ASR 903/ASR 920 Series Denial of Service Vulnerability

The Cisco ASR 903 and ASR 920 are router products. A security vulnerability exists in the Cisco ASR 903ASR 920 series devices using RSP2 cards due to ineffective handling of IPv6 packets. An unauthenticated, physically proximate attacker caused a denial of service on the affected system...