FreeRDP Denial of Service Vulnerability (CNVD-2017-25707)

FreeRDP is a free, open source implementation of the Remote Desktop Protocol RDP developed by the FreeRDP team. A denial of service vulnerability exists in FreeRDP version 2.0.0-beta1+android11. A remote attacker can exploit this vulnerability to cause a denial of service with the help of special...

ALPINE-CVE-2017-14164

A size-validation issue was discovered in opjj2kwritesot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service heap-based buffer overflow affecting opjwritebytesLE in lib/openjp2/cio.c or possibly remote code execution...

RTPproxy Denial of Service Vulnerability

RTPproxy is a software proxy. A security vulnerability exists in the NAT feature of RTPproxy 2.2.alpha.20160822 and earlier versions, which stems from the program failing to properly identify the IP address and port number of a legitimate recipient of RTP traffic. An attacker can exploit this...

MIMEDefang Elevation of Privilege Vulnerability

MIMEDefang is a high performance email filtering system. A security vulnerability exists in MIMEDefang 2.80 and earlier versions, which stems from the program creating a PID file after removing account privileges. A local attacker can exploit the vulnerability to terminate arbitrary processes...

Akeo Consulting Rufus Arbitrary Code Execution Vulnerability

Akeo Consulting Rufus is an open source formatting tool for USB drives and other storage devices. An arbitrary code execution vulnerability exists in Akeo Consulting Rufus 2.16 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code within the context of the...

UBUNTU-CVE-2017-14130

The bfdelfparseattributes function in elf-attrs.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service bfdelfattrstrdup heap-based buffer over-read and application crash via a crafted ELF file...

unrar directory traversal vulnerability

unrar also known as unrar-free or unrar-gpl is a decompression software used in Linux. A directory traversal vulnerability exists in unrar version 0.0.1. An attacker can exploit this vulnerability to decompress RAR v2 archives into an upper level directory...

DEBIAN-CVE-2017-14120

unrar 0.0.1 aka unrar-free or unrar-gpl suffers from a directory traversal vulnerability for RAR v2 archives: pathnames of the form ../filename are unpacked into the upper directory...

UBUNTU-CVE-2017-13766

In Wireshark 2.4.0 and 2.2.0 to 2.2.8, the Profinet I/O dissector could crash with an out-of-bounds write. This was addressed in plugins/profinet/packet-dcerpc-pn-io.c by adding string validation...

Smartwebsites SmartCMS Cross-Site Scripting Vulnerability

Smartwebsites SmartCMS is a Content Management System CMS from Smartwebsites Cyprus. The system provides online content management, user management and document management. A cross-site scripting vulnerability exists in Smartwebsites SmartCMS version 2. A remote attacker can exploit this...

BSA-2017-363

Security Advisory ID : BSA-2017-363 Component : Apache Revision : 1.0: Interim A maliciously constructed HTTP/2 request could cause modhttp2 to dereference a NULL pointer and crash the server process. Affected Products Brocade is investigating its product lines to determine which products may be...

CloudBees Jenkins Git Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed tasks . Git Plugin is one of the plug-ins used to manage the...

SQL Injection Vulnerability in Xiaowei OA v2.0

Xiaowei OA system is Beijing Xiaowei Help Technology Co., Ltd. to provide mobile office platform for small and medium-sized enterprises. SQL injection vulnerability exists in Xiaowei OA v2.0, which can be exploited by attackers to obtain sensitive information from the database...

ToMAX R60G Cross-Site Request Forgery Vulnerability

The ToMAX R60G is an enterprise router device from China's Xinghongwang Technology ToMAX. A cross-site request forgery vulnerability exists in the ToMAX R60G V2-V2.0-v.2.6.3-170330 version. A remote attacker can exploit this vulnerability to perform unauthorized operations...

CVE-2017-12943

D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/showinfo.php?REQUIREFILE= absolute path traversal attack, as demonstrated by discovering the admin password...

CVE-2017-10207

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications subcomponent: Utilities. The supported version that is affected is 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality...

CVE-2017-10136

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications subcomponent: Import/Export. The supported version that is affected is 2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality...

CVE-2017-10145

Vulnerability in the Java Advanced Management Console component of Oracle Java SE subcomponent: Server. The supported version that is affected is Java Advanced Management Console: 2.6. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...

CVE-2017-9939

A vulnerability was discovered in Siemens SiPass integrated All versions before V2.70 that could allow an attacker with network access to the SiPass integrated server to bypass the authentication mechanism and perform administrative operations...

CVE-2017-9940

A vulnerability was discovered in Siemens SiPass integrated All versions before V2.70 that could allow an attacker with access to a low-privileged user account to read or write files on the file system of the SiPass integrated server over the network...