Mercurial Remote Code Execution Vulnerability

Mercurial is a software developer Matt Mackall developed a set of cross-platform distributed version control software written in the Python language . The software supports the simultaneous processing of plain text and binary files and so on. A remote code execution vulnerability exists in...

Google Android Qualcomm TrustZone Information Disclosure Vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA, of which Qualcomm TrustZone is a system-wide security technology. An information disclosure vulnerability exists in Qualcomm TrustZone in versions of Android prior to 7.1.1. The...

Google Chrome Security Bypass Vulnerability (CNVD-2017-09205)

Google Chrome is a web browser developed by the American company Google Google. A security bypass vulnerability exists in versions of Google Chrome prior to 59.0.3071.86. An attacker can exploit the vulnerability to bypass extension validation...

Jamroom Cross-Site Scripting Vulnerability

Jamroom is a social media content management system. The system helps build social networks, content communities, blogs and more. A cross-site scripting vulnerability exists in versions of Jamroom prior to 4.2.7. A remote attacker can exploit this vulnerability to inject arbitrary web script or...

Hitachi Device Manager and Replication Manager Cross-Site Scripting Vulnerability

Hitachi Device Manager and Replication Manager are both products of Hitachi, Japan.Hitachi Device Manager is software that manages multiple Hitachi storage systems from a single console and provides logical view capabilities to align storage assets with business applications. Replication Manager ...

Smb4K Local Elevation of Privilege Vulnerability

Smb4K is a set of tools that use Samba software to access SMB/CIFS shares in the local network neighborhood. A security vulnerability exists in versions of Smb4K prior to 2.0.1. A local attacker could exploit this vulnerability to gain root privileges...

VideoLAN VLC Denial of Service Vulnerability (CNVD-2017-08120)

VideoLAN VLC is a free and open source cross-platform multimedia player also a multimedia framework developed by the French organization VideoLAN. It supports playback of multiple media files, CD-ROMs, etc., multiple audio and video formats WMV, MP3, etc., etc. ParseJSS is one of the subtitle fil...

Apple Safari 'Safari' Component Address Forgery Vulnerability

Apple Safari is a web browser developed by Apple Inc. and is the default browser that comes with the Mac OS X and iOS operating systems.Safari is one of the specialized components used for the Safari browser.... An address forgery vulnerability exists in the 'Safari' component of Apple Safari...

Cisco Prime Collaboration Provisioning Software Directory Traversal Vulnerability

Cisco Prime Collaboration Provisioning Software is a set of Web-based, next-generation communications services software from Cisco. The software provides IP communication service features for IP telephony, voice mail and unified communications environments. A directory traversal vulnerability...

Apache CXF Fediz Cross-Site Request Forgery Vulnerability

Apache CXF is the United States Apache Apache Software Foundation of an open source Web services framework. The framework supports a variety of Web services standards , a variety of front-end programming APIs , etc. Apache CXF Fediz is one of the subprojects , mainly used to provide authenticatio...

Deluge WebUI Path Traversal Vulnerability

Deluge is a BitTorrent client.WebUI is one of the components that launches the web interface. A path traversal vulnerability exists in the WebUI component in versions of Deluge prior to 1.3.15. An attacker can exploit this vulnerability to view files...

Hipchat Server Arbitrary Code Execution Vulnerability

Hipchat Server is a set of team chat tools that supports group and 1-to-1 voice and video chat with screen sharing. A security vulnerability exists in Hipchat Server versions prior to 2.2.3. A remote attack could exploit the vulnerability to execute arbitrary code via an imported file...

jasper: JP2 encoder NULL pointer dereference due to uninitialized cmprof_

JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash...

Craft CMS Cross-Site Scripting Vulnerability

Craft CMS is a content management system CMS for developers and content managers. A cross-site scripting vulnerability exists in Craft CMS versions prior to 2.6.2976. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

GMV Checker ATM Security Arbitrary Code Execution Vulnerability

GMV Checker ATM Security is a dedicated ATM security product providing hard disk encryption. A security vulnerability exists in versions prior to GMV Checker ATM Security 5.0.18. A remote attacker can exploit the vulnerability to execute arbitrary code...

CVE-2017-5036

A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to have an unspecified impact via a crafted PDF file...

CVE-2017-5042

Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary URLs and observe any plaintext cookies sent...

AZL-34924 CVE-2017-3615 affecting package libdb for versions less than 5.3.28-7

Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks...

CVE-2017-3607

Vulnerability in the Data Store component of Oracle Berkeley DB. The supported version that is affected is Prior to 6.2.32. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks...

CVE-2017-3513

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM...