280 matches found
Elastic X-Pack Machine Learning Cross-Site Scripting Vulnerability
Elastic X-Pack is an extension of the Elastic Stack log analytics system from Elasticsearch in the Netherlands.X-Pack Machine Learning is one of the machine learning components. A cross-site scripting vulnerability in Elastic X-Pack Machine Learning versions prior to 6.2.4 and prior to 5.6.9 can ...
Mikrotik RouterOS Stack Buffer Overflow Vulnerability
MikroTik RouterOS is a set of routing operating system developed based on Linux core by MikroTik Latvia. The system turns a PC computer into a professional router. A buffer overflow vulnerability in the stack exists in Mikrotik RouterOS versions prior to 6.42.7 and prior to 6.40.9. A remote...
TIBCO Data Virtualization Command Injection Vulnerability
TIBCO Data Virtualization formerly known as Cisco Information Server is the United States TIBCO Software, Inc. of a data virtualization suite Cisco Data Virtualization Suite is the basis of the Java-based information server. version version control adapters is one of the version control adapters....
Red Hat 389-ds-base Denial of Service Vulnerability (CNVD-2018-09316)
Red Hat 389-ds-base is an American Red Hat package that includes a Linux directory server and a server administration command-line program. A security vulnerability exists in Red Hat 389-ds-base versions prior to 1.4.0.9, prior to 1.3.8.1, and prior to 1.3.6.15. A remote attacker could cause a...
tomcat-native: Mishandling of client certificates can allow for OCSP check bypass
When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127 bytes. The result of the parsing error was to skip the OCSP check. It was therefore possible for client certificates th...
IBM API Connect Information Disclosure Vulnerability (CNVD-2018-03882)
IBM API Connect aka APIConnect is an integrated solution for managing the API lifecycle from IBM USA. The solution supports creating, running, managing and securing APIs, microservices and more. An information disclosure vulnerability exists in IBM API Connect versions 5.0.7.0 through 5.0.7.2 and...
bchunk denial of service vulnerability
bchunk is a format converter capable of converting CD images in bin/cue format to iso format files. A security vulnerability exists in bchunk version 1.2.0 and 1.2.1. An attacker can exploit this vulnerability to cause a denial of service crash with malformed CUE .cue files...
OpenJDK: incorrect privilege use when handling unreferenced objects (RMI, 8174966)
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...
Kohana Security Component Cross-Site Scripting Vulnerability
Kohana is the Kohana team developed a set of MVC model based on the construction of PHP5 framework. security component is one of the security components . A cross-site scripting vulnerability exists in the Security component of Kohana versions prior to 3.3.6. A remote attacker can inject arbitrar...
PHP Denial of Service Vulnerability (CNVD-2017-22591)
PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. A security vulnerability exists in the main/phpvariables.c file in PHP versions prior to 5.6.31, 7.x versions prior to 7.0.17, and 7.1.x version...
Open-Xchange OX Guard Security Bypass Vulnerability
Open-Xchange OX Guard is a suite of security protection software for e-mail and files from Open-Xchange USA. A security bypass vulnerability exists in versions 2.0 and 2.2.0 of Open-Xchange OX Guard, which can be exploited by attackers to bypass security restrictions and perform unauthorized...
CVE-2014-7234
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-7233. Reason: This issue was MERGED into CVE-2014-7233 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2014-7233...
UBUNTU-CVE-2015-2938
Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file...
PT-2015-1057 · Cisco · Cisco Asa
Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software versions 8.4 through 8.47.27 Cisco Adaptive Security Appliance ASA Software versions 8.6 through 8.61.16 Cisco Adaptive Security Appliance ASA Software versions 9.0 through 9.04.32 Cisco Adaptive...
UBUNTU-CVE-2014-2488
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 3.2.24, 4.0.26, 4.1.34, 4.2.26, and 4.3.12 allows local users to affect confidentiality via unknown vectors related to Core...
python-django: caching of anonymous pages could reveal CSRF token
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users...
jbossas JMX-Console cross-site-scripting in filter parameter
Cross-site scripting XSS vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key...
Oracle Database Server 11.1 - 'CREATE ANY Directory' Privilege Escalation
source: https://www.securityfocus.com/bid/31738/info Oracle Database Server is prone to a privilege-escalation issue related to the 'CREATE ANY DIRECTORY' user privilege. Attackers may exploit this issue to gain full SYSDBA privileges on the vulnerable database server. This issue affects Oracle...
PT-2007-3271
Name of the Vulnerable Software and Affected Versions DirectAdmin versions prior to 1.293 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via http or ftp requests logged in various log files, including /var/log/directadmin/security.log. It also enabl...