LOYTEC LVIS-3ME Cross-Site Scripting Vulnerability

LVIS-3ME is a graphical user interface from LOYTEC. A cross-site scripting vulnerability exists in LOYTEC LVIS-3ME versions prior to 6.2.0, which can be exploited by an attacker to conduct a cross-site scripting attack due to a lack of proper web request authentication in the web interface, if an...

CVE-2017-8745

An elevation of privilege vulnerability exists in Microsoft SharePoint Foundation 2013 Service Pack 1 when it does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Cross Site Scripting Vulnerability"...

CVE-2017-8629

Microsoft SharePoint Server 2013 Service Pack 1 allows an elevation of privilege vulnerability when it fails to properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint XSS Vulnerability"...

CVE-2017-8629

Microsoft SharePoint Server 2013 Service Pack 1 allows an elevation of privilege vulnerability when it fails to properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint XSS Vulnerability"...

CVE-2017-8629

Microsoft SharePoint Server 2013 Service Pack 1 allows an elevation of privilege vulnerability when it fails to properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint XSS Vulnerability"...

Microsoft SharePoint Server 2013 Service Pack 1 Elevation of Privilege Vulnerability (KB4011113)

This host is missing an important security update according to Microsoft KB4011113 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Symantec Encryption Desktop Denial of Service Vulnerability

Symantec Encryption Desktop SED is a multi-layer storage encryption solution from Symantec USA. The solution encrypts stored data as well as entire hard disks or hard disk partitions. A security vulnerability exists in versions of SED prior to 10.4.1MP2. A remote attacker could exploit this...

TYPO3 API Information Disclosure Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. An information disclosure vulnerability exists in the TYPO3 API. A remote user can send a specially crafted HTTP request to the TYPO3 API to view potentially sensitive version...

Youngzsoft CCFile Denial of Service Vulnerability

Youngzsoft CCFile aka CC File Transfer is a file transfer program. The program is capable of transferring files via Internet and LAN. A security vulnerability exists in Youngzsoft CCFile version 3.6. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to...

CVE-2017-6785

A vulnerability in configuration modification permissions validation for Cisco Unified Communications Manager could allow an authenticated, remote attacker to perform a horizontal privilege escalation where one user can modify another user's configuration. The vulnerability is due to lack of prop...

UBUNTU-CVE-2017-2885

An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability...

CVE-2017-8654

Microsoft SharePoint Server 2010 Service Pack 2 allows a cross-site scripting XSS vulnerability when it does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability"...

Cross site scripting

Microsoft SharePoint Server 2010 Service Pack 2 allows a cross-site scripting XSS vulnerability when it does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability"...

CVE-2015-1847

Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally inaccessible files via a .. dot dot in a crafted URL...

CVE-2015-1847

CVE-2015-1847 concerns a directory traversal in the Appserver web request/response interface. The vulnerability affects Appserver versions before 1.0.3, allowing remote attackers to read normally inaccessible files by inserting a “..” in a crafted URL. Multiple sources (NVD, OpenVAS entry, CNVD/P...

ProcessMaker Enterprise Core Code Execution Vulnerability

Summary A code execution vulnerability exists in ProcessMarker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization potentially resulting in PHP code being executed. An attacker can send a crafted web parameter to trigger this vulnerability. Tested...

X (Formerly Twitter): XXE on sms-be-vip.twitter.com in SXMP Processor

Hi team, What type of issue are you reporting? Does it align to a CWE or OWASP issue? I've identified an XXE vulnerability in the cloudhopper sxmp servlet on sms-be-vip.twitter.com which discloses local files to an external attacker and allows web requests to be sent. This aligns to...

CVE-2017-8569

Microsoft SharePoint Server allows an elevation of privilege vulnerability due to the way that it sanitizes a specially crafted web request to an affected SharePoint server, aka "SharePoint Server XSS Vulnerability"...

CVE-2017-8569

Microsoft SharePoint Server allows an elevation of privilege vulnerability due to the way that it sanitizes a specially crafted web request to an affected SharePoint server, aka "SharePoint Server XSS Vulnerability"...

Privilege escalation

Microsoft SharePoint Server allows an elevation of privilege vulnerability due to the way that it sanitizes a specially crafted web request to an affected SharePoint server, aka "SharePoint Server XSS Vulnerability"...