3179 matches found
CVE-2015-2883
Philips In.Sight B120/37 is affected by a cross-site scripting (XSS) vulnerability, related to the Weaved cloud web service. The issue can be triggered via the name parameter in deviceSettings.php or shareDevice.php. The Common result is that arbitrary script/HTML could be injected, potentially a...
CVE-2015-2883
Philips In.Sight B120/37 has XSS, related to the Weaved cloud web service, as demonstrated by the name parameter to deviceSettings.php or shareDevice.php...
CVE-2015-2888
The CVE-2015-2888 entry concerns the Summer Baby Zoom Wifi Monitor & Internet Viewing System. Affected component/issue is authentication bypass related to the MySnapCam web service, enabling remote attackers to bypass authentication over the network. CVSS data in the document shows a high/severe ...
NETGEAR ProSAFE Plus Configuration Utility Incorrect Access Control Vulnerability
NetGear ProSafe is the smart switch product for monitoring and configuring your network. An incorrect access control vulnerability exists in the NETGEAR ProSAFE Plus Configuration Utility, which can be exploited by an attacker to perform switch configuration tasks based on SOAP requests...
CVE-2016-10273
Multiple stack buffer overflow vulnerabilities in Jensen of Scandinavia AS Air:Link 3G AL3G version 2.23m Rev. 3, Air:Link 5000AC AL5000AC version 1.13, and Air:Link 59300 AL59300 version 1.04 Rev. 4 devices allow remote attackers to execute arbitrary code or crash the web service via the 1...
Stack overflow
Multiple stack buffer overflow vulnerabilities in Jensen of Scandinavia AS Air:Link 3G AL3G version 2.23m Rev. 3, Air:Link 5000AC AL5000AC version 1.13, and Air:Link 59300 AL59300 version 1.04 Rev. 4 devices allow remote attackers to execute arbitrary code or crash the web service via the 1...
dnaLIMS Admin Module Command Execution
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'dnaLIMS Admin Module Command Execution', 'Description' = %q This module utilizes an administrative module which allows for...
Fedora 25 : php-pear-PHP-CodeSniffer (2017-ca3f01bd37)
Version 2.8.1 - This release contains a fix for a security advisory related to the improper handling of shell commands - Uses of shellexec and exec were not escaping filenames and configuration settings in most cases - A properly crafted filename or configuration option would allow for arbitrary...
Fedora 24 : php-pear-PHP-CodeSniffer (2017-aaf92c483c)
Version 2.8.1 - This release contains a fix for a security advisory related to the improper handling of shell commands - Uses of shellexec and exec were not escaping filenames and configuration settings in most cases - A properly crafted filename or configuration option would allow for arbitrary...
Ektron 8.5 / 8.7 / 9.0 XSLT Transform Remote Code Execution
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Ektron 8.5, 8.7, 9.0 XSLT Transform Remote Code Execution', 'Description' = %q Ektron 8.5, 8.7 'catatonicprime' , 'License' =...
CVE-2016-6044
IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which may let the attacker violate security policy...
CVE-2017-3241
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with...
CVE-2016-7038
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed...
CVE-2016-7038
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed...
Default credentials
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed...
CVE-2016-7038
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed...
UBUNTU-CVE-2016-7038
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed...
CVE-2016-7038
CVE-2016-7038 affects Moodle 2.x/3.x where web service tokens are not invalidated when a user password is changed or forced to be changed. The connected documents confirm the vulnerability appears in Moodle web service token handling; no explicit remediation details are provided in the sources. E...
CVE-2017-3241
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: RMI. Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with...
OSIsoft PI Coresight and PI Web API Information Disclosure Vulnerabilities
OSIsoft PI Coresight is a set of web-based tools for secure access to PI System data, and the PI Web API is a REST service that provides access to PI System data. A security vulnerability exists in OSIsoft PI Coresight and the PI Web API that could be exploited by an attacker to submit a special...