CVE-2017-8654

Microsoft SharePoint Server 2010 Service Pack 2 allows a cross-site scripting XSS vulnerability when it does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability"...

KLA11089 XSS vulnerability in Microsoft Sharepoint Server

An XSS cross-site scripting vulnerability related to an improper sanitizing of web requests was found in Microsoft SharePoint Server. By exploiting this vulnerability malicious users can spoof user interaface. This vulnerability can be exploited remotely via a specially designed web request...

ProcessMaker Enterprise Core Multiple SQL Injection Vulnerabilities

Summary Multiple exploitable SQL Injection vulnerabilities exists in ProcessMarker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability,...

kitto directory traversal vulnerability

kitto is an interactive dashboard framework written using Elixir. A directory traversal vulnerability exists in kitto, which allows remote attackers to submit a specially crafted request to view the contents of system files with WEB privileges...

McAfee Advanced Threat Defense Security Bypass Vulnerability (CNVD-2017-23473)

McAfee Advanced Threat Defense ATD is a suite of threat detection and defense solutions from the U.S.-based company McAfee McAfee. The solution provides malware analysis, shared threat intelligence, and isolation of compromised systems. There is an authentication bypass vulnerability in the Web...

Microsoft .NET Denial of Service Vulnerability

Microsoft .NET Framework is a software framework developed by Microsoft. NET Framework Microsoft Common Object Runtime Library does not properly handle web requests, allowing attackers to exploit the vulnerability by submitting a special request and crashing the application...

CVE-2017-8559

Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access OWA handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability...

CVE-2017-8560

Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access OWA handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability...

.NET Denial of Service Vulnerability

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this...

Microsoft SharePoint Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

Microsoft Exchange Server Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access OWA fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive...

KLA11068 Denial of Service Vulnerability in Microsoft .NET Framework

An improper handling of web requests has been found in Microsoft Common Object Runtime Library. By exploiting this vulnerability malicious users can cause a denial of service. This vulnerability can be exploited by issuing specially designed requests to the .NET web application. Original advisori...

KLA11069 Multiple vulnerabilities in Microsoft Office

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges and spoof user interface. Below is a complete list of vulnerabilities: 1. Multiple vulnerabilities related to improper handling of...

CVE-2017-2847

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configuration resulting in command injection. An attacker can simply send an HTTP...

CVE-2017-1193

IBM Sterling B2B Integrator Standard Edition 5.2 could allow user to obtain sensitive information using an HTTP GET request. IBM X-Force ID: 123667...

Microsoft SharePoint Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

Cross-Site Request Forgery Vulnerability in Multiple IBM Products (CNVD-2017-10743)

IBM Global Retention Policy and Schedule Management is a single retention management system. An unspecified cross-site request forgery vulnerability exists in multiple IBM products, which stems from a program's failure to properly validate HTTP requests. A remote attacker could exploit the...

Microsoft ASP.NET Core Spoofing Vulnerability

Microsoft ASP.NET Core is a cross-platform open source framework from Microsoft. The framework is used to build cloud-based applications such as Web One applications, IoT applications, and mobile backends. A spoofing vulnerability exists in Microsoft ASP.NET Core, which stems from the program...

CVE-2017-6636

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software prior to Release 11.1 could allow an authenticated, remote attacker to view any file on an affected system. The vulnerability exists because the affected software does not perform proper input validation of HT...

CVE-2017-6635

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software prior to Release 12.1 could allow an authenticated, remote attacker to delete any file from an affected system. The vulnerability exists because the affected software does not perform proper input validation o...