CVE-2017-9513: Improper Access Control

Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & receive notifications when comments are added to the watched page, and vote & watch JIRA issues that they do not have access to, although th...

CVE-2017-15703: Deserialization of Untrusted Data

Any authenticated user valid client certificate but without ACL permissions could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users...

CVE-2018-4836: Improper Authentication

A vulnerability has been identified in TeleControl Server Basic V3.1. An authenticated attacker with a low-privileged account to the TeleControl Server Basic's port 8000/tcp could escalate his privileges and perform administrative operations...

CVE-2014-6027: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in TorrentFlux 2.4 allow 1 remote attackers to inject arbitrary web script or HTML by leveraging failure to encode file contents when downloading a torrent file or 2 remote authenticated users to inject arbitrary web script or HTML via vectors...

PT-2017-14662

Name of the Vulnerable Software and Affected Versions IBM QRadar versions 7.2 through 7.3 Description The issue allows a remote authenticated attacker to execute arbitrary commands on the system by sending a specially-crafted request. This enables the attacker to exploit the system and execute...

Security Advisory - Memory Leak Vulnerability in Some Huawei FireWall Products

Some Huawei FireWall products have a memory leak vulnerability due to memory don't be released when an local authenticated attacker execute special commands many times. An attacker could exploit it to cause memory leak, which may further lead to system exceptions.Vulnerability ID:...

CVE-2017-1487

IBM Sterling File Gateway 2.2 could allow an authenticated attacker to obtain sensitive information such as login ids on the system. IBM X-Force ID: 128626...

PT-2017-13737

Name of the Vulnerable Software and Affected Versions IBM Sterling File Gateway version 2.2 Description The issue allows an authenticated attacker to obtain sensitive information, including login ids, on the system. Recommendations For IBM Sterling File Gateway version 2.2, at the moment, there i...

CVE-2017-12331

A vulnerability in Cisco NX-OS System Software could allow an authenticated, local attacker to bypass signature verification when loading a software patch. The vulnerability is due to insufficient NX-OS signature verification for software patches. An authenticated, local attacker could exploit th...

Information disclosure

A vulnerability in Cisco WebEx Event Center could allow an authenticated, remote attacker to view unlisted meeting information. The vulnerability is due to a design flaw in the product. An attacker could execute a query on an Event Center site to view scheduled meetings. A successful query would...

CVE-2017-2736: Improper Neutralization of Special Elements used in a Command

VCM5010 with software versions earlier before V100R002C50SPC100 has a command injection vulnerability. This is due to insufficient validation of user's input. An authenticated attacker could launch a command injection attack...

CVE-2017-1000240

The application OpenEMR is affected by multiple reflected & stored Cross-Site Scripting XSS vulnerabilities affecting version 5.0.0 and prior versions. These vulnerabilities could allow remote authenticated attackers to inject arbitrary web script or HTML...

CVE-2017-1000240: Improper Neutralization of Input During Web Page Generation

The application OpenEMR is affected by multiple reflected & stored Cross-Site Scripting XSS vulnerabilities affecting version 5.0.0 and prior versions. These vulnerabilities could allow remote authenticated attackers to inject arbitrary web script or HTML...

UBUNTU-CVE-2017-16651

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid...

CVE-2017-15888: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allows remote authenticated attackers to inject arbitrary web script or HTML via the NAME parameter...

Directory traversal

In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/api/RecordingList/DownloadRecord?file=" and "/api/SupportInfo?file=" are the vulnerable parameters. An attacker must be authenticated to exploit this issue to...

CVE-2017-14005: Unverified Password Change

An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When setting a new password for a user, the application does not require the user to know the original password. An attacker who is authenticated could change a user's password, enabling futur...

CVE-2017-5531: Undefined Security Weakness

Deployments of TIBCO Managed File Transfer Command Center versions 8.0.0 and 8.0.1 and TIBCO Managed File Transfer Internet Server versions 8.0.0 and 8.0.1 that enable the Administrator Service may be affected by a vulnerability which may allow any authenticated user to gain administrative contro...

CVE-2017-15012: Improper Input Validation

OpenText Documentum Content Server formerly EMC Documentum Content Server through 7.3 does not properly validate the input of the PUTFILE RPC-command, which allows any authenticated user to hijack an arbitrary file from the Content Server filesystem; because some files on the Content Server...

CVE-2017-15204: Authorization Bypass Through User-Controlled Key

In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user...