CVE-2015-0783

The FileViewer class in Novell ZENworks Configuration Management ZCM allows remote authenticated users to read arbitrary files via the filename variable...

PT-2019-5314

Name of the Vulnerable Software and Affected Versions Log4j versions 1.2 up to 1.2.17 Description The issue is related to the deserialization of untrusted data in the SocketServer class of Log4j 1.2, which can be exploited to remotely execute arbitrary code when combined with a deserialization...

Artificial Inteligent Packet Inspection Engine: AIEngine

AIEngine is a next generation interactive/programmable Python/Ruby/Java packet inspection engine with capabilities of learning without any human intervention, NIDS Network Intrusion Detection System functionality, DNS domain classification, network collector, network forensics and many others...

WSTMall open source mall system LogLoginsAction.class.php exists SQL injection vulnerability

WSTMall is a multi-commercial O2O open source system developed by Merchant Software based on thinkphp, a system that can help businesses and individuals to quickly build a community service system. WSTMall open source mall system LogLoginsAction.class.php has a SQL injection vulnerability due to...

SQL injection vulnerability in class parameter of Interactive Creation website building system

Interactive Creative Xiamen Digital Technology Co., Ltd. is a brand website construction company in Fujian Province, "Interactive Creative" is one of its independent brands. A SQL injection vulnerability exists in the class parameter of Interactive Creative's website building system. An attacker...

CVE-2017-11324

An issue was discovered in Tilde CMS 1.0.1. Due to missing escaping of the backtick character, a SELECT query in class.SystemAction.php is vulnerable to SQL Injection. The vulnerability can be triggered via a POST request to /actionphp/action.input.php with the id parameter...

CVE-2017-11422

Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include reset password, create new account, create new role, etc...

CVE-2017-11422

CVE-2017-11422 affects Statamic framework prior to 2.6.0, where session permission checks are insufficient when methods from a user’s class are invoked (e.g., reset password, create account, create role). This can allow actions beyond intended privileges. The issue is fixed in 2.6.0; upgrade to t...

GLPI '$crit' Variable SQL Injection Vulnerability

GLPI is an open source IT resource management suite maintained by the Indepnet Association. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A SQL injection vulnerability exists in the '$crit' variable in the...

graphite2: heap-buffer-overflow write "lz4::decompress" (src/Decompressor)

A heap-based buffer overflow flaw related to "lz4::decompress" src/Decompressor has been reported in graphite2. An attacker could exploit this issue to cause a crash or, possibly, execute arbitrary code...

UBUNTU-CVE-2017-11474

GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computersoftwareversion.class.php, exploitable via ajax/common.tabs.php...

Uninitialized Memory Disclosure

openwhisk is vulnerable to uninitialized memory disclosure. The library initializes a buffer by providing a numeric value to the Buffer class, resulting in a buffer being created with non zero-ed out memory. This can lead to information on the uninitialized memory being disclosed...

CVE-2017-3100

Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful exploitation could lead to memory address disclosure...

CVE-2016-6793

The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service infinite loop and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a...

CVE-2017-3100

Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful exploitation could lead to memory address disclosure...

Memory corruption

Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful exploitation could lead to memory address disclosure...

UBUNTU-CVE-2017-3100

Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful exploitation could lead to memory address disclosure...

Fedora 26 : wordpress (2017-fe7c3c9c30)

WordPress 4.7.5 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.7.4 and earlier are affected by six security issues : - Insufficient redirect validation in the HTTP class. Reported by Ronni...

CVE-2016-6793

The CVE-2016-6793 entry affects Apache Wicket DiskFileItem in Wicket 6.x (before 6.25.0) and 1.5.x (before 1.5.17). The vulnerability allows remote attackers to cause a denial of service (infinite loop) and to write, move, and delete files with the permissions of DiskFileItem. If run on a Java VM...

CVE-2017-3100

Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful exploitation could lead to memory address disclosure...