Linux kernel information disclosure vulnerability (CNVD-2017-37613)

Linux kernel is a popular operating system. Linux kernel suffers from an information disclosure vulnerability that allows local attackers to exploit the vulnerability by submitting a special request to obtain sensitive information...

Cisco IOS XR Software Denial of Service Vulnerability (CNVD-2017-36400)

Cisco IOS XR Software is the United States Cisco Cisco company's IOS software series including IOS T, IOS S and IOS XR in a fully modular, distributed network operating system. A denial of service vulnerability exists in the Local Packet Transport Services LPTS ingress frame handling feature in...

The vulnerability of the implementation of the direct authentication service for microprogramming software in Cisco Adaptive Security Appliance (ASA) allows a attacker to cause a service failure.

The vulnerability of the direct authentication service for microprogramming software in Cisco Adaptive Security Appliance ASA devices is related to insufficient checking of HTTP request headers. Exploiting this vulnerability can allow a malicious actor to trigger a system reboot and a service...

Infinispan 'hotrod java' client-side remote code execution vulnerability

Infinispan is a distributed in-memory data grid. A remote code execution vulnerability exists in the Infinispan 'hotrod java' client, which allows remote attackers to exploit the vulnerability by submitting a special request to execute arbitrary code in the context of the application...

CVE-2017-8194

The FusionSphere OpenStack V100R006C00SPC102NFV has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message...

HP Matrix Operating Environment Point Hijacking Vulnerability

HP Matrix Operating Environment is a suite of cloud management software designed for infrastructure services from Hewlett-Packard HP. A point hijacking vulnerability exists in HP Matrix Operating Environment version 7.6 LR1, which can be exploited by an attacker to conduct a clickjacking attack v...

CVE-2017-12300

A vulnerability in the SNORT detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a file policy that is configured to block the Server Message Block Version 2 SMB2 protocol. The vulnerability is due to the incorrect detection of an SMB2 fil...

FLIR Thermal Camera Remote Code Execution

A remote code execution vulnerability exists in FLIR Thermal cameras. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request...

MVPower DVR Remote Code Execution

A remote code execution vulnerability exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request...

Microsoft Windows SMB Server SMBv1 Information Disclosure (CVE-2017-11815)

An information disclosure vulnerability exists in the SMB Server component of Microsoft Windows. The vulnerability is due to improper handling of SMBv1 requests. A remote, authenticated attacker could exploit the vulnerability by sending a crafted request to a target SMB server...

Cisco Prime Collaboration Provisioning logconfigtracer.jsp Arbitrary File Deletion (CVE-2017-6637)

An arbitrary file deletion vulnerability exists in Cisco Prime Collaboration Provisioning. The vulnerability is due to insufficient validation on user supplied paths before using them in file operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted reques...

Sql injection

Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary SQL commands via a crafted xmlrpc API request to 1 unsubscribeforum.php or 2 unsubscribetopic.php in mobiquo/functions/...

The vulnerability of the REST API interface of the Cisco IOS XE operating system allows a perpetrator to bypass authentication procedures and gain access to the web interface.

The vulnerability of the REST API interface of the Cisco IOS XE operating system exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass authentication procedures and gain access to the web interface by sending a specially crafted API...

GHSA-Q34C-48GC-M9G8 actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...

GHSA-HGPP-PP89-4FGF Action Pack contains database-query restrictions bypass

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to...

actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...

Action Pack contains database-query restrictions bypass

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to...

GHSA-GH2W-J7CX-2664 Active Record contains SQL Injection

SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in...

Dragonfly Code Injection vulnerability

The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request...

Active Record contains SQL Injection

SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in...