CVE-2017-7433

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

Path traversal

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

Microsoft Windows SMB Server Information Disclosure Vulnerability (CNVD-2017-08204)

Microsoft Windows is the popular computer operating system. An information disclosure vulnerability exists in the processing of certain requests by the Microsoft Server Message Block 1.0 SMBv1 server. A remote attacker can exploit the vulnerability to obtain sensitive server information via a...

CVE-2017-8295

WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to...

Qemu 'hw/display/cirrus_vga.c' Remote Code Execution Vulnerability Vulnerability

QEMU is an open source emulator software. Qemu 'hw/display/cirrusvga.c' suffers from a remote code execution vulnerability vulnerability that allows an attacker to exploit the vulnerability by submitting a special request that can execute arbitrary code...

CVE-2017-7409

Palo Alto Networks PAN-OS before 7.0.15 has XSS in the GlobalProtect external interface via crafted request parameters, aka PAN-SA-2017-0011 and PAN-70674...

Cisco Unified Communications Manager UDP Handling Denial of Service Vulnerability

Cisco Unified Communications Manager is an enterprise-class IP telephony call processing system. Cisco Unified Communications Manager has a security vulnerability in the Session Initiation Protocol SIP UDP throttling process, which could be exploited by a remote attacker to submit a special reque...

Microsoft Office XSS Elevation of Privilege Vulnerability

Microsoft Office is a suite of office software based on the Windows operating system developed by Microsoft. An elevation of privilege vulnerability exists in a constructed request that is not properly filtered by the Office Web Apps server, which could allow an attacker to perform a cross-site...

python-pysaml2: Entity expansion issue

An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion...

Linux kernel crypto/ahash.c denial of service vulnerability

Linux kernel is an open source operating system. Linux kernel has a security vulnerability in the crypto/ahash.c file. An attacker can exploit the vulnerability to submit a special request to crash the system...

Local Elevation of Privilege Vulnerability in Multiple Cisco Products

Cisco Unified Computing System UCS Manager provides unified, embedded management of all software and hardware components in Cisco UCS. Cisco Firepower 4100 Series Next-Generation Firewall NGFW is the industry's first fully integrated, threat-oriented, next-generation firewall with unified...

Cisco IOS XE Software Local Command Execution Vulnerability

Cisco IOS is the interconnected Internet operating system used on most Cisco Systems routers and network switches. The Cisco IOS XE Software startup script does not validate the value of the ROMMON variable effectively, allowing remote attackers to exploit the vulnerability by submitting a specia...

Microsoft IIS WebDAV ScStoragePathFromUrl Buffer Overflow (CVE-2017-7269)

A buffer overflow exists in Microsoft Internet Information Services 6.0. The vulnerability is due to improper validation of a long header in HTTP request. A remote attacker could exploit this vulnerability by sending a crafted request over a network to the vulnerable application. Successful...

Cross site scripting

Reflected Cross-site scripting XSS vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen...

CVE-2017-7271

Reflected Cross-site scripting XSS vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen...

Cisco Nexus 9000 Series Switches NX-OS Software Denial of Service Vulnerability

Cisco Nexus 9000 Series Switches are 9000 series switches from Cisco, USA. A denial of service vulnerability exists in the remote login feature of the Cisco NX-OS Software in Cisco Nexus 9000 Series Switches. A remote attacker could exploit the vulnerability by sending a special request to...

Cisco IOS XE Software L2TP Message Denial of Service Vulnerability

Cisco IOS XE Software is an operating system developed by Cisco in the United States for its network devices. Cisco IOS XE Software's fails to adequately filter L2TP packets. A remote attacker could exploit this vulnerability to submit a special request for a denial of service attack...

The vulnerability of the McAfee VirusScan Enterprise anti-virus software allows a hacker to bypass access control rules.

The vulnerability of the McAfee VirusScan Enterprise antivirus software is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to bypass access control rules using a specially crafted HTTP request...

The vulnerability of the McAfee VirusScan Enterprise anti-virus software allows a hacker to bypass the sandbox mechanism or cause a service failure.

The vulnerability of the McAfee VirusScan Enterprise antivirus software is related to incorrect code generation management. Exploiting this vulnerability allows a malicious actor to bypass the sandbox mechanism or trigger a service failure through a specially crafted HTTP request...

CVE-2017-0055

Microsoft Internet Information Server IIS in Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to perform cross-site scripting and run...