Directory traversal

Directory traversal vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote authenticated administrators to read arbitrary files via a crafted request...

CVE-2016-0325

IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert...

IBM Kenexa LMS on Cloud Directory Traversal Vulnerability

IBM Kenexa LMS on Cloud is a full-featured, configurable, enterprise-grade, social Learning Management System LMS that integrates social networking, collaboration, and knowledge sharing capabilities. The software provides interactive elements that support users in evaluating learning content and...

Microsoft Windows Local Security Privilege Subsystem Service Denial of Service Vulnerability

Microsoft Windows is a series of operating systems released by the American company Microsoft. A denial of service vulnerability exists in the Microsoft Windows Local Security Privilege Subsystem service. A remote attacker exploiting the vulnerability could cause a denial of service attack via a...

Local Security Authority Subsystem Service Denial of Service Vulnerability

A denial of service vulnerability exists in the Windows Local Security Authority Subsystem Service LSASS. A remote, but authenticated, attacker who successfully exploited this vulnerability could cause the target system to become nonresponsive. To exploit the vulnerability, a remote attacker woul...

Ruckus Wireless H500 Authentication Bypass Vulnerability

The Ruckus Wireless H500 is an indoor wall switch access point from Ruckus Wireless, USA. web management interface is one of the web-based management interfaces. An authentication bypass vulnerability exists in the Ruckus Wireless H500 web management interface. An attacker could exploit this...

bind: assertion failure in buffer.c while building responses to a specifically constructed request

A denial of service flaw was found in the way BIND constructed a response to a query that met certain criteria. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS request packet...

Hopper Dissassembler Remote Code Execution Vulnerability

Hopper is a set of decompilation tools for OS X and Linux. A security vulnerability exists in Hopper Dissassemble that allows remote attackers to execute arbitrary code by submitting a special request...

Squash YAML Code Execution (CVE-2013-5036)

A remote code execution vulnerability exists in Squash. The vulnerability is due to insufficient sanitization of user-supplied input while processing certain language expressions. An attacker could exploit this vulnerability by sending a crafted request to the affected software...

Cisco Firepower Management Center Elevation of Privilege Vulnerability

Cisco Firepower Management Center is a new generation of firewall management center software from the U.S. company Cisco Cisco. An elevation of privilege vulnerability exists in the web framework of Cisco Firepower Management Center. A remote attacker could exploit this vulnerability by sending a...

Cross site request forgery (csrf)

IBM Spectrum Control formerly Tivoli Storage Productivity Center 5.2.x before 5.2.11 allows remote authenticated users to upload non-executable files via a crafted HTTP request...

Accellion FTA getStatus verify_oauth_token Command Execution (CVE-2015-2857)

A command execution vulnerability exists in Accellion File Transfer appliance. The vulnerability is due to insufficient sanitization of the oauthtoken parameter. A remote attacker can exploit this vulnerability by sending crafted request to the affected appliance...

Denial of Service Vulnerability in Multiple Huawei Firewall Devices

The Huawei USG9580, 9560 and 9520 are all USG9500 series firewall appliances from Huawei, China. A security vulnerability exists in the Huawei USG9520, USG9560, and USG9580, which allows remote attackers to exploit the vulnerability by submitting a special request to access the device and reboot...

E-cidade Traversal Directory Vulnerability

A traversal directory vulnerability exists in E-cidade. The vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing simple URL encoding to bypass files and directories that are accessible to an unauthenticated user ... %252F...

Memory Corruption Vulnerability in Multiple Symantec Products (CNVD-2016-08079)

Symantec Advanced Threat Protection: Network is a suite of software for digging out and removing advanced threats that exist on endpoints, networks, and email gateways; Symantec Endpoint Protection SEP is a suite of antivirus software. A memory corruption vulnerability exists in a number of...

SAP Profile Maintenance Directory Traversal Vulnerability

SAP is a provider of enterprise management software and solutions. A directory traversal vulnerability exists in SAP Profile Maintenance. Because the program fails to repeat user-supplied input, a remote attacker could exploit a specially crafted request with a directory traversal sequence '... /...

CVE-2016-3368

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow remote authenticated users to execute arbitrary code by leveraging a domain account to make a crafted request, ak...

Remote code execution

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow remote authenticated users to execute arbitrary code by leveraging a domain account to make a crafted request, ak...

DEBIAN-CVE-2016-6317

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing...

CVE-2016-6317

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing...