HPE Intelligent Management Center UrlAccessController Authentication Bypass (CVE-2017-5791)

An authentication bypass vulnerability has been reported in HPE Intelligent Management Center. The vulnerability is due to errors in handling specific strings contained in the request URI. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted request to the target...

Vulnerability of the Samba network file system, allowing for the execution of arbitrary code

The vulnerability of the Samba network file system exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code located in a library hosted on a shared network resource through a specially crafted network request to the Samb...

Cross-Site Request Forgery Vulnerability in Multiple Pivotal Products

Pivotal Cloud Foundry PCF Runtime cf-release and others are products of Pivotal Software, Inc. PCF is an open source Platform-as-a-Service PaaS cloud computing platform that provides container scheduling, continuous delivery, and automated service deployment. cf-release is a release version of PC...

GNU Binutils libbfd Denial of Service Vulnerability

GNU Binutils is a set of programming language utility programs developed by the GNU Project. The GNU Binutils libbfd inventory suffers from a denial-of-service vulnerability, which allows remote attackers to exploit the vulnerability by submitting a specially crafted request that crashes the...

GNU Binutils libbfd Library Denial of Service Vulnerability

GNU Binutils is a set of programming language utility programs developed by the GNU Project. The GNU Binutils libbfd inventory suffers from a denial-of-service vulnerability, which allows remote attackers to exploit the vulnerability by submitting a specially crafted request that crashes the...

GNU Binutils libbfd Library Denial of Service Vulnerability (CNVD-2017-10176)

GNU Binutils is a set of programming language utility programs developed by the GNU Project. The GNU Binutils libbfd inventory suffers from a denial-of-service vulnerability, which allows remote attackers to exploit the vulnerability by submitting a specially crafted request that crashes the...

Sierra Wireless GX440 Command Injection Vulnerability (CNVD-2017-10181)

The Sierra Wireless GX440 is a gateway device from Sierra Wireless Canada. The Sierra Wireless GX440 suffers from a command injection vulnerability that can be exploited by a remote attacker to submit a special request and execute arbitrary commands...

Sierra Wireless GX440 weak password vulnerability (CNVD-2017-10180)

The Sierra Wireless GX440 is a gateway device from Sierra Wireless Canada. The Sierra Wireless GX440 suffers from a weak password vulnerability that can be exploited by a remote attacker to submit a special request to recover the password...

GNU Binutils libbfd Library Denial of Service Vulnerability (CNVD-2017-10175)

GNU Binutils is a set of programming language utility programs developed by the GNU Project. The GNU Binutils libbfd inventory suffers from a denial-of-service vulnerability, which allows remote attackers to exploit the vulnerability by submitting a specially crafted request that crashes the...

Tenda FH1202/F1202 and F1200 Router Stack Buffer Overflow Vulnerability

The Tenda FH1202, F1202 and F1200 are all wireless router products from Tenda China. A stack buffer overflow vulnerability exists in the Tenda FH1202, F1202, and F1200 routers using firmware versions prior to 1.2.0.20. An attacker can exploit this vulnerability by sending a specially crafted POST...

CVE-2017-6622

A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges. The vulnerability is due to missing security constraints in certain HTTP request methods,...

Path traversal

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

CVE-2017-7433

An absolute path traversal vulnerability CWE-36 in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication...

Microsoft Windows SMB Server Information Disclosure Vulnerability (CNVD-2017-08204)

Microsoft Windows is the popular computer operating system. An information disclosure vulnerability exists in the processing of certain requests by the Microsoft Server Message Block 1.0 SMBv1 server. A remote attacker can exploit the vulnerability to obtain sensitive server information via a...

CVE-2017-8295

WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to...

Qemu 'hw/display/cirrus_vga.c' Remote Code Execution Vulnerability Vulnerability

QEMU is an open source emulator software. Qemu 'hw/display/cirrusvga.c' suffers from a remote code execution vulnerability vulnerability that allows an attacker to exploit the vulnerability by submitting a special request that can execute arbitrary code...

CVE-2017-7409

Palo Alto Networks PAN-OS before 7.0.15 has XSS in the GlobalProtect external interface via crafted request parameters, aka PAN-SA-2017-0011 and PAN-70674...

Cisco Unified Communications Manager UDP Handling Denial of Service Vulnerability

Cisco Unified Communications Manager is an enterprise-class IP telephony call processing system. Cisco Unified Communications Manager has a security vulnerability in the Session Initiation Protocol SIP UDP throttling process, which could be exploited by a remote attacker to submit a special reque...

Microsoft Office XSS Elevation of Privilege Vulnerability

Microsoft Office is a suite of office software based on the Windows operating system developed by Microsoft. An elevation of privilege vulnerability exists in a constructed request that is not properly filtered by the Office Web Apps server, which could allow an attacker to perform a cross-site...

python-pysaml2: Entity expansion issue

An XML entity expansion vulnerability was found in python-pysaml2. A remote attacker could send a crafted request which would cause denial of service through resource exhaustion...