LoboEvolution XML External Entity Injection Vulnerability

LoboEvolution is an extensible web browser that supports Java projects. LoboEvolution 9b75694cedfa4825d4a2330abf2719d470c654cd The parsing of XML in previous versions suffers from an XML External Entity Injection vulnerability, which can be exploited by an attacker with the help of a specially...

Schneider Electric SoMachine Basic XML External Entity Injection Vulnerability

Schneider Electric SoMachine Basic is a software for programming and debugging components on a control platform from the French company Schneider Electric Schneider Electric. An XML external entity injection vulnerability exists in Schneider Electric SoMachine Basic version 1.6 SP1, which stems...

CVE-2018-7783

Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity XXE vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band OOB attack. The vulnerability is triggered when input...

The vulnerability of the components ExportSettings.sh, updateWPS, RebootSystem, and vpnBasicSettings of the Intelbras NCLOUD 300 Wi-Fi router’s microprogramming system allows a hacker to gain access to the device with administrator privileges.

The vulnerabilities of the components ExportSettings.sh /cgi-bin/ExportSettings.sh, updateWPS /goform/updateWPS, RebootSystem /goform/RebootSystem, and vpnBasicSettings /goform/vpnBasicSettings of the Intelbras NCLOUD 300 Wi-Fi router software are related to the use of pre-installed registration...

Mozilla Firefox Out-of-Bounds Memory Read Vulnerability

Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A security vulnerability exists in Mozilla Firefox versions prior to 61, Firefox ESR versions pri...

CVE-2018-1000540

LoboEvolution version 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity XXE vulnerability in XML Parsing when viewing the XML file in the browser that can result in disclosure of confidential data, denial of service, server side request forgery. This attack appear to be...

UBUNTU-CVE-2018-1000548

Umlet version 14.3 contains a XML External Entity XXE vulnerability in File parsing that can result in disclosure of confidential data, denial of service, server side request forgery. This attack appear to be exploitable via Specially crafted UXF file. This vulnerability appears to have been fixe...

CVE-2018-1000540

LoboEvolution version 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity XXE vulnerability in XML Parsing when viewing the XML file in the browser that can result in disclosure of confidential data, denial of service, server side request forgery. This attack appear to be...

CivetWeb Buffer Overflow Vulnerability

CivetWeb is a C++/C based embedded web server. A buffer overflow vulnerability exists in the 'sendssifile' function of the civetweb.c file in CivetWeb 1.10 and earlier versions. An attacker can exploit this vulnerability to cause a denial of service or disclose information with the help of a...

perfSONAR Monitoring and Debugging Dashboard Information Disclosure Vulnerability

The perfSONAR Monitoring and Debugging Dashboard MaDDash is a suite of tools for collecting two-dimensional data and presenting it visually. A security vulnerability exists in perfSONAR MaDDash. The vulnerability can be exploited to obtain directory listings and potentially disclose sensitive...

SUSE-SU-2018:1759-1 Security update for microcode_ctl

This update for microcodectl fixes the following security issue: - CVE-2017-5715: Prevent unauthorized disclosure of information to an attacker with local user access caused by speculative execution and indirect branch prediction bsc1095735...

Reliable Controls® MACH-ProWebCom™ 未授权访问信息泄露

MACH-ProWebCom™ 是一个功能强大内置网络服务器完全可自由编程的BACnet® 楼宇控制器。可以快速方便地同 Reliable Controls® MACH-ProWebCom™ 将楼宇自控系统发布到网络上。 MACH-ProWebCom™ Web 服务存在未授权访问，可以下载服务配置等敏感信息 MACH-ProWebCom™, a fully programmable BACnet® Building Controller with a powerful, built-in Web server.It can post your building graphics to t...

Microsoft Windows FxCop XML External Entity Injection Vulnerability

Microsoft Windows FxCop is a code review tool for the .net platform. Microsoft Windows FxCop XML External Entity Injection vulnerability, which originates from an external entity injection error when the program processes XML data. A remote attacker could exploit this vulnerability to disclose...

PT-2018-10677

Name of the Vulnerable Software and Affected Versions PPPD versions prior to the version with the fixed patch Description The issue arises from improper input validation combined with an integer overflow in the EAP-TLS protocol implementation. This can lead to a crash, information disclosure, or...

CVE-2017-3968

Session fixation vulnerability in the web interface in McAfee Network Security Manager NSM before 8.2.7.42.2 and McAfee Network Data Loss Prevention NDLP before 9.3.4.1.5 allows remote attackers to disclose sensitive information or manipulate the database via a crafted authentication cookie...

CVE-2017-5385

Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, leading to potential information disclosure for sites using this header. This vulnerability affects Firefox 51...

CVE-2017-5386

WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR 45.7 and Firefox 51...

DEBIAN-CVE-2017-5386

WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR 45.7 and Firefox 51...

Privilege escalation

WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR 45.7 and Firefox 51...

CVE-2017-5386

WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR 45.7 and Firefox 51...