Views (for Drupal 7) - Less critical - Cross site scripting - SA-CONTRIB-2019-036

This module enables you to create customized lists of data. The module doesn't sufficiently sanitize certain field types, leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that a view must display a field with the format "Full data serialized" and an...

CVE-2019-9023

Removed by vendor...

World Readable Data

tripleo-heat-templates contains a world readable data vulnerability. The library does not set the proper permissions during the creation of the ceph.client.openstack.keyring, allowing a local user to access the keyring to read or modify data. This vulnerability only affects setups with openstack...

The vulnerability of the Windows operating system, related to errors in processing fragmented IP packets by the stack, allows a hacker to disclose sensitive information that is protected.

The vulnerability of the Windows operating system is related to errors in processing fragmented IP packets. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose sensitive information using specially crafted fragmented IP packets...

CVE-2018-20301

An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints e.g., creating, editing, updating allow users to update any coherencefields data. For example, users can automatically confirm their accounts ...

WordPress <= 5.0 - PHP Object Injection via Meta Data vulnerability

PHP Object Injection via Meta Data vulnerability found by Sam Thomas in WordPress versions = 5.0. Solution Update WordPress to the latest available version at least 5.0.1...

Anker Nebula Capsule Pro Denial of Service Vulnerability

The Anker Nebula Capsule Pro is a projector device from Anker Innovations, USA. A security vulnerability exists in the Anker Nebula Capsule Pro NBUIM1V2.1.9 version. An attacker can exploit the vulnerability by sending data to the WifiService with the help of a specially crafted application to...

CVE-2018-18591

A potential unauthorized disclosure of data vulnerability has been identified in Micro Focus Service Manager versions: 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51. The vulnerability could be exploited to release unauthorized disclosure of data...

CVE-2018-18591 MFSBGN03823 rev.1 - Micro Focus Service Manager, unauthorized disclosure of data

A potential unauthorized disclosure of data vulnerability has been identified in Micro Focus Service Manager versions: 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51. The vulnerability could be exploited to release unauthorized disclosure of data...

CVE-2018-18591

CVE-2018-18591 affects Micro Focus Service Manager versions 9.30 through 9.51 (as listed). The vulnerability is described as a potential unauthorized disclosure of data, which could be exploited to release confidential information. The provided connected sources confirm the affected software set ...

GoPro gpmf-parser denial of service vulnerability

GoPro gpmf-parser is a telemetry data parser in GPMF format for use in GoPro cameras. A security vulnerability exists in the 'GPMFScaledData' function of the GPMFparser.c file in GoPro gpmf-parser versions prior to 1.2.1. An attacker can exploit this vulnerability to cause a denial of service...

SSL Insecure Protocols

The remote server offers insecure SSL protocol version which can lead to vulnerability exploitation. No source data...

cgit cgit_clone_objects() Directory Traversal

cgit: directory traversal in cgitcloneobjects CVE-2018-14912 There is a directory traversal vulnerability in cgitcloneobjects, reachable when the configuration flag enable-http-clone is set to 1 default: void cgitcloneobjectsvoid if !ctx.qry.path cgitprinterrorpage400, "Bad request", "Bad request...

Oracle Fusion Middleware Oracle WebLogic Server Component Remote Vulnerability

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platform for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. Oracle WebLogic Server is one of the application server components for cloud and traditional...

Reliable Controls® MACH-ProWebCom™ 未授权访问信息泄露

MACH-ProWebCom™ 是一个功能强大内置网络服务器完全可自由编程的BACnet® 楼宇控制器。可以快速方便地同 Reliable Controls® MACH-ProWebCom™ 将楼宇自控系统发布到网络上。 MACH-ProWebCom™ Web 服务存在未授权访问，可以下载服务配置等敏感信息 MACH-ProWebCom™, a fully programmable BACnet® Building Controller with a powerful, built-in Web server.It can post your building graphics to t...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM MessageSight (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM MessageSight. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this...

Security Bulletin: Vulnerabilities in GSKit affect IBM SPSS Modeler (CVE-2015-0159, CVE-2015-0138, CVE-2014-6221)

Summary GSKit is an IBM component that is used by IBM SPSS Modeler. The GSKit that is shipped with IBM SPSS Modeler contains multiple security vulnerabilities including the “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. IBM SPSS Modeler has addressed the...

CVE-2017-18233

An issue was discovered in Exempi before 2.4.4. Integer overflow in the Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp allows remote attackers to cause a denial of service infinite loop via crafted XMP data in a .avi file...

Design/Logic Flaw

A Remote Unauthorized Access to Data vulnerability in HPE Business Process Monitor version v09.2x, v09.30 was found...

CVE-2017-5801

CVE-2017-5801 is described across sources as a vulnerability in HPE Business Process Monitor (BPM) affecting v09.2x and v09.30, with indications of remote code execution/unauthorized data access. The connected documents cite an RCE/unauthorized access vector in BPM, but do not provide concrete te...