Design/Logic Flaw

Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data...

Apple macOS High Sierra APFS is vulnerable

Apple macOS High Sierra is a specialized operating system developed by Apple for Mac computers.APFS is one of the file system components for Apple devices. A security vulnerability exists in the APFS component of Apple macOS High Sierra versions prior to 10.13.1. The vulnerability can be exploite...

Array data injection vulnerability in activerecord

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ backslash character...

CVE-2017-15199

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, Identifier, and Description...

kernel: Incorrect overwrite check in __ip6_append_data()

The ip6appenddata function in net/ipv6/ip6output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structure may occur, which allows local users to cause a denial of service system crash via crafted system calls...

IBM Sterling B2B Integrator Security Bypass Vulnerability (CNVD-2017-15934)

IBM Sterling B2B Integrator supports highly secure integration of complex B2B processes with diverse partner communities. A security bypass vulnerability exists in IBM Sterling B2B Integrator version 5.2 that stems from the program failing to properly restrict user requests. An attacker could...

CVE-2017-0263

creationtimestamp| type| source ---|---|--- 2017-05-09 18:26:18+00:00| seen| MISP/59120865-27e0-4e6d-9b74-4a9f950d210f 2017-05-20 11:22:46+00:00| seen| https://t.me/canyoupwnme/1426 2018-02-21 07:47:18+00:00| seen| MISP/5a8d2377-208c-4330-908f-4818950d210f 2018-04-13 13:08:50+00:00|...

MGASA-2017-0093 Updated putty packages fix security vulnerability

In PuTTY before 0.68, if SSH agent forwarding is enabled, local attackers that are also able to connect to the UNIX domain socket could have overwritten heap data CVE-2017-6542...

Unspecified Vulnerability in Oracle Virtualization VM VirtualBox Component

Oracle Virtualization Oracle VirtualBox is a virtual machine component of Oracle's virtualization solution. A local security vulnerability exists in the Core subcomponent of the Oracle VM VirtualBox component of Oracle Virtualization, versions prior to 5.0.28 and versions prior to 5.1.8. An...

Unspecified Vulnerability in Oracle Sun Systems Products 'SMB Users' Subpart

Oracle Sun Systems Products Suite is a Sun Systems Products Suite from Oracle USA. A security vulnerability exists in the Oracle Sun Systems Products 'SMB Users' subcomponent. A local attacker could exploit the vulnerability to read data, compromising the confidentiality and integrity of the data...

CVE-2016-0929

The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry PCF 1.6.x before 1.6.4 logs command lines of failed commands, which might allow context-dependent attackers to obtain sensitive information by reading the log data, as demonstrated by a syslog message that contains credentials...

CVE-2016-3893

The wcdcalhwdepioctlshared function in sound/soc/codecs/wcdcal-hwdep.c in the Qualcomm sound codec in Android before 2016-09-05 on Nexus 6P devices does not properly copy firmware data, which allows attackers to obtain sensitive information via a crafted application, aka Android internal bug...

barrons.com XSS vulnerability

Open Bug Bounty ID: OBB-180088 Description| Value ---|--- Affected Website:| barrons.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediatio...

SUSE-SU-2016:2000-1 Security update for Linux Kernel Live Patch 4 for SLE 12 SP1

This update for the Linux Kernel 3.12.57-6035 fixes the several issues. These security issues were fixed: - CVE-2016-4470: The keyrejectandlink function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure is initialized, which allowed local users to cause a...

Red Hat Network Satellite Cross-Site Scripting Vulnerability

Red Hat Network Satellite RHN Satellite, Red Hat Network Satellite is a set of system management platforms from the American company Red Hat Red Hat. The platform can be used to extend the Linux infrastructure and provide system management functions such as administration, configuration and...

Design/Logic Flaw

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute...

CVE-2015-8652

Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial o...

Liferay Portal 5.1.2 Cross Site Scripting

Exploit Title: Liferay Portal 5.1.2 - Persistent XSS Discovery Date: 2016-02-10 Exploit Author: Sarim Kiani Vendor Homepage: https://www.liferay.com Software Link: https://www.liferay.com/community/releases Version: 5.1.2 Tested on: Windows OS Liferay Portal 5.1.2 is an open source version of...

hadoop2 -- unauthorized disclosure of data vulnerability

Arun Suresh reports: RPC traffic from clients, potentially including authentication credentials, may be intercepted by a malicious user with access to run tasks or containers on a cluster...

CVE-2015-7430

The Hadoop connector 1.1.1, 2.4, 2.5, and 2.7.0-0 before 2.7.0-3 for IBM Spectrum Scale and General Parallel File System GPFS allows local users to read or write to arbitrary GPFS data via unspecified vectors...