Oracle Java SE/JRockit Remote Vulnerability (CNVD-2017-18124)

Java SE is short for Java Platform Standard Edition, based on the JDK and JRE, for developing and deploying Java applications for desktops, servers, and embedded devices and real-time environments. Java SE 8u131 has a security vulnerability in its implementation that allows an attacker to exploit...

Joomla! JoomRecipe Component SQL Injection Vulnerability

Joomla! is a content management system. A SQL injection vulnerability exists in version 1.0.4 of the JoomRecipe component of Joomla! The vulnerability allows attackers to obtain sensitive database information...

CVE-2017-7013

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the...

IBM Tivoli Endpoint ManagerXML External Entity Injection Vulnerability

IBM BigFix Platform is IBM's dynamic multi-technology platform that integrates message content drivers and management systems, of which Tivoli Endpoint Manager is the endpoint control software. An XML external entity injection vulnerability exists in Tivoli Endpoint Manager in IBM BigFix Platform...

Linksys Smart Wi-Fi Router CGI Scripts Information Disclosure

The remote Linksys Smart Wi-Fi Router device is affected by an information disclosure vulnerability in its web administration interface due to a flaw that allows bypassing authentication mechanisms for various CGI scripts. An unauthenticated, remote attacker can exploit this to disclose sensitive...

PYSEC-2017-85

txAWS all current versions fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information disclosure...

Multiple vulnerabilities in Google Android Qualcomm components (CNVD-2017-14392)

Android is a free and open-source Linux-based operating system used primarily on mobile devices. Multiple vulnerabilities exist in the Google Android Qualcomm component. An attacker can exploit the vulnerabilities to obtain sensitive information and execute arbitrary code with elevated privileges...

Multiple vulnerabilities in Google Android Qualcomm components (CNVD-2017-14388)

Android is a free and open-source Linux-based operating system used primarily on mobile devices. Multiple vulnerabilities exist in the Google Android Qualcomm component. An attacker can exploit the vulnerabilities to obtain sensitive information and execute arbitrary code with elevated privileges...

Multiple vulnerabilities in Google Android Qualcomm components (CNVD-2017-14378)

Android is a free and open-source Linux-based operating system used primarily on mobile devices. Multiple vulnerabilities exist in the Google Android Qualcomm component. An attacker can exploit the vulnerabilities to obtain sensitive information and execute arbitrary code with elevated privileges...

CVE-2017-6726

A vulnerability in the CLI of the Cisco Prime Network Gateway could allow an authenticated, local attacker to retrieve system process information, which could lead to the disclosure of confidential information. More Information: CSCvd59341. Known Affected Releases: 4.21.0P1...

HackerOne: Reading redacted data via hackbot's answers

Summary: Hello, I have found a way to use hackbot's automated duplication answers to reveal redacted data via brute force. This is restricted by the length of the report and number of radacted items. For short report with little content and just 1-2 redacted texts this is rather easy to accomplis...

SQL Injection Vulnerability in Hanchao B2B2C Multi-User Mall System's goods_id Parameter

Hanchao B2B2C multi-user mall system is a PHP multi-user mall website system source code developed in PHP + MySQL. Hanchao B2B2C multi-user mall system v2.1.3 version goodsid parameter SQL injection vulnerability exists, because the system fails to user-supplied parameters for effective filtering...

CVE-2016-3997

NetApp Clustered Data ONTAP allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service by leveraging failure to enable SMB signing enforcement in its default state...

Microsoft Windows - USP10!NextCharInLiga Uniscribe Font Processing Out-of-Bounds Memory Read

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1202 We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!NextCharInLiga function, while trying to display text using a corrupted TTF font file: ---...

IBM API Connect XML External Entity Injection Vulnerability

IBM API Connect aka APIConnect is an integrated solution for managing the API lifecycle from IBM USA. The solution supports creating, running, managing, and securing APIs, microservices, and more. An XML external entity injection vulnerability exists in IBM API Connect versions 5.0.0.0 through...

Microsoft Windows Uniscribe Information Disclosure Vulnerability(CVE-2017-0284)

We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!ttoGetTableData function, while trying to display text using a corrupted TTF font file: --- 210.274: Access violation - code c0000005 first chance First chance exceptions are reported before any exception handlin...

HPESBGN03763 rev.1 - HPE SiteScope, Disclosure of Sensitive Information, Bypass Security Restriction, Remote Arbitrary Code Execution

Potential Security Impact: Local: Bypass Security Restrictions, Disclosure of Sensitive Information; Remote: Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP SiteScope Monitors Software Series - v11.2x, v11.3x CVSS Scores: | CVE | CVSS Vector | Base Scor...

Microsoft Windows - USP10!CreateIndexTable Uniscribe Font Processing Out-of-Bounds Memory Read

Microsoft Windows - USP10!CreateIndexTable Uniscribe Font Processing Out-of-Bounds Memory Read Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1201 We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!CreateIndexTable function, while trying to...

SQL Injection Vulnerability in the cartSettlement Method of ShopSn V2.0 Mall System

ShopsN Mall system is a product of Shanghai Yiso Network Technology Co., Ltd, an enterprise-class commercial standard full-featured allow free commercial use of open source online store full network system. A SQL injection vulnerability exists in the cartid parameter in the cartSettlement method ...

IBM Maximo Asset Management HTTP Response Splitting Vulnerability

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. An HTTP respons...