Automated Logic Corporation ALC WebCTRL, Liebert SiteScan, Carrier i-VU

CVSS v3 6.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Automated Logic Corporation ALC Equipment: ALC WebCTRL, Liebert SiteScan, Carrier i-VU Vulnerability: XML External Entity XXE REPOSTED INFORMATION This advisory was originally posted to the NCCIC Portal on May 30, 201...

SQL Injection Vulnerability in Flash cms O_id Parameter

Flash Flash cms is Zibo Flash Network Technology Co., Ltd. developed a corporate website system. A SQL injection vulnerability exists in the Oid parameter of the Flash cms /member/memberwuliu.asp page. The vulnerability stems from the program's failure to filter user-submitted data. An attacker c...

USN-3297-1 jbig2dec vulnerabilities

Bingchang Liu discovered that jbig2dec incorrectly handled memory when decoding malformed image files. If a user or automated system were tricked into processing a specially crafted JBIG2 image file, a remote attacker could cause jbig2dec to crash, resulting in a denial of service, or possibly...

Multiple vulnerabilities in FortiPortal (CNVD-2017-10725)

FortiPortal is Fortinet's advanced, feature-rich hosted security analytics and management enabler that serves as an MSP for VM software solutions/products that can be deployed on hosted service infrastructures. FortiPortal has multiple security vulnerabilities. The vulnerabilities can be exploite...

IBM Rational Team Concert XML External Entity Injection Vulnerability

IBM Rational Team Concert RTC is the U.S. IBM's set of Jazz-based platform and support for decentralized teams for real-time collaboration related to software lifecycle management solutions. An XML external entity injection vulnerability exists in IBM RTC. A remote attacker could exploit this...

CVE-2016-10294

An information disclosure vulnerability in the Qualcomm power driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10,...

CVE-2017-0625

The CVE-2017-0625 entry corresponds to an information disclosure vulnerability in the MediaTek command queue driver affecting Android. Connected CNVD records describe impact as local information disclosure enabling a malicious local app to access data outside its permissions, with Android version...

CVE-2017-0602

CVE-2017-0602 describes an information-disclosure vulnerability in Bluetooth on Android that could let a local malicious app bypass OS protections that isolate app data. Affected versions span Android 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2. The vulnerability is categorized as Mode...

CVE-2017-4896

Airwatch Inbox for Android contains a vulnerability that may allow a rooted device to decrypt the local data used by the application. Successful exploitation of this issue may result in an unauthorized disclosure of confidential data...

CVE-2017-4896

CVE-2017-4896 affects VMware Airwatch Inbox for Android, where a rooted device may decrypt local app data, enabling potential confidential data disclosure. The vulnerability stems from weaknesses in local data protection within the Airwatch Inbox component. Affected software is Airwatch Inbox for...

S-CMS enterprise website builder system/wapmember/post.asp page O_id parameter exists SQL injection vulnerability

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. There is a SQL injection vulnerability in the Oid parameter of the /wapmember/post.asp page of the S-CMS enterprise website builder system. As the program fails to filter the data submitted by users, it...

Brave URI Obfuscation Vulnerability

Brave is a Web browser product from Brave Software, Inc. in the United States. A URI obfuscation vulnerability exists in Brave version 0.12.4, which can be exploited by attackers to redirect users to malicious websites, resulting in the disclosure of personal information or property damage...

shop.strobel-druck.de XSS vulnerability

Vulnerable URL: http://shop.strobel-druck.de/de/quick-search.html?query=a%3E%27%3E%22%3Et%3Ci%3Ep%3Cimg+src%3Dy+onerror%3Dprompt%28%2Fopenbugbounty%2F%29%3E Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 19:25 GMT Vulnerability type:| XSS...

CVE-2017-2331

A firewall bypass vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based malicious attacker to bypass firewall policies, leading to authentication bypass methods, information disclosure, modification of system files, and...

CVE-2016-9978

IBM Curam Social Program Management 5.2, 6.0, and 7.0 could allow an authenticated attacker to disclose sensitive information. IBM X-Force ID: 120254...

CVE-2016-9978

IBM Curam Social Program Management (Cúram) versions affected: 5.2.0.0–5.2.0 SP6, 6.0.x and 6.2.x up to 6.2.0.3/6.2.0.4, 6.1.x up to 6.1.1.4, and 7.0.0.0–7.0.0.0. An authenticated attacker could bypass Security Sensitivity controls via a specially crafted URL to disclose information tied to highe...

Huawei P9 Input Checksum Vulnerability

Huawei P9 is a smartphone from Huawei. The Huawei P9 suffers from an input validation vulnerability, which can be exploited by an attacker to send a forged air-port message to the affected product via a spoofed base station. Due to insufficient checksums on certain fields in the message, an...

CVE-2017-7885

Artifex jbig2dec 0.13 has a heap-based buffer over-read leading to denial of service application crash or disclosure of sensitive information from process memory, because of an integer overflow in the jbig2decodesymboldict function in jbig2symboldict.c in libjbig2dec.a during operation on a craft...

CVE-2016-4896

SetsucoCMS all versions does not properly manage sessions, which allows remote attackers to disclose or alter unauthorized information via unspecified vectors...

Cell Phone Remote Lighting Monitoring System SQL Injection Vulnerability in txtUsername Parameter

Mobile Remote Lighting Monitoring System is a lighting monitoring system from China Electronic Technology Group Corporation. A SQL injection vulnerability exists in the Mobile Remote Lighting Monitoring System. The lack of filtering of the 'txtUsername' parameter allows an attacker to exploit the...