FortiCloud XSS vulnerability in on-demand sandbox GUI

Before Dec 5th, 2017, a Cross-Site-Scripting XSS vulnerability in forticloud.com on-demand sandbox GUI may have allowed an authenticated user to inject arbitrary web code or HTML in the context of the victim's browser via the upload of a maliciously crafted file...

[SECURITY] Fedora 27 Update: qbittorrent-4.0.1-1.fc27

A Bittorrent client using rblibtorrent and a Qt4 Graphical User Interface. It aims to be as fast as possible and to provide multi-OS, unicode support...

PSFTPd Windows FTP Server Command Injection Vulnerability

PSFTPd Windows FTP Server is a suite of FTP server software. The software supports protocols such as FTP, FTPS and SFTP. A command injection vulnerability exists in PSFTPd Windows FTP Server version 10.0.4 Build 729. An attacker can exploit this vulnerability to hide data and create arbitrary...

CVE-2017-15270

The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values CSV file. This can be used by attackers to hide data in the Graphical User Interface GUI view and create arbitrary entries to a certain extent. Special characters such as '"' and ',' a...

Hardcoded credentials

The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values CSV file. This can be used by attackers to hide data in the Graphical User Interface GUI view and create arbitrary entries to a certain extent. Special characters such as '"' and ',' a...

NetScaler VPX on 11.1 Firmware Shows as VPX (1) in GUI when Using MAS Pooled Capacity Licensing

NetScaler GUI showing "NetscalerRemoteLicensedVirtualAppliance”. However, VPX instance is showing “License type” as Enterprise on GUI but the model ID was 1 i.e, VPX1...

CVE-2017-15270: Improper Input Validation

The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values CSV file. This can be used by attackers to hide data in the Graphical User Interface GUI view and create arbitrary entries to a certain extent. Special characters such as '"' and ',' a...

CVE-2017-1710

A vulnerability in the Service Assistant GUI in IBM Storwize V7000 2076 8.1 could allow a remote attacker to perform a privilege escalation. IBM X-Force ID: 134531...

Privilege escalation

A vulnerability in the Service Assistant GUI in IBM Storwize V7000 2076 8.1 could allow a remote attacker to perform a privilege escalation. IBM X-Force ID: 134531...

CVE-2017-1710: Undefined Security Weakness

A vulnerability in the Service Assistant GUI in IBM Storwize V7000 2076 8.1 could allow a remote attacker to perform a privilege escalation. IBM X-Force ID: 134531...

CVE-2017-16765

XSS exists on D-Link DWR-933 1.00WWB17 devices via cgi-bin/gui.cgi...

Denial of service

A Denial of Service DoS vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an authenticated user to cause the web GUI to be temporarily unresponsive, via passing a specially crafted payload to the 'params' parameter of the JSON web API...

CVE-2017-14182

A Denial of Service DoS vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an authenticated user to cause the web GUI to be temporarily unresponsive, via passing a specially crafted payload to the 'params' parameter of the JSON web API...

CVE-2017-14182: Improper Input Validation

A Denial of Service DoS vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an authenticated user to cause the web GUI to be temporarily unresponsive, via passing a specially crafted payload to the 'params' parameter of the JSON web API...

Check_MK Information < 1.2.8p26 Disclosure Vulnerability

CheckMK is prone to a race condition vulnerability which could lead to information disclosure. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FortiOS web GUI logindisclaimer redir parameter XSS vulnerability

A reflected XSS vulnerability exists in FortiOS web GUI "Login Disclaimer" redir parameter. It is potentially exploitable by a remote unauthenticated attacker, via sending a maliciously crafted URL to a victim who has an open session on the web GUI. Visiting that malicious URL may cause the...

CVE-2017-10400

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware subcomponent: Administration Graphical User Interface. The supported version that is affected is 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

Unspecified Vulnerability in Oracle GlassFish Server (CNVD-2017-31314)

Oracle Fusion Middleware Oracle Fusion Middleware is the United States Oracle Oracle company's set of business innovation platform for enterprise and cloud environments. The platform provides middleware, software collection and other functions. Oracle GlassFish Server is one of the components tha...

CVE-2017-14614

Directory traversal vulnerability in the Visor GUI Console in GridGain before 1.7.16, 1.8.x before 1.8.12, 1.9.x before 1.9.7, and 8.x before 8.1.5 allows remote authenticated users to read arbitrary files on remote cluster nodes via a crafted path...

Directory traversal

Directory traversal vulnerability in the Visor GUI Console in GridGain before 1.7.16, 1.8.x before 1.8.12, 1.9.x before 1.9.7, and 8.x before 8.1.5 allows remote authenticated users to read arbitrary files on remote cluster nodes via a crafted path...