Adobe ColdFusion Multiple Vulnerabilities (APSB19-10)

Adobe ColdFusion is prone to code execution and information disclosure vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2019-1680 Cisco Webex Business Suite Content Injection Vulnerability

A vulnerability in Cisco Webex Business Suite could allow an unauthenticated, remote attacker to inject arbitrary text into a user's browser. The vulnerability is due to improper validation of input. An attacker could exploit this vulnerability by convincing a targeted user to view a malicious UR...

CVE-2019-1000016

FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbsav1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in...

CVE-2019-1652

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper...

LAquis SCADA Web Server Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of LAquis SCADA Software. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of requested URLs. The issue results from the lack of...

Information Disclosure

Linux kernel that is built with CONFIGPOSIXTIMERES and CONFIGCHECKPOINTRESTORE is vulnerable to information disclosure. An out-of-bounds access in the showtimer function in the timercreate syscall implementation in kernel/time/posix-timers.c allows userspace applications to read arbitrary kernel...

PHP 5.6.x < 5.6.8 Multiple Vulnerabilities

According to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.8. It is, therefore, affected by multiple vulnerabilities : - An unspecified use-after-free error exists in the zendsharedmemdup function within file ext/opcache/zendsharedalloc.c that allows an...

PHP 5.6.x < 5.6.22 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.22. It is, therefore, affected by multiple vulnerabilities : - An out-of-bounds read error exists in the gdContributionsCalc function within file ext/gd/libgd/gdinterpolation.c. An unauthenticated,...

PHP 5.6.x < 5.6.20 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.20. It is, therefore, affected by multiple vulnerabilities : - A buffer over-write condition exists in the finfoopen function due to improper validation of magic files. An unauthenticated, remote...

Squid 3.1.12.1 <= 3.1.x <= 3.1.23 / 3.2.0.4 <= 3.2.x / 3.3.x / 3.4.x / 3.5.x <= 3.5.28 / 4.x < 4.4 Cross-Site Scripting Vulnerability (SQUID-2018:4)

According to its banner, the version of Squid running on the remote host is 3.1.x after or equal to 3.1.12.1 and prior or equal to 3.1.23, 3.2.x after or equal to 3.2.0.4, 3.3.x, 3.4.x, 3.5.x prior or equal to 3.5.28, or 4.x prior to 4.4. It is, therefore, affected by a cross-site scripting XSS...

Quest NetVault Backup Server < 11.4.5 Process Manager Service SQL Injection Remote Code Execution Vulnerability (ZDI-17-982)

The version of Quest NetVault Backup Server running on the remote host is prior to 11.4.5. It is, therefore, affected by an SQL injection SQLi remote code execution vulnerability in the process manager server due to improper validation of user-supplied input. An unauthenticated, remote attacker c...

AIX 5.3 TL 12 : xorg (IJ11551)

https://vulners.com/cve/CVE-2018-14665 https://vulners.com/cve/CVE-2018-14665 X.Org X server could allow a remote authenticated attacker to gain elevated privileges on the system, caused by improper validation of command line parameters. An attacker could exploit this vulnerability using the...

phpMyAdmin 4.x < 4.8.4 Multiple Vulnerabilities (PMASA-2018-6) (PMASA-2018-8)

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.x prior to 4.8.4. It is, therefore, affected by multiple vulnerabilities: - An arbitrary file read vulnerability exists in the transformation feature. An authenticated, remote attacker c...

Trend Micro Control Manager sCloudService GetPassword SQL Injection (CVE-2018-3604)

An SQL injection vulnerability exists in the Trend Micro Control Manager. The vulnerability is due to improper validation of user-supplied input on SOAP sCloudService requests invoking the GetPassword method. Successful exploitation of the vulnerability could allow the attacker to execute arbitra...

CMS Made Simple remote password reset (CVE-2018-10081)

A remote password reset vulnerability exists in CMS Made Simple. The vulnerability is due to improper validation of password reset requests...

WordPress 4.4.x < 4.4.10 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A DOM-based cross-site scripting XSS vulnerability exists in the uploadSizeError function within file wp-includes/js/plupload/handlers.js when handling overly large file...

Nextcloud Server < 14.0.0, < 13.0.6, < 12.0.11 Improper validation of permissions (NC-SA-2018-010) - Linux

Nextcloud Server is prone to an improper access restriction vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Improper validation of permissions (NC-SA-2018-010)

Improper revalidation of permissions lead to not accepting access restrictions by acess tokens...

Directory traversal

A vulnerability in Cisco Data Center Network Manager software could allow an authenticated, remote attacker to conduct directory traversal attacks and gain access to sensitive files on the targeted system. The vulnerability is due to improper validation of user requests within the management...

CVE-2018-0464 Cisco Data Center Network Manager Path Traversal Vulnerability

A vulnerability in Cisco Data Center Network Manager software could allow an authenticated, remote attacker to conduct directory traversal attacks and gain access to sensitive files on the targeted system. The vulnerability is due to improper validation of user requests within the management...