CVE-2017-8132

CVE-2017-8132 affects Huawei FusionSphere OpenStack (software versions V100R006C00 and V100R006C10). The vulnerability is a command injection due to insufficient input validation on four TCP listening ports, allowing an unauthenticated attacker to gain root privileges by sending malicious command...

CVE-2017-8175

The Bastet of some Huawei mobile phones with software earlier than Vicky-AL00AC00B167 versions, earlier than Victoria-AL00AC00B167 versions, earlier than Warsaw-AL00C00B191 versions has an insufficient input validation vulnerability due to the lack of parameter validation. An attacker may trick a...

PT-2017-18134

Name of the Vulnerable Software and Affected Versions UMA product versions V200R001 through V300R001 Description The issue is due to insufficient input validation, which allows an attacker to craft malicious links or scripts to launch cross-site scripting XSS attacks. Recommendations For versions...

CVE-2017-2736: Improper Neutralization of Special Elements used in a Command

VCM5010 with software versions earlier before V100R002C50SPC100 has a command injection vulnerability. This is due to insufficient validation of user's input. An authenticated attacker could launch a command injection attack...

PT-2017-15500

Name of the Vulnerable Software and Affected Versions HUAWEI P9 smartphones with software versions earlier than EVA-L09C432B383 HUAWEI P9 smartphones with software versions earlier than EVA-L09C636B380 HUAWEI P9 smartphones with software versions earlier than VIE-L09C432B370 HUAWEI P9 smartphones...

CVE-2017-8127: Improper Neutralization of Input During Web Page Generation

The UMA product with software V200R001 has a cross-site scripting XSS vulnerability due to insufficient input validation. An attacker could craft malicious links or scripts to launch XSS attacks...

PT-2017-18181

Name of the Vulnerable Software and Affected Versions Huawei mobile phones with software earlier than Vicky-AL00AC00B167 versions Huawei mobile phones with software earlier than Victoria-AL00AC00B167 versions Huawei mobile phones with software earlier than Warsaw-AL00C00B191 versions Description...

PT-2017-3875

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 2.7.38 Symfony versions prior to 2.8.31 Symfony versions prior to 3.2.14 Symfony versions prior to 3.3.13 Symfony versions prior to 3.4-BETA5 Symfony versions prior to 4.0-BETA5 Description The issue exists due to...

MGASA-2017-0409 Updated roundcubemail packages fix security vulnerability

It was discovered that roundcubemail contained a zero-day file disclosure vulnerability caused by insuficient input validation which was currently being exploited by hackers to read roundcube's configuration files and steal its database credentials CVE-2017-16651...

CVE-2017-12294: Improper Neutralization of Input During Web Page Generation

A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected system. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the...

PT-2017-3318

Name of the Vulnerable Software and Affected Versions macOS versions prior to 10.13.1 file versions prior to 5.31 Description The issue is related to insufficient input validation in the file component of the operating system. This can be exploited by a remote attacker to cause a denial of servic...

Cross site scripting

A vulnerability in the web framework code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected software. The vulnerability is due to insufficient input validation of some parameter...

Cross site scripting

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected system. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the...

CVE-2017-12296

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the affected system. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the...

PT-2017-12473

Name of the Vulnerable Software and Affected Versions Cisco WebEx Meeting Center affected versions not specified Description A vulnerability could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of an affected system. The issue is due to...

ATutor cross-site scripting vulnerability (CNVD-2017-32279)

ATutor is an open source Web-based learning content management system LCMS developed by the ATutor team. The system includes teaching content management, forums, chat rooms and other modules. A cross-site scripting vulnerability exists in versions prior to Atutor 2.2.3, which stems from the progr...

PT-2017-3931

Name of the Vulnerable Software and Affected Versions Huawei USG6330 affected versions not specified Description The issue is related to insufficient input validation during the authentication process in the network packet analysis tool of the Huawei USG6330 firewall. This can be exploited by a...

PT-2017-3580

Name of the Vulnerable Software and Affected Versions: Android versions 7.0 through 8.1 Description: The issue is related to the incorrect use of mmco parameters in the Android media framework libavc, which is part of the Media Framework component of the Android operating system. This is due to...

CVE-2017-12257

A vulnerability in the web framework of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of some parameters...

PT-2017-3848

Name of the Vulnerable Software and Affected Versions sssd versions prior to 1.16.0 Description The issue is related to insufficient input validation in the sysdb search user by upn res function of the sssd service, which manages access to remote directories and authentication mechanisms. This fl...