CVE-2017-15044

The default installation of DocuWare Fulltext Search server through 6.11 allows remote users to connect to and download searchable text from the embedded Solr service, bypassing DocuWare's access control features of the DocuWare user interfaces and API. An attacker can also gain privileges by...

Cisco Registered Envelope Service Cross-Site Scripting Vulnerability (CNVD-2017-34810)

Cisco Registered Envelope Service is a set of mail service solutions from Cisco USA. The product includes read receipts for mail, mail recycling, mail forwarding and reply functions, and provides smartphone support. A cross-site scripting vulnerability exists in the web interface in Cisco...

Code injection

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for...

CVE-2017-12625

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for...

CVE-2017-12285

A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbitrary files from an affected system, aka Directory Traversal. The vulnerability exists because the affected software does not perform proper input validatio...

Cisco Unified Contact Center Express Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Contact Center Express could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of an affected device. The vulnerability is due to insufficient validation of user-supplied inp...

Unspecified Vulnerability in Oracle iPlanet Web Server (CNVD-2017-33734)

Oracle Fusion Middleware Oracle Fusion Middleware is a set of Oracle's business innovation platform for enterprise and cloud environments, which provides middleware, software collections, etc. Oracle iPlanet Web Server is one of the Web servers designed specifically for medium and large enterpris...

Unspecified Vulnerability in Oracle Hospitality Guest Access (CNVD-2017-31510)

Oracle Hospitality Applications is a suite of business applications, servers and storage solutions for hospitality management from Oracle Corporation. The solution provides human resources cost management, provide customers with the entire journey of service tracking management to improve custome...

The vulnerability in the web interface of the Kaspersky Anti-Virus for Linux File Server allows a malicious actor to send authenticated requests.

The vulnerability of the Kaspersky Anti-Virus for Linux File Server web interface is related to the absence of Anti-CSRF tokens in all forms of the interface. Exploiting this vulnerability allows a malicious actor to send authenticated requests during the time when the authenticated user is viewi...

HPE System Management Homepage Authentication Bypass Vulnerability

HPE System Management Homepage is a Web-based interface from Hewlett Packard Enterprise. A security vulnerability exists in HPE System Management Homepage that allows an attacker to submit a special request to bypass authentication and gain unauthorized access...

PT-2017-12430 · Cisco · Cisco Unified Intelligence Center

Name of the Vulnerable Software and Affected Versions: Cisco Unified Intelligence Center affected versions not specified Description: A vulnerability in the web interface could allow an unauthenticated, remote attacker to perform a Document Object Model DOM-based cross-site scripting attack. This...

Cisco Firepower Management Center Cross-Site Scripting Vulnerability

Cisco Firepower Management Center is a new generation of firewall management center software from the U.S. company Cisco Cisco. A cross-site scripting vulnerability exists in the web-based management interface in Cisco Firepower Management Center, which results from the program failing to...

Cisco SocialMiner XML External Entity Injection Vulnerability

Cisco SocialMiner is the United States Cisco Cisco a social media call center solution. The solution supports social media monitoring and analytics. An XML external entity injection vulnerability exists in the web-based user interface of Cisco SocialMiner, which arises from the program's failure ...

The vulnerability of the application interface of the IBM WebSphere Portal server allows a hacker to gain access to user credentials.

The vulnerability of the IBM WebSphere Portal application’s user interface exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to gain access to user credentials by injecting arbitrary JavaScript code into the Web UI...

Oracle MICROS BellaVita Remote Vulnerability

Oracle Hospitality Applications is a suite of business applications, servers and storage solutions for hospitality management from Oracle. The solution provides human resources cost management, provide customers throughout the journey to track the management of services to improve customer...

Cisco AsyncOS Software Command Injection Vulnerability

The Cisco AsyncOS operating system is available to enhance the security and performance of Cisco email security appliances. A security vulnerability exists in the web interface of the Cisco Web Security Appliance WSA. an authenticated remote attacker performs command injection to elevate privileg...

The vulnerability of the Android operating system’s user interface allows a hacker to execute arbitrary code.

The vulnerability of the Android operating system’s user interface is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the Android operating system’s user interface allows a hacker to increase their privileges.

The vulnerability of the Android operating system’s user interface is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to increase their privileges...

CVE-2017-6700

A vulnerability in the web-based management interface of Cisco Prime Infrastructure PI and Evolved Programmable Network Manager EPNM could allow an unauthenticated, remote attacker to conduct a Document Object Model DOM based environment or client-side cross-site scripting XSS attack against a us...

Foscam C1 Indoor HD Camera cgiproxy.fcgi -DNS1.address configuration command injection vulnerability

Foscam C1 Indoor HD Camera is a wireless HD IP camera from Foscam China. A security vulnerability exists in the web management interface in the Foscam C1 Indoor HD Camera using application firmware version 2.52.2.37. The vulnerability can be exploited to inject arbitrary shell characters by sendi...