2330 matches found
Design/Logic Flaw
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php formfield5label parameter...
CVE-2018-0003
A specially crafted MPLS packet received or processed by the system, on an interface configured with MPLS, will store information in the system memory. Subsequently, if this stored information is accessed, this may result in a kernel crash leading to a denial of service. Affected releases are...
Data Exfiltration over DNS Request Covert Channel: DNSExfiltrator
DNSExfiltrator allows for transfering exfiltrate a file over a DNS request covert channel. This is basically a data leak testing tool allowing to exfiltrate data over a covert channel. DNSExfiltrator has two sides: 1. The server side , coming as a single python script dnsexfiltrator.py , which ac...
Double free
Use-after-free in the usbtvprobe function in drivers/media/usb/usbtv/usbtv-core.c in the Linux kernel through 4.14.10 allows attackers to cause a denial of service system crash or possibly have unspecified other impact by triggering failure of audio registration, because a kfree of the usbtv data...
Input validation vulnerability in multiple Huawei products
Huawei IPS Module provides an administrator mechanism consisting of an administrator, an administrator interface.NGFW Module is a next-generation firewall product in a single-board form factor.NIP6300/6600 series products are the next-generation professional intrusion prevention products launched...
Tinysvcmdns Multi-label DNS Heap Overflow Vulnerability
Summary An exploitable heap overflow vulnerability exists in the tinysvcmdns library version 2016-07-18. A specially crafted packet can make the library overwrite an arbitrary amount of data on the heap with attacker controlled values. An attacker needs send a dns packet to trigger this...
Unspecified vulnerability in MediaWiki language converter
MediaWiki is a free and free web-based wiki engine developed and maintained by the Wikimedia Foundation and MediaWiki volunteers, which can be used to deploy internal knowledge management and content management systems. language converter is one of the language converters. A security vulnerabilit...
Cross-Site Scripting (XSS)
kibana is vulnerable to cross-site scripting attacks. The vulnerability exists in timechartFn function in schema.js due to lack of sanitization in timelion label which allows a malicious user can inject and execute arbitrary Javascript...
EyesOfNetwork web interface 'graph' parameter SQL injection vulnerability
EyesOfNetwork EON is an open source, free IT monitoring solution. The solution provides business process configuration tools, generating pop-up windows when events occur in the active queue, etc. EyesOfNetwork web interface aka eonweb is one of the web interfaces. A SQL injection vulnerability...
CVE-2017-16000
SQL injection vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the graph parameter to module/capacityperlabel/index.php...
PT-2017-3911
Name of the Vulnerable Software and Affected Versions tcpdump versions prior to 4.9.3 Description The issue is related to a buffer over-read in the LDP parser of the tcpdump utility, specifically in the ldp tlv print function located in print-ldp.c. This can be exploited by a remote attacker to...
LibOFX Buffer Overflow Vulnerability
LibOFX is a library that allows programs to support OFX financial data bi-directional exchange command responses. A buffer overflow vulnerability exists in the label parsing feature in LibOFX version 0.9.11. An attacker can exploit this vulnerability to execute code or cause a denial of service...
UBUNTU-CVE-2017-13715
The skbflowdissect function in net/core/flowdissector.c in the Linux kernel before 4.3 does not ensure that nproto, ipproto, and thoff are initialized, which allows remote attackers to cause a denial of service system crash or possibly execute arbitrary code via a single crafted MPLS packet...
openSUSE Security Update : the Linux Kernel (openSUSE-2017-734) (Stack Clash)
The openSUSE Leap 42.2 kernel was updated to 4.4.73 to receive security and bugfixes. The following security bugs were fixed : - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be 'jumped'...
Security update for the Linux Kernel (important)
The openSUSE Leap 42.2 kernel was updated to 4.4.73 to receive security and bugfixes. The following security bugs were fixed: - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped"...
Description of the security update for Outlook 2013: June 13, 2017
Description of the security update for Outlook 2013: June 13, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common...
openSUSE Security Update : deluge (openSUSE-2017-656)
This update for deluge fixes two security issues : - CVE-2017-9031: A remote attacker may have used a directory traversal vulnerability in the web interface bsc1039815 - CVE-2017-7178: A remote attacher could have exploited a CSRF vulnerability to trick a logged-in user to perform actions in the...
CVE-2017-3128
A stored XSS Cross-Site-Scripting vulnerability in Fortinet FortiOS allows attackers to execute unauthorized code or commands via the policy global-label parameter...