CVE-2016-8790

Huawei CloudEngine 5800 with software before V200R001C00SPC700, CloudEngine 6800 with software before V200R001C00SPC700, CloudEngine 7800 with software before V200R001C00SPC700, CloudEngine 8800 with software before V200R001C00SPC700, CloudEngine 12800 with software before V200R001C00SPC700 could...

Plaintext Credentials Logged

presto-main logs plaintext database credentials on startup. It loads the credentials stored in a properties file and logs it to a world readable file, server.log...

Artifex Software MuPDF Buffer Overflow Vulnerability

Artifex Software MuPDF is a free, lightweight PDF reader from Artifex Software, USA. A buffer overflow vulnerability exists in the main function of the jstestmain.c file in Artifex Software MuPDF versions prior to 1.10. A remote attacker can exploit this vulnerability to cause a denial of service...

PT-2017-7825 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: MuPDF versions prior to 1.10 Description: The issue is related to a buffer overflow in the main function in jstest main.c in Mujstest, which allows remote attackers to cause a denial of service out-of-bounds write via a crafted file...

Joomla com_virtuemart plugin 'id' parameter SQL injection vulnerability

Joomla is an open source content management system CMS. A SQL injection vulnerability exists in the mainproduct parameter of the Joomla comproduct component. An attacker can exploit the vulnerability to access or modify database data...

Jenkins Multiple Vulnerabilities (Feb 2017) - Windows

Jenkins is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:jenkins:jenkins"; ifdescription...

DEBIAN-CVE-2017-6384

Memory leak in the loginuser function in saslserv/main.c in saslserv/main.so in Atheme 7.2.7 allows a remote unauthenticated attacker to consume memory and cause a denial of service. This is fixed in 7.2.8...

spice: Buffer overflow in main_channel_alloc_msg_rcv_buf when reading large messages

A vulnerability was discovered in SPICE in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution...

CVE-2017-5545

The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service buffer over-read via Apple Property List data that is too short...

Yelp: Clickjacking @ Main Domain[www.yelp.com]

Hello Yelp Security Team, I Just want to submit a report Clickjacking on your Main Domain, I Know that this is a Low Risk But may i know if your aware of it. PoC: See Atachments. Impact: For example, imagine an attacker who builds a web site that has a button on it that says "click here for a fre...

shopify-scripts: Heap Overflow in mrb_arb_splice

It's similar with 192235, but the root cause is different. both of mruby and mruby-engine are crashed by the following PoC. MRBINT64 ruby ary = Array.new1023 ary0x7ffffffffffffc00,0 = Array.new1024 $ gdb -q --args ./bin/mruby test2.rb Reading symbols from ./bin/mruby...done. gdb r Starting progra...

armbets.tv XSS vulnerability

Vulnerable URL: http://www.armbets.tv/main-tag.php?tag=3=%22%3E%3Cscript%3Ealert%28%27OPENBUGBOUNTY%27%29%3C/script%3E=1 Details: Description| Value ---|--- Patched:| Yes, at 05.10.2016 Latest check for patch:| 05.10.2016 19:16 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclose...

iSQL isql_main.c Buffer Overflow Vulnerability

iSQL is an interpreter of SQL that interprets and executes SQL commands to create small databases. A buffer overflow vulnerability exists in iSQL version 1.0, which can be exploited by an attacker to execute arbitrary code...

Jenkins Winstone Servlet Cross Site Scripting Vulnerability (Nov 2011) - Windows

Jenkins is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:jenkins:jenkins";...

repository.mainlib.upd.edu.ph XSS vulnerability

Vulnerable URL: http://repository.mainlib.upd.edu.ph/pmarf/results.php?field=subject"=Caramoan,+Camarines+Sur--Town+fiesta Details: Description| Value ---|--- Patched:| Yes, at 24.11.2017 Latest check for patch:| 24.11.2017 11:54 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

SQL injection vulnerability in the main.aspx page of the remote consultation system of Beijing BlueVision Technology Co.

Telemedicine is a broad term that refers to remote disease diagnosis, remote checkups, remote monitoring, and remote surgical teaching/surgical guidance activities conducted between hospitals through telemedicine systems. A SQL injection vulnerability exists in the main.aspx page of the...

OracleVM 3.2 : xen (OVMSA-2016-0090)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/HVM: correct CPUID leaf 80000008 handling - 6c733e54 xsa173010001-x86-HVM-correct-CPUID-leaf-80000008-handl ing.patch was based on upstream commit: ef437690af8b75e6758dce77af75a22b63982883 x86/HVM...

[SECURITY] Fedora 23 Update: libvirt-1.2.18.4-1.fc23

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support...

[SECURITY] Fedora 24 Update: kf5-kxmlgui-5.24.0-1.fc24

KDE Frameworks 5 Tier 3 solution for user-configurable main windows...

Jenkins CLI RMI Java Deserialization Vulnerability (Nov 2015) - Active Check

Jenkins is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:jenkins:jenkins"; ...