PT-2017-16174

Name of the Vulnerable Software and Affected Versions McAfee Network Data Loss Prevention NDLP versions 9.3.x Description The issue allows remote attackers to obtain session or cookie information by modifying the HTTP request, which can lead to unauthorized access. This is due to an Embedding...

CVE-2017-3575

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily "exploitable" vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM...

UBUNTU-CVE-2017-3309

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Optimizer. Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple...

PT-2017-8343

Name of the Vulnerable Software and Affected Versions Kallithea versions prior to 0.3.2 Description The issue allows remote authenticated users to edit or delete open pull requests or delete comments by leveraging read access. Recommendations For versions prior to 0.3.2, update to version 0.3.2 o...

PT-2017-9813

Name of the Vulnerable Software and Affected Versions Huawei Mate 8 phones versions before NXT-AL10C00B386 Huawei Mate 8 phones versions before NXT-CL00C92B386 Huawei Mate 8 phones versions before NXT-DL00C17B386 Huawei Mate 8 phones versions before NXT-TL00C01B386 Huawei Mate S phones versions...

CVE-2017-3819: Missing Authentication for Critical Function

A privilege escalation vulnerability in the Secure Shell SSH subsystem in the StarOS operating system for Cisco ASR 5000 Series, ASR 5500 Series, ASR 5700 Series devices, and Cisco Virtualized Packet Core could allow an authenticated, remote attacker to gain unrestricted, root shell access. The...

Google Chrome Security Updates (stable-channel-update-for-desktop-2017-03) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Mozilla Firefox Security Advisories (MFSA2017-05, MFSA2017-07) - Windows

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

PT-2017-10352

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.8 Description The issue allows local ARM guest OS users to cause a denial of service, resulting in a host crash. This can be achieved through vectors involving a data or prefetch abort with the ESR EL2.EA bit set...

CVE-2016-9817: Improper Access Control

Xen through 4.7.x allows local ARM guest OS users to cause a denial of service host crash via vectors involving a 1 data or 2 prefetch abort with the ESREL2.EA bit set...

CVE-2017-5585: Improper Neutralization of Special Elements in Output Used by a Downstream Component

OpenText Documentum Content Server formerly EMC Documentum Content Server 7.3, when PostgreSQL Database is used and returntopresultsrowbased config option is false, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and execute arbitrary...

PT-2017-2022

Name of the Vulnerable Software and Affected Versions Cisco TelePresence MCU platforms versions 4.31.68 or later Description A vulnerability in the kernel of Cisco TelePresence Multipoint Control Unit MCU Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause ...

CVE-2017-3792: Improper Input Validation

A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit MCU Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service DoS condition. The vulnerability is due to improper size validation when...

PT-2017-15799

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 Description The issue affects the Oracle Marketing component, specifically the User Interface subcomponent. It allows an unauthenticated attacker with...

Web Based TimeSheet Script Authentication Bypass Vulnerability

web based timesheet is a program to monitor the work of your employees. An authentication bypass vulnerability exists in the Web Based TimeSheet script that requires the string 'or' '=' to be entered where the password is filled in, which can be exploited by an attacker to bypass authentication...

openssl: Memory corruption in the ASN.1 encoder

A flaw was found in the way OpenSSL encoded certain ASN.1 data structures. An attacker could use this flaw to create a specially crafted certificate which, when verified or re-encoded by OpenSSL, could cause it to crash, or execute arbitrary code using the permissions of the user running an...

CVE-2015-8856: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via a crafted file or directory name...

CVE-2017-3256

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Replication. Supported versions that are affected are 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2016-9310

The control mode mode 6 functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet...

CVE-2017-0393

A denial of service vulnerability in libvpx in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1,...