CVE-2017-10676

On D-Link DIR-600M devices before C1v3.05ENB01beta20170306, XSS was found in the form2userconfig.cgi username parameter...

Accellion FTA Device Cross-Site Scripting Vulnerability (CNVD-2017-07450)

Accellion FTA devices is a file transfer device from Accellion USA. The device supports file transfer, file sharing, file transfer tracking and reporting, and more. A cross-site scripting vulnerability exists in home/seos/courier/smtpgadd.html in Accellion FTA devices versions prior to FTA912180....

DEBIAN-CVE-2016-7447

Heap-based buffer overflow in the EscapeParenthesis function in GraphicsMagick before 1.3.25 allows remote attackers to have unspecified impact via unknown vectors...

chromium-browser: use after free in pdfium

A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file...

chromium-browser: script injection in extensions

The extensions subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux relies on an IFRAME source URL to identify an associated extension, which allows remote attackers to conduct extension-bindings injection attacks by leveraging script access to a...

UBUNTU-CVE-2016-3866

The Qualcomm sound driver in Android before 2016-09-05 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28868303 and Qualcomm internal bug CR1032820...

CVE-2016-7110

Huawei Unified Maintenance Audit UMA before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special characters," a different vulnerability than CVE-2016-7109...

Linux kernel elevation of privilege vulnerability (CNVD-2016-06287)

The Linux kernel, released by the Linux Foundation in the United States and used by the operating system Linux, is an open-source, free, and most widely ported operating system kernel. An elevation of privilege vulnerability exists in versions of Linux kernel prior to 3.11 on ARM platforms,...

phpMyAdmin directory traversal vulnerability (CNVD-2016-04566)

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A directory traversal vulnerability exists in the...

PT-2016-1701 · Google · Kubernetes

Name of the Vulnerable Software and Affected Versions: Kubernetes versions prior to 1.2.0-alpha.5 Description: The issue allows remote attackers to read arbitrary pod logs via a container name. This is related to a lack of protection for service data in the Kubernetes cluster management tool and...

HP KeyView Arbitrary Code Execution Vulnerability (CNVD-2015-05721)

HP KeyView is file filtering and conversion software that extracts file content and metadata. A security vulnerability exists in the implementation of HP KeyView versions prior to 10.23.0.1 and prior to 10.24.0.1. A remote attacker can exploit this vulnerability to execute arbitrary code...

UBUNTU-CVE-2013-7397

Async Http Client aka AHC or async-http-client before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a...

Mozilla Firefox-release Security Policy Bypass Vulnerability

Mozilla Firefox is a web browser developed by the Mozilla Foundation in conjunction with the open source community. A security policy bypass vulnerability exists in Mozilla Firefox versions prior to 37.0.1, due to the Reader mode feature in Mozilla Firefox on Android and the desktop Firefox...

Design/Logic Flaw

The Reader mode feature in Mozilla Firefox before 37.0.1 on Android, and Desktop Firefox pre-release, does not properly handle privileged URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origi...

Huawei eSpace Desktop V200R001C03 Denial of Service Vulnerability (CNVD-2015-00030)

Huawei eSpace Desktop is a Unified Communications PC client developed by Huawei. A denial of service vulnerability exists in versions prior to Huawei eSpace Desktop V200R001C03, which allows local users to cause a denial of service via unspecified vectors...

Updated pulseaudio package fixes RTP remote crash vulnerability

PulseAudio versions shipped in Mageia 3 and 4 were vulnerable to a remote RTP attack which could crash the PulseAudio server simply by sending an empty UDP packet. Additionally, the version of PulseAudio shipped in Mageia 4 was a pre-release version of PulseAudio v5 and has been updated to the...

TP-Link TL-SC3171 IP Cameras - Multiple Vulnerabilities

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Multiple Vulnerabilities in TP-Link TL-SC3171 IP Cameras 1. Advisory Information Title: Multiple Vulnerabilities in TP-Link TL-SC3171 IP Cameras Advisory ID: CORE-2013-0618 Advisory URL:...

Hacker Jailbreaks Google Glass for Root Access Unlock

On Friday, Jay Freeman announced on Twitter that he exploited a known vulnerability and subsequently achieved root access to his developer-model of Google Glass – Google’s highly anticipated, wearable, head-mounted computer. Around the same time, another notable hacker, Liam McLoughlin, tweeted...

CVE-2013-1665

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External...

CVE-2012-4501

Summary of CVE-2012-4501 (CloudStack/Apache CloudStack) : A configuration vulnerability in development versions of CloudStack/OpenStack incubated CloudStack allowed an attacker to issue arbitrary API calls by abusing the system user account, including deleting VMs. The issue affected CloudStack c...