18928 matches found
EulerOS 2.0 SP2 : mercurial (EulerOS-SA-2017-1133)
According to the version of the mercurial package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In Mercurial before 4.1.3, 'hg serve --stdio' allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary...
Cross site scripting
Cross-site scripting XSS vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving unspecified parameters and a privilege escalation attack...
CVE-2015-3615
Fortinet FortiManager is affected by a Cross‑Site Scripting (XSS) vulnerability in FortiManager 5.0.x before 5.0.11 and 5.2.x before 5.2.2. A remote authenticated user can inject arbitrary web script or HTML via unspecified parameters, with privilege escalation potential. Root cause and exact exp...
CVE-2015-3615
Cross-site scripting XSS vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving unspecified parameters and a privilege escalation attack...
CVE-2017-11148
Server-side request forgery SSRF vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors...
Server side request forgery (ssrf)
Server-side request forgery SSRF vulnerability in link preview in Synology Chat before 1.1.0-0806 allows remote authenticated users to access intranet resources via unspecified vectors...
CVE-2017-11148
Synology Chat contains a Server-Side Request Forgery (SSRF) in the link preview component that affects versions prior to 1.1.0-0806. Remote authenticated users can access intranet resources via unspecified vectors. The CNVD/NVD entries confirm the vulnerability in Synology Chat and warn about the...
CVE-2015-0783
The FileViewer class in Novell ZENworks Configuration Management ZCM allows remote authenticated users to read arbitrary files via the filename variable...
CVE-2014-5144
Cross-site scripting XSS vulnerability in Telescope before 0.9.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted markdown...
Cross site scripting
Cross-site scripting XSS vulnerability in Telescope before 0.9.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted markdown...
Design/Logic Flaw
The FileViewer class in Novell ZENworks Configuration Management ZCM allows remote authenticated users to read arbitrary files via the filename variable...
CVE-2014-5144
Cross-site scripting XSS vulnerability in Telescope before 0.9.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted markdown...
CVE-2015-0783
The FileViewer class in Novell ZENworks Configuration Management ZCM allows remote authenticated users to read arbitrary files via the filename variable...
CVE-2014-5144
The CVE-2014-5144 entry describes a persistent XSS in Telescope prior to 0.9.3. An authenticated user can inject arbitrary web script or HTML via crafted markdown, with exploitation tied to parsing of markdown input and lack of sanitisation. Affected software: Telescope
UBUNTU-CVE-2015-4165
The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and...
CVE-2015-4165
Elasticsearch CVE-2015-4165 affects versions 1.0.0 through 1.5.2. The vulnerability leverages the snapshot API to place writeable snapshot metadata files in locations read by another application, which could lead to arbitrary code execution when the Java VM running Elasticsearch can write to such...
CVE-2015-5946
Incomplete blacklist vulnerability in SuiteCRM 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension...
CVE-2015-7854
Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service daemon crash or possibly execute arbitrary code via a crafted key file...
DEBIAN-CVE-2015-7849
Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code or cause a denial of service crash via crafted packets...