CVE-2016-0732

The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to gain privileges...

qemu security update

CentOS Errata and Security Advisory CESA-2017:2445 An update for qemu-kvm is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Default credentials

A vulnerability was discovered in Siemens ViewPort for Web Office Portal before revision number 1453 that could allow an unauthenticated remote user to upload arbitrary code and execute it with the permissions of the operating-system user running the web server by sending specially crafted networ...

CVE-2017-6866

A vulnerability was discovered in Siemens XHQ server 4 and 5 4 before V4.7.1.3 and 5 before V5.0.0.2 that could allow an authenticated low-privileged remote user to gain read access to data in the XHQ solution exceeding his configured permission level...

Design/Logic Flaw

The basicsettings function in the download manager plugin for WordPress before 2.7.3 allows remote authenticated users to update every WordPress option...

Cisco Prime Infrastructure and EPNM multiple functions Cross Site Scripting (CVE-2017-6699)

A reflected cross-site scripting vulnerability has been reported in Cisco Prime Infrastructure and Evolved Programmable Network Manager. The vulnerability is due to insufficient validation of some request parameters in jsp functions. A remote user can exploit this vulnerability by enticing a targ...

Schneider Electric U.motion Builder localize.php SQL Injection (CVE-2017-7973)

An SQL injection vulnerability has been reported in Schneider Electric U.motion Builder. The vulnerability is due to insufficient validation of the username HTTP request parameter in requests made to localize.php. A remote, unauthenticated user can exploit this vulnerability by sending a crafted...

Path traversal

EMC Data Protection Advisor prior to 6.4 contains a path traversal vulnerability. A remote authenticated high privileged user may potentially exploit this vulnerability to access unauthorized information from the underlying OS server by supplying specially crafted strings in input parameters of t...

CVE-2017-8003

EMC Data Protection Advisor prior to 6.4 contains a path traversal vulnerability. A remote authenticated high privileged user may potentially exploit this vulnerability to access unauthorized information from the underlying OS server by supplying specially crafted strings in input parameters of t...

Schneider Electric U.motion Builder track_import_export.php SQL Injection (CVE-2017-7973)

An SQL injection vulnerability exists in Schneider Electric U.motion Builder. The vulnerability is due to insufficient validation of the objectid HTTP parameter of the trackimportexport.php request. A remote, unauthenticated user can exploit this vulnerability by sending a crafted HTTP request to...

CentOS Update for qemu-img CESA-2017:1681 centos7

Check the version of qemu-img SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882749";...

Qemu: nbd: segmentation fault due to client non-negotiation

Quick Emulator QEMU built with Network Block Device NBD Server support was vulnerable to a null-pointer dereference issue. The flaw could occur when releasing a client that was not initialized due to failed negotiation. A remote user or process could exploit this flaw to crash the qemu-nbd server...

CVE-2017-10805

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

RHEL 7 : kernel (RHSA-2017:1615)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1615 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: A flaw was found in the way Linux kern...

Schneider Electric U.motion Builder loadtemplate.php SQL Injection (CVE-2017-7973)

An SQL injection vulnerability exists in Schneider Electric U.motion Builder. The vulnerability is due to insufficient validation of the tpl HTTP parameter of the loadtemplate.php request. A remote, unauthenticated user can exploit this vulnerability by sending a crafted HTTP request to the...

CVE-2015-7514

OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information...

CVE-2016-2192

PostgreSQL PL/Java before 1.5.0 allows remote authenticated users to alter type mappings for types they do not own...

[ASA-201706-2] freeradius: authentication bypass

Arch Linux Security Advisory ASA-201706-2 ========================================= Severity: High Date : 2017-06-02 CVE-ID : CVE-2017-9148 Package : freeradius Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-281 Summary ======= The package freeradius before...

Code injection

git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with...

MailStore Server search-result Reflected Cross-Site Scripting

A reflected cross-site scripting vulnerability has been reported in MailStore Server. The vulnerability is due to insufficient input validation on user input for search results. A remote user can exploit this vulnerability by enticing an authenticated user to click on a malicious link...