CVE-2016-5949

IBM Kenexa LCMS Premier on Cloud could allow an authenticated user to obtain sensitive user data with a specially crafted HTTP request...

CVE-2016-5966

IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...

EAP: Sensitive data can be exposed at the server level in domain mode

It was discovered that when configuring RBAC and marking information as sensitive, users with a Monitor role are able to view the sensitive information...

EAP: Sensitive data can be exposed at the server level in domain mode

It was discovered that when configuring RBAC and marking information as sensitive, users with a Monitor role are able to view the sensitive information...

Aerospike Database Server Information Disclosure Vulnerability

Aerospike Database Server is a distributed, scalable NoSQL database from Aerospike, Inc. An information disclosure vulnerability exists in Aerospike Database Server version 3.10.0.3. An attacker can exploit this vulnerability to obtain sensitive information...

Input validation

An issue was discovered on LG devices using the MTK chipset with L5.0/5.1, M6.0/6.0.1, and N7.0 software, and RCA Voyager Tablet, BLU Advance 5.0, and BLU R1 HD devices. The MTKLogger app with a package name of com.mediatek.mtklogger has application components that are accessible to any applicati...

XML External Entity (XXE) Injection

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to XML External Entity XXE Injection when opting into the DTDLOAD option and opting out of the NONET option. Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt...

IBM License Metric Tool and BigFix Inventory Information Disclosure Vulnerability (CNVD-2017-00327)

The IBM License Metric Tool and BigFix Inventory are both products of IBM Corporation of America. The former is a set of free tools that help IBM Passport Advantage Software Upgrade and Support Services customers determine their Processor Value Unit PVU licensing needs, and the latter is a soluti...

Design/Logic Flaw

Multiple information leaks exist in various IOCTL handlers of the Kaspersky Internet Security KLDISK driver. Specially crafted IOCTL requests can cause the driver to return out-of-bounds kernel memory, potentially leaking sensitive information such as privileged tokens or kernel memory addresses...

IBM Security Privileged Identity Manager Information Disclosure Vulnerability (CNVD-2017-00195)

IBM Security Privileged Identity Manager is an identity management product within IBM Identity Governance and Management, an identity governance solution from IBM in the U.S. It is used to protect, automate, and audit the use of privileged identities to help defend against insider threats and...

SQL Injection Vulnerability in Haixie Zhikang Base Platform

Haixie Zhikang Basic Platform is a management system for food and beverage and pharmaceuticals. A SQL injection vulnerability exists in the Haixie Zhikang Basic Platform login, which can be exploited by attackers to obtain sensitive information from the website database...

SQL Injection Vulnerability in Social Information Collection Platform-Hotel Information Management System of Beijing Aerospace Golden Shield Technology Co.

Beijing Aerospace Golden Shield Technology Hotel Information Management System is a set of hotel management software. Beijing Aerospace Golden Shield Science and Technology Co., Ltd. social information collection platform - hotel information management system...

SAP Netweaver ABAP EA-DFPS Remote Authorization Bypass Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A remote authorization bypass vulnerability exists in SAP NetWeaver, which can be exploited by attackers to gain...

OLX: Multiple vulnerabilities in http://blog.dubizzle.com/uae

http://blog.dubizzle.com/uae/ uses outdated Yoast Seo plugin which has following vulnerabilities: ! Title: Yoast SEO = 3.2.4 - Subscriber Settings Sensitive Data Exposure Reference: https://wpvulndb.com/vulnerabilities/8487 ! Title: Yoast SEO = 3.2.5 - Unspecified Cross-Site Scripting XSS...

Advantech SUSIAccess Server Information Disclosure Vulnerability

SUSIAccess is an easy-to-use remote device management software solution. An information disclosure vulnerability exists in Advantech SUSIAccess Server. An attacker can exploit the vulnerability to traverse the file system to obtain sensitive information...

DBD :: mysql outer boundary read information disclosure vulnerability

DBD::mysql is a Perl5 Database Interface DBI driver for MySQL. DBD :: mysql suffers from an outer boundary read information disclosure vulnerability. An attacker can exploit this vulnerability to obtain sensitive information...

IBM Kenexa LMS on Cloud Information Disclosure Vulnerability

IBM Kenexa LMS on Cloud is a full-featured, configurable, enterprise-grade, social Learning Management System LMS that integrates social networking, collaboration, and knowledge sharing capabilities. The software provides interactive elements that support users in evaluating learning content and...

Microsoft SQL Server Information Disclosure Vulnerability

Microsoft SQL Server is the United States Microsoft Microsoft company develops and maintains a set of applications in the Microsoft Windows system under the large commercial database system. An information disclosure vulnerability exists in Microsoft SQL Server. An attacker can exploit the...

Google Android Qualcomm Component Information Disclosure Vulnerability (CNVD-2016-11053)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA in the U.S. Qualcomm is one of the Qualcomm components used in Qualcomm devices. An information disclosure vulnerability exists in the Google Android Qualcomm component. An attacke...

Ufo UFO-UAPWS suffers from SQL error reporting injection vulnerability (CNVD-2016-10771)

Ufo UFO-UAPWS Reporting System is an Internet solution for enterprises. A SQL reporting error injection vulnerability exists in UFIDA UFO-UAPWS. An attacker exploiting the vulnerability can view sensitive information, obtain database information, and cause information leakage...