IBM DB2 10.5 < FP8 Special Build 36828 / 11.1.2.2 < FP2 Special Build 36792 Multiple Vulnerabilities (Windows)

According to its version, the installation of IBM DB2 running on the remote host is either 10.5 prior to fix pack 8 Special Build 36828, or 11.1.2.2 prior to fix pack 2 Special Build 36792. It is, therefore, affected by multiple vulnerabilities related to denial of service and possible exposure o...

DEBIAN-CVE-2017-14318

An issue was discovered in Xen 4.5.x through 4.9.x. The function gnttabcacheflush handles GNTTABOPcacheflush grant table operations. It checks to see if the calling domain is the owner of the page that is to be operated on. If it is not, the owner's grant table is checked to see if a grant mappin...

UBUNTU-CVE-2017-14318

An issue was discovered in Xen 4.5.x through 4.9.x. The function gnttabcacheflush handles GNTTABOPcacheflush grant table operations. It checks to see if the calling domain is the owner of the page that is to be operated on. If it is not, the owner's grant table is checked to see if a grant mappin...

Null pointer dereference

An issue was discovered in Xen 4.5.x through 4.9.x. The function gnttabcacheflush handles GNTTABOPcacheflush grant table operations. It checks to see if the calling domain is the owner of the page that is to be operated on. If it is not, the owner's grant table is checked to see if a grant mappin...

ALPINE-CVE-2017-14318

An issue was discovered in Xen 4.5.x through 4.9.x. The function gnttabcacheflush handles GNTTABOPcacheflush grant table operations. It checks to see if the calling domain is the owner of the page that is to be operated on. If it is not, the owner's grant table is checked to see if a grant mappin...

Radancy: Weak password

It takes ash123456789123456789 as a password,which is not secure.It can be cracked using Dictionary,brute force etc attacks. Impact: If password complexity is not enforced people may tend to put easily guessable password which may be exploitable for a malicious user. Solution-To make it more...

travel.southwest.com XSS vulnerability

Vulnerable URL:...

Google Chrome Type Obfuscation Error Vulnerability

Google Chrome is an open source web browser. A type obfuscation vulnerability exists in Google Chrome V8, which allows remote attackers to exploit the vulnerability to submit a special request and execute arbitrary code...

Google Chrome HTTPS Security Downgrade Vulnerability

Google Chrome is an open source web browser. Google Chrome has a security vulnerability that allows remote attackers to exploit the vulnerability to submit special requests, weakening the security protections of HTTPS...

Zomato: [www.zomato.com] IDOR - Delete/Deactivate any special menu of any Restaurants from Zomato

@prateek0490 was able to delete and deactivate special menu of any restaurant using IDOR Going through the JS, I found another cool function which looked interesting and vulnerable and indeed it was vulnerable - var...

Zomato: [www.zomato.com] IDOR - Delete/Deactivate ANY/ALL Promos through a Post Request at **clients/promoDataHandler.php**

@prateek0490 found a IDOR issue which can deactivate any special offer in our platform...

QPDF Denial of Service Vulnerability (CNVD-2017-30595)

QPDF is content preserving PDF conversion system. The QPDF tokenizer implementation has a security vulnerability that allows remote attackers to exploit the vulnerability to build special PDF files that can be parsed by inducing users and can be used for denial-of-service attacks...

Libgcrypt Information Disclosure Vulnerability (CNVD-2017-30593)

libgcrypt is a cryptographic library based on the GnuPG code. A security vulnerability exists in libgcrypt that allows remote attackers to exploit the vulnerability to submit special requests to obtain sensitive information...

Memory Override Access Vulnerability in Xunlei Look Client

Xunlei Look client is Xunlei's video playback software. A memory override access vulnerability exists in the Xunlei Look client's decoder when decoding special mp4 files. An attacker could exploit this vulnerability to cause a denial of service...

Denial of Service Vulnerability in Storm Video 5

Storm Video 5 is the video playback software of Beijing Storm Technology Co. Storm Video 5 decoder has a denial of service vulnerability when decoding special mp4 files, which can be exploited by attackers to cause the software to crash, resulting in a denial of service...

Memory Override Vulnerability in Sohu Video 5

Sohu Video 5 is Sohu's video playback software for PC. A memory override vulnerability exists in Sohu Video 5's decoder when decoding special mp4 files. An attacker exploited the vulnerability to cause the software to crash, resulting in a denial of service...

Power Property App Has Denial of Service Vulnerability

Power Property app is a management platform for mobile, centralized and data-driven operation and maintenance management of power grid systems. A denial of service vulnerability exists in the Power Property app. The vulnerability is caused due to the program failing to properly parse special...

Trend Micro Smart Protection OS Command Injection

1. Advisory Information Title: Trend Micro Smart Protection OS Command Injection Advisory ID: CORE-2017-0004 Advisory URL:http://www.coresecurity.com/core-labs/advisories/trend-micro-smart-protection-os-command-injection Date published: 2017-08-23 Date of last update: 2017-08-23 Vendors contacted...

ShopsN v3.0 SQL Injection Vulnerability in Frontend SpecialBusinessController.class.php File

ShopsN is a free e-commerce open source system. ShopsN v3.0 beta3 version SpecialBusinessController.class.php file contains a SQL injection vulnerability due to the system fails to effectively filter the placeorder function. A remote attacker can exploit the vulnerability to obtain sensitive...

Apache Pony Mail Security Bypass Vulnerability

Apache Pony Mail is a plugin with mail archiving, viewing and interaction features. A security vulnerability exists in Apache Pony Mail that allows an attacker to submit special requests to bypass authentication...