Cisco Industrial Network Director Cross-Site Scripting Vulnerability

A vulnerability in the web interface of Cisco Industrial Network Director could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against an affected system. The vulnerability is due to insufficient validation of certain user-supplied input passed in...

SQL Injection

Moodle is vulnerable to SQL injection. Authenticated users can execute SQL commands through a calendar event. This is due to the library not validating the user input before executing the SQL command...

IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution

This module exploits an unauthenticated remote PHP code execution vulnerability in IBM OpenAdmin Tool included with IBM Informix versions 11.5, 11.7, and 12.1. The 'welcomeServer' SOAP service does not properly validate user input in the 'newhomepage' parameter of the 'saveHomePage' method allowi...

Cross-site Scripting (XSS)

cnvs/easel is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary JavaScript because the library does not sanitize it's user input...

FreeBSD : NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler (f52e3a8d-3f7e-11e7-97a9-a0d3c19bfa21)

NVIDIA Unix security team reports : NVIDIA GPU Display Driver contains vulnerabilities in the kernel mode layer handler where not correctly validated user input, NULL pointer dereference, and incorrect access control may lead to denial of service or potential escalation of privileges. %NASLMINLEV...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Unified Communications Manager 10.5 through 11.5 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerabilit...

NETGEAR Multiple Model PHP Remote Command Injection

The remote NETGEAR device is affected by a remote command injection vulnerability in multiple PHP scripts due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted URL, to execute arbitrary commands on the device. Note that...

Red Hat JBoss BPM Suite BRMS Tasks List Cross-Site Scripting (CVE-2017-2674)

A cross-site scripting vulnerability exists in Red Hat JBoss BPM Suite and JBoss BRMS. The vulnerability is due to insufficient validation of user supplied input within the Tasks List component of business-central. An authenticated attacker can exploit this vulnerability by creating a malicious...

Veritas NetBackup Appliance 2.7.x / 3.0.x Remote Command Execution (VTS17-005) (exploit)

The remote Veritas NetBackup Appliance is affected by a remote command execution vulnerability due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted GET request, to execute arbitrary commands with root privileges. Nessus w...

CVE-2017-9135

An issue was discovered on Mimosa Client Radios before 2.2.4 and Mimosa Backhaul Radios before 2.2.4. On the backend of the device's web interface, there are some diagnostic tests available that are not displayed on the webpage; these are only accessible by crafting a POST request with a program...

Remote Code Execution (RCE)

symphonycms/symphony-2 is vulnerable to remote code execution RCE. This is due to a lack of sanitization on user input strings, allowing a malicious user to inject and execute arbitrary script through symphony/content/content.blueprintsdatasources.php...

Code injection

A vulnerability in a script file that is installed as part of the Cisco Policy Suite CPS Software distribution for the CPS appliance could allow an authenticated, local attacker to escalate their privilege level to root. The vulnerability is due to incorrect sudoers permissions on the script file...

CVE-2017-6623

A vulnerability in a script file that is installed as part of the Cisco Policy Suite CPS Software distribution for the CPS appliance could allow an authenticated, local attacker to escalate their privilege level to root. The vulnerability is due to incorrect sudoers permissions on the script file...

Log injection in SAP NetWeaver AS Java using basic auth

Application: SAP NetWeaver AS Java Versions Affected: ENGINEAPI 7.10-7.50 Vendor URL: SAP Bug: Log Injection Reported: 17.05.2017 Vendor response: 18.05.2017 Date of Public Advisory: 14.11.2017 Reference: SAP Security Note 2485208 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class:...

Cross-site Scripting (XSS)

plupload is vulnerable to cross-site scripting XSS attacks. The moxie.swf file contains a function that takes in user input and returns a result via a callback endpoint. This can allow a malicious user to inject and execute arbitrary script through a Same Origin Method Execution SOME attack...

NVIDIA UNIX driver -- multiple vulnerabilities in the kernel mode layer handler

NVIDIA Unix security team reports: NVIDIA GPU Display Driver contains vulnerabilities in the kernel mode layer handler where not correctly validated user input, NULL pointer dereference, and incorrect access control may lead to denial of service or potential escalation of privileges...

NVIDIA GPU Display Driver Local Elevation of Privilege Vulnerability (CNVD-2017-07280)

NVIDIA GPU Display Driver is a set of graphics processor GPU graphics card drivers from NVIDIA. A security vulnerability exists in the kernel mode layer handler in the NVIDIA GPU Display Driver. The vulnerability can be exploited to cause a denial of service null pointer backreference or elevatio...

NVIDIA GPU Display Driver Local Elevation of Privilege Vulnerability (CNVD-2017-07279)

NVIDIA GPU Display Driver is a set of graphics processor GPU graphics card drivers from NVIDIA. A security vulnerability exists in the kernel mode layer handler in NVIDIA GPU Display Driver due to the program failing to properly validate user-submitted values during offset calculations. An attack...

CVE-2017-0351

All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges...

Cross-Site Scripting (XSS)

atlas-dashboardv2 is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the user input in the edit-tag function, allowing a malicious user to inject and execute arbitrary javascript...