KLA11153 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to cause denial of service and obtain sensitive information. 1. A buffer overflow vulnerability in Direct 3D 9 component can be exploited remotely to cause denial of service; 2. ...

IBM Connections Engagement Center Cross-Site Scripting Vulnerability

IBM Connections Engagement Center is a set of digital work platforms for employees at IBM in the United States. The platform allows for the addition of email, apps, news, and social tools through an administrative interface. A cross-site scripting vulnerability exists in IBM Connections Engagemen...

The vulnerability of the user interface (UI) of the Apache Storm distributed processing platform allows a hacker to execute arbitrary code.

The vulnerability of the user interface UI of the Apache Storm distributed processing platform’s software platform is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to remotely connect to the UI and execute arbitrary code...

Apple Mac OS X Security Updates (HT208331, HT208394)-01

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

About the security content of Safari 11.0.2

About the security content of Safari 11.0.2 This document describes the security content of Safari 11.0.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

LXCA User Account Names Exposed To Unauthenticated Users Who Can Access the Web User Interface - Lenovo Support NL

No description provided...

Design/Logic Flaw

A vulnerability was identified in Lenovo XClarity Administrator LXCA before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with access to the LXCA web user interface. No password information of the user accounts is exposed...

IBM DOORS Next Generation Cross-Site Scripting Vulnerability

IBM Rational DOORS Next Generation DNG/RRC is a suite of software for capturing, tracking, analyzing, and managing requirements from IBM, USA. The software provides a single platform for global team collaboration to manage requirements more efficiently, sharing unified users, servers and project...

CVE-2017-1650

IBM DOORS Next Generation DNG/RRC 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 133260...

CVE-2017-1560

IBM DOORS Next Generation DNG/RRC 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...

CVE-2017-1607

IBM DOORS Next Generation DNG/RRC 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132927...

CVE-2017-1461

IBM DOORS Next Generation DNG/RRC 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...

IBM Rational DOORS Next Generation Cross-Site Scripting Vulnerability (CNVD-2017-37834)

IBM Rational DOORS Next Generation DNG and Rational Requirements Composer RRC are both requirements management solutions from IBM USA. The solutions are primarily used to define, manage, and report on requirements throughout the project lifecycle. A cross-site scripting vulnerability exists in IB...

CVE-2017-15516

NetApp SnapCenter Server versions 1.1 through 2.x are susceptible to a Cross-Site Request Forgery CSRF vulnerability which could be used to cause an unintended authenticated action in the user interface...

CVE-2017-15516

NetApp SnapCenter Server versions 1.1 through 2.x are susceptible to a Cross-Site Request Forgery CSRF vulnerability which could be used to cause an unintended authenticated action in the user interface...

CVE-2017-4932

VMware AirWatch Launcher for Android prior to 3.2.2 contains a vulnerability that could allow an escalation of privilege from the launcher UI context menu to native UI functionality and privilege. Successful exploitation of this issue could result in an escalation of privilege...

CVE-2017-15270

The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values CSV file. This can be used by attackers to hide data in the Graphical User Interface GUI view and create arbitrary entries to a certain extent. Special characters such as '"' and ',' a...

Code injection

An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Fonts" component. It allows remote attackers to spoof the user interface via crafted text...

CVE-2017-13828

CVE-2017-13828 affects macOS before 10.13.1, specifically the Fonts component. A remote attacker can spoof the user interface by supplying crafted text, exploiting font rendering to mislead users. Practical impact is UI spoofing; the vulnerability is addressed by upgrading to macOS 10.13.1 or lat...

Foscam IP Video Camera CGIProxy.fcgi SoftAP Configuration Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during the SoftAP configuration...