153 matches found
ALPINE-CVE-2019-9636
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding with an incorrect netloc during NFKC normalization. The impact is: Information disclosure credentials, cookies, etc. that are cached against a given hostname. The components are:...
Podcast Generator Cross-Site Scripting Vulnerability
Podcast Generator is a set of free podcast publishing scripts written in PHP. A cross-site scripting vulnerability exists in Podcast Generator version 2.7. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
CVE-2018-1741
IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 does not properly limit the number or frequency of interaction which could be used to cause a denial of service, compromise program logic or other consequences. IBM X-Force ID: 148420...
Security Bulletin: IBM Security Key Lifecycle Manager is vulnerable to Hazardous Input Validation ( CVE-2018-1749)
Summary IBM Security Key Lifecycle Manager uses incomplete blocklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. Vulnerability Details CVEID: CVE-2018-1749 DESCRIPTION: IBM Tivoli Key Lifecycle Manager...
CVE-2018-1000802
CVE-2018-1000802 affects CPython 2.7, where shutil.make_archive is vulnerable to command injection. A specially crafted input to the function can lead to Denial of Service and potential information gain via arbitrary file creation, as described in multiple advisories. The issue stems from imprope...
Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Security Key Lifecycle Manager (SKLM) (CVE-2012-5783)
Summary IBM WebSphere Application Server is shipped as a component of IBM Security Key Lifecycle Manager SKLM. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulleti...
Google gperftools memory leak vulnerability
Google gperftools is an implementation of malloc that includes performance analysis tools such as heap checker, heap analyzer and CPU analyzer. A memory disclosure vulnerability exists in the mallocextension.cc file in Google gperftools version 2.7. An attacker could exploit this vulnerability to...
File upload vulnerability in SemCms website builder version 2.7
SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox , google, 360 and other mainstream browsers.SemCms php version written in php language, combined with apache, in window, or linux system to run...
Security Bulletin: IBM Security Key Lifecycle Manager is affected by XML External Entity Injection (XXE) attack (CVE-2017-1666)
Summary IBM Security Key Lifecycle Manager is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Vulnerability Details CVEID: CVE-2017-1666 DESCRIPTION:...
CVE-2018-11406
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the...
Oracle Hospitality Simphony (MICROS) 2.7 < 2.9 - Directory Traversal
Exploit Title: Oracle Hospitality Simphony MICROS directory traversal Date: 30.01.2018 Exploit Author: Dmitry Chastuhin https://twitter.com/chipik Vendor Homepage: http://www.oracle.com/ Version: 2.7, 2.8 and 2.9 Tested on: Win, nix CVE : CVE-2018-2636 !/usr/bin/env python...
Buffer overflow
Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications subcomponent: Security. The supported version that is affected is 2.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality...
Apache Hadoop Insufficient Access Control Vulnerability
Apache Hadoop is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:hadoop"; i...
Information disclosure
An Information Exposure issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior. An attacker may be able to exploit a flaw in the handling of Ethernet frame...
Sql injection
An Injection issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior. An attacker may be able to inject packets that could potentially disrupt the availabili...
CVE-2017-16719
An Injection issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior. An attacker may be able to inject packets that could potentially disrupt the availabili...
PT-2017-3905 · Faad2 +1 · Faad2 +1
Name of the Vulnerable Software and Affected Versions: FAAD2 version 2.7 Description: The issue is related to the mp4ff parse tag function, which can lead to a denial of service due to an infinite loop and CPU consumption when processing a crafted mp4 file. This allows remote attackers to exploit...
PT-2017-3886 · Freeware +1 · Faad2 +1
Name of the Vulnerable Software and Affected Versions: Freeware Advanced Audio Decoder 2 FAAD2 version 2.7 Description: The issue is caused by a buffer overflow in the mp4ff read stsd function, located in common/mp4ff/mp4atom.c, which can lead to a denial of service. This can be triggered by a...
Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability (CNVD-2016-04939)
Cisco WebEx Meetings Server CWMS is the United States Cisco Cisco WebEx meeting program in a set of multifunctional meeting solutions that include audio, video and Web conferencing. A cross-site request forgery vulnerability exists in Cisco WebEx Meetings Server CWMS version 2.7. A remote attacke...