Remote Code Execution in pg

Affected versions of pg contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name. There are two specific scenarios in which it is likely for an application to be vulnerable: 1. The application executes unsafe, user-supplied sql...

CVE-2017-3183 Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions

Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions. Sage XRT Treasury is a business finance management application. Database user access privileges are determine...

CVE-2017-3183

Sage XRT Treasury v3 is affected by CVE-2017-3183 through an authorization bypass where database access privileges are determined by the USER_CODE field. An authenticated, low-privilege user can alter USER_CODE to match a privileged user and gain full/privileged access to the SQL database, enabli...

Intel Active Management Technology Multiple Vulnerabilities (INTEL-SA-00112)

Intel Active Management Technology is prone to multiple buffer overflow and memory corruption vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

Public Knowledge Project Open Journal System Cross-Site Scripting Vulnerability

Public Knowledge Project PKP Open Journal System OJS is a journal management and publishing system. A cross-site scripting vulnerability exists in PKP OJS version 3.X prior to 3.1.1-2, which stems from the program failing to escape the '$authors' parameter. A remote attacker can use the '$authors...

Trend Micro Smart Protection Server SQL Injection Vulnerability

Trend Micro Smart Protection Server Standalone is a server that provides smart protection from Trend Micro. A SQL injection vulnerability exists in version 3.x of Trend Micro Smart Protection Server Standalone, which originates from a program that fails to properly detect user-submitted strings...

PT-2018-10244 · Red Hat · Openshift Enterprise

Name of the Vulnerable Software and Affected Versions: Openshift Enterprise versions 3.x Description: A flaw was found in the source-to-image function, specifically in the improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go, which leads to privilege escalation...

Cisco Wireless LAN Controller Default Simple Network Management Protocol Community Strings

With new installations of Cisco Wireless LAN Controller Software, the installation scripts create default communities for Simple Network Management Protocol SNMP Version 2 SNMPv2 and a default username for SNMP Version 3 SNMPv3, both allowing for read and write access. As documented in the Cisco...

CVE-2017-7534

OpenShift Enterprise 3.x contains a stored cross-site scripting (XSS) vulnerability in the pod log viewer. The issue arises from inadequate sanitization of user input, specifically terminal escape characters, which can cause clickable links to be created when viewing pod logs. The vulnerability a...

CVE-2018-0160

A vulnerability in Simple Network Management Protocol SNMP subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper management of memory resources, referred to as a double free. An attacker...

CVE-2018-0160

A vulnerability in Simple Network Management Protocol SNMP subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper management of memory resources, referred to as a double free. An attacker...

mailman security update

3:2.1.12-26.3 - Related: 1545967 - Add missed import 3:2.1.12-26.2 - Resolves: 1545967 - Fix XSS vulnerability in web UI. Add sanitizer 3:2.1.12-26.1 - Resolves: 1545967 - Fix XSS vulnerability in web UI...

LimeSurvey 2.6.x < 2.6.7, 2.7x.x < 2.73.1, 3.x.x < 3.4.2 File Disclosure Vulnerability

LimeSurvey mishandles application/controller/InstallerController.php after installation, which allows remote attackers to access the configuration file. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Joomla Joomanager 2.0.0 Component - com_Joomanager Arbitrary File Download Exploit

Exploit for php platform in category web applications !/usr/bin/python2 -- coding:utf-8 -- ''' GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright C 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it ...

Sonatype Nexus Repository Manager Cross-Site Scripting Vulnerability

Sonatype Nexus Repository Manager aka NXRM is a maven repository manager. A cross-site scripting vulnerability exists in Sonatype Nexus Repository Manager version 3.x prior to 3.8. The vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML in a variety of ways...

CVE-2017-15571

In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/list.html.erb via crafted column data...

iTerm2 Information Disclosure Vulnerability

iTerm2 is a terminal emulator for MacOS. A security vulnerability exists in version 3.x of iTerm2 prior to 3.1.1. A remote attacker could exploit the vulnerability to obtain passwords or other sensitive information...

Ipython Cross-Site Scripting Vulnerability

IPython is an enhanced version of Python's native interactive shell developed by the IPython team. A cross-site scripting vulnerability exists in version 3.x of Ipython prior to 3.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Design/Logic Flaw

iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new default feature was added to iTerm2 version 3.0.0 and unreleased 2.9.x versions such as 2.9.20150717 that resulted in a potential information disclosure. In an attempt to see whether the text under...

[SECURITY] Fedora 25 Update: sqlite-3.14.2-3.fc25

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL databas...