4744 matches found
UBUNTU-CVE-2018-10060
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitizeuri function in lib/functions.php...
CVE-2018-9118
exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a .. in the filename parameter...
glibc: DNS resolver NULL pointer dereference with crafted record type
resquery in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service NULL pointer dereference and process crash...
tcpdump: Buffer over-read in print-pgm.c:pgm_print() in PGM parser
The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgmprint...
AZL-35101 CVE-2018-1000156 affecting package patch for versions less than 2.7.6-9
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITORPROGRAM invocation using ed can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's...
CVE-2018-1000147
An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with insufficient permission to obtain Perforce passwords configured in jobs to obtain them...
CVE-2017-3967
Target influence via framing vulnerability in the web interface in McAfee Network Security Management NSM before 8.2.7.42.2 allows remote attackers to inject arbitrary web script or HTML via application pages inability to break out of 3rd party HTML frames...
Jumio SDK for Android Arbitrary Code Execution Vulnerability
Jumio SDK for Android is a software development kit for building authentication applications using biometrics based on the Android platform. A security vulnerability exists in versions of Jumio SDK for Android prior to 1.5.0. The vulnerability can be exploited to execute arbitrary code via the...
Enhancesoft osTicket Arbitrary Password Reset Vulnerability
Enhancesoft osTicket is a U.S. Enhancesoft's open source ticketing system. A security vulnerability exists in Enhancesoft osTicket versions prior to 1.10.2. A remote attacker can exploit the vulnerability to reset arbitrary passwords...
Enhancesoft osTicket cross-site scripting vulnerability (CNVD-2018-07903)
Enhancesoft osTicket is a U.S. Enhancesoft's open source ticketing system. A cross-site scripting vulnerability exists in the /scp/index.php file in Enhancesoft osTicket versions prior to 1.10.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the 'sor...
rap2hpoutre Laravel Log Viewer Security Bypass Vulnerability
rap2hpoutre Laravel Log Viewer is a log viewer for the Laravel development framework. A security vulnerability exists in rap2hpoutre Laravel Log Viewer prior to version 0.13.0. A remote attacker can exploit this vulnerability to bypass access restrictions...
Kontena server/app/views/static/code.html page cross-site scripting vulnerability
Kontena is a suite of open source microservices platforms capable of running applications as containers. The 'kontena master login --remote' code on the server/app/views/static/code.html page in Kontena versions prior to 1.5.0 indicates a cross-site scripting vulnerability. A remote attacker coul...
Unspecified Vulnerability in inversoft prime-jwt
inversoft prime-jwt is an open source Java 8-based JWT library . A security vulnerability exists in JWTDecoder.decode in versions prior to inversoft prime-jwt 1.3.0 and commit 0d94dcef0133d699f21d217e922564adbb83a227. No details of the vulnerability are provided at this time...
PYSEC-2018-8
io/mongo/parser.py in Eve aka pyeve before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter...
AZL-7346 CVE-2018-1057 affecting package samba for versions less than 4.12.5-6
On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts eg Domain Controllers...
Atlassian Floodlight Controller LoadBalancer Module Denial of Service Vulnerability
Atlassian Floodlight Controller is a Floodlight Controller product from Atlassian Australia.LoadBalancer module is one of the load balancing modules. A contention condition vulnerability exists in the LoadBalancer module in Atlassian Floodlight Controller versions prior to 1.2. A remote attacker...
CVE-2017-7434
In the JDBC driver of NetIQ Identity Manager before 4.6 sending out incorrect XML configurations could result in passwords being logged into exception logfiles...
Synology Surveillance Station File and Directory Information Disclosure Vulnerability
Synology Surveillance Station is a video management application from Synology, and User Profile is one of the user information storage files. An information disclosure vulnerability exists in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station versions prior to...