DEBIAN-CVE-2018-11204

A NULL pointer dereference was discovered in H5Ochunkdeserialize in H5Ocache.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack...

SQL Injection Vulnerability in DedeCMS V5.7-SP2 Version

Dream Content Management System DedeCMS is a PHP open source website management system. SQL injection vulnerability exists in DedeCMS V5.7-SP2 version, which can be exploited by attackers to obtain sensitive database information...

MyBiz MyProcureNet Arbitrary File Upload Vulnerability

MyBiz MyProcureNet is a procurement process automation solution from MyBiz Solutions Malaysia. A security vulnerability exists in MyBiz MyProcureNet version 5.0.0, which originates from an attacker being able to adjust the 'HiddenFieldControlCustomWhiteListedExtensions' parameter and add arbitrar...

Cisco Secure Access Control System Remote Code Execution Vulnerability

Cisco Secure Access Control System ACS is the United States Cisco Cisco a set of security access control system. The system can be through the RADIUS, TACACS protocol for network access and network device access control respectively. ACS Report is one of the system report generation component. An...

OpenEMR Access Restriction Bypass Vulnerability (CNVD-2018-10222)

OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A security vulnerability exists in the interface/patientfile/letter.php...

WordPress Events Manager Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Events Manager plugin prior to version 5.9, which can be exploit...

mysql: InnoDB unspecified vulnerability (CPU Apr 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server...

IBM Jazz Reporting Service Cross-Site Scripting Vulnerability (CNVD-2018-08562)

IBM Jazz Reporting Service JRS is a suite of IBM USA applications for discovering cross-project reports that can be used in integration with IBM Rational CLM's Rational solution for managing all lifecycles of a development project. CLM users can access reports provided by JRS in dashboards,...

Nagios XI Elevation of Privilege Vulnerability

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. An elevation of privilege vulnerability exists in Nagios XI version 5.2.x and version 5.4.x prior to 5.4.13...

UBUNTU-CVE-2018-2784

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server...

Spring Framework Spring-messaging Remote Code Execution Vulnerability

Spring Framework is the U.S. Pivotal Software's set of open source Java, Java EE application framework. The framework helps developers build high-quality applications . A remote code execution vulnerability exists in Spring Framework Spring-messaging. An attacker can exploit the vulnerability to...

Cross-site scripting vulnerability in DedeCMS V5.7 SP2 official system "Topic Management".

Weaving dream content management system DedeCms is a PHP open source website management system. A cross-site scripting vulnerability exists in the "Topic Management" section of DedeCMS V5.7 SP2. Attackers can insert malicious js code in the page to obtain user cookies and other information,...

UBUNTU-CVE-2018-1270

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message to...

mysql: Server: DML unspecified vulnerability (CPU Jan 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: DML. Supported versions that are affected are 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2017-1655

IBM Jazz Foundation IBM Rational Collaborative Lifecycle Management 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2017-1762

IBM Jazz Foundation IBM Rational Collaborative Lifecycle Management 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

mysql: Server: InnoDB unspecified vulnerability (CPU Oct 2017)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: InnoDB. Supported versions that are affected are 5.6.37 and earlier and 5.7.19 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise...

File Upload Vulnerability in KingCMS Version v5.1

KingCMS is a set of easy to learn, simple to operate open source content management system CMS, support for PHP + sqLite3/MySQL and ASP + ACCESS/MSSQL, dedicated to the professional development of oriented programs and enterprise website construction system. A file upload vulnerability exists in...

Code Execution Vulnerability in CmsEasy v5.7

CMSeasy is a web content management system based on PHP+Mysql architecture and a PHP development platform. The use of modular development, easy to use features easy to expand, can be oriented to large and medium-sized sites to provide heavyweight website construction solutions. CmsEasy v5.7 versi...

Trend Micro Email Encryption Gateway Cross-Site Request Forgery Vulnerability

Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. A cross-site request forgery vulnerability exists in Trend Micro Email Encryptio...