Momentum Axel 720P Root Account Vulnerability

The Momentum Axel 720P is a dual-band HD camera that supports WiFi connectivity. A security vulnerability exists in Momentum Axel 720P version 5.1.8. The vulnerability can be exploited by an attacker to gain root privileges with the help of a UART pin code to take full control of the system...

Momentum Axel 720P Buffer Overflow Vulnerability

The Momentum Axel 720P is a dual-band HD camera that supports WiFi connectivity. A buffer overflow vulnerability exists in Momentum Axel 720P version 5.1.8. An attacker can exploit this vulnerability to gain access to user accounts...

Huawei 1288H and 2288H Rack Server JSON Injection Vulnerability

Huawei 1288H V5 and 2288H V5 are both rack routers that can be widely used for cloud virtualization, database, big data and other loads. A JSON injection vulnerability exists in the V100R005C00 software of the Huawei 1288H V5 and 2288H V5. The vulnerability stems from the program failing to...

Trend Micro Email Encryption Gateway SQL Injection Vulnerability (CNVD-2018-10479)

Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. A SQL injection vulnerability exists in the formConfiguration class in Trend Mic...

DEBIAN-CVE-2018-11204

A NULL pointer dereference was discovered in H5Ochunkdeserialize in H5Ocache.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack...

SQL Injection Vulnerability in DedeCMS V5.7-SP2 Version

Dream Content Management System DedeCMS is a PHP open source website management system. SQL injection vulnerability exists in DedeCMS V5.7-SP2 version, which can be exploited by attackers to obtain sensitive database information...

MyBiz MyProcureNet Arbitrary File Upload Vulnerability

MyBiz MyProcureNet is a procurement process automation solution from MyBiz Solutions Malaysia. A security vulnerability exists in MyBiz MyProcureNet version 5.0.0, which originates from an attacker being able to adjust the 'HiddenFieldControlCustomWhiteListedExtensions' parameter and add arbitrar...

Cisco Secure Access Control System Remote Code Execution Vulnerability

Cisco Secure Access Control System ACS is the United States Cisco Cisco a set of security access control system. The system can be through the RADIUS, TACACS protocol for network access and network device access control respectively. ACS Report is one of the system report generation component. An...

OpenEMR Access Restriction Bypass Vulnerability (CNVD-2018-10222)

OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A security vulnerability exists in the interface/patientfile/letter.php...

WordPress Events Manager Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Events Manager plugin prior to version 5.9, which can be exploit...

mysql: InnoDB unspecified vulnerability (CPU Apr 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server...

IBM Jazz Reporting Service Cross-Site Scripting Vulnerability (CNVD-2018-08562)

IBM Jazz Reporting Service JRS is a suite of IBM USA applications for discovering cross-project reports that can be used in integration with IBM Rational CLM's Rational solution for managing all lifecycles of a development project. CLM users can access reports provided by JRS in dashboards,...

Nagios XI Elevation of Privilege Vulnerability

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. An elevation of privilege vulnerability exists in Nagios XI version 5.2.x and version 5.4.x prior to 5.4.13...

UBUNTU-CVE-2018-2784

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.6.39 and prior and 5.7.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server...

Spring Framework Spring-messaging Remote Code Execution Vulnerability

Spring Framework is the U.S. Pivotal Software's set of open source Java, Java EE application framework. The framework helps developers build high-quality applications . A remote code execution vulnerability exists in Spring Framework Spring-messaging. An attacker can exploit the vulnerability to...

Cross-site scripting vulnerability in DedeCMS V5.7 SP2 official system "Topic Management".

Weaving dream content management system DedeCms is a PHP open source website management system. A cross-site scripting vulnerability exists in the "Topic Management" section of DedeCMS V5.7 SP2. Attackers can insert malicious js code in the page to obtain user cookies and other information,...

UBUNTU-CVE-2018-1270

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user or attacker can craft a message to...

mysql: Server: DML unspecified vulnerability (CPU Jan 2018)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: DML. Supported versions that are affected are 5.7.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

CVE-2017-1655

IBM Jazz Foundation IBM Rational Collaborative Lifecycle Management 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2017-1762

IBM Jazz Foundation IBM Rational Collaborative Lifecycle Management 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...