Atlassian FishEye and Crucible Cross-Site Scripting Vulnerabilities

Atlassian FishEye and Crucible are both products of the Australian company Atlassian, FishEye is a suite of software for deep viewing of source code repositories and Crucible is a suite of code review tools. A cross-site scripting vulnerability exists in multiple repositories in Atlassian FishEye...

The vulnerability of the NFSv4 protocol in the Solaris operating system, which allows a hacker to trigger a service failure

The vulnerability of the NFSv4 protocol in the Solaris operating system is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to cause service interruptions such as downtime or, in rare cases, forced shutdowns of the system...

BSA-2017-373

Security Advisory ID : BSA-2017-373 Component : NFSv4 Revision : 2.0: Interim The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is...

libgig Denial of Service Vulnerability (CNVD-2017-27701)

libgig is a C++ library for loading, modifying existing and creating new Gigasampler .gig files and DLS downloadable sound Level 1/2 files, KORG sample instruments .KSF and .KMP files, SoundFont v2 .sf2 files and AKAI sampler data. A denial of service vulnerability exists in the function LoadStri...

LibTIFF 'TIFFReadDirEntryArray' Function Denial of Service Vulnerability

Silicon Graphics LibTIFF is a library for reading and writing TIFF Tagged Image File Format files from Silicon Graphics, USA. The library contains a number of command-line tools for processing TIFF files. A security vulnerability exists in the 'TIFFReadDirEntryArray' function in the tifread.c fil...

WordPress PressForward plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.PressForward plugin is one of the workflow editing plugin. A cross-site scripting vulnerability exists in the...

CVE-2017-1338

IBM DOORS Next Generation DNG/RRC 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...

OSNEXUS QuantaStor v4 Virtual Appliance Cross-Site Scripting Vulnerability

OSNEXUS QuantaStor v4 virtual appliance is a virtual storage appliance from OSNEXUS USA. A cross-site scripting vulnerability exists in OSNEXUS QuantaStor v4 virtual appliance versions prior to 4.3.1. A remote attacker can exploit this vulnerability to inject arbitrary HTML or JavaScript code...

CVE-2017-1431

IBM InfoSphere Streams 4.0, 4.1, and 4.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127632...

Oracle Hospitality e7 Unauthorized Operation Vulnerability

Oracle Hospitality Applications is a set of business applications, servers and storage solutions for hotel management from Oracle. The program provides human resources cost management, provide customers with the entire journey of service tracking management to improve customer satisfaction and...

kernel: NFSv4 server does not properly validate layout type when processing NFSv4 pNFS LAYOUTGET operand

It was found that the NFSv4 server in the Linux kernel did not properly validate layout type when processing NFSv4 pNFS LAYOUTGET and GETDEVICEINFO operands. A remote attacker could use this flaw to soft-lockup the system and thus cause denial of service...

CVE-2017-10200

Vulnerability in the Oracle Hospitality e7 component of Oracle Hospitality Applications subcomponent: Other. The supported version that is affected is 4.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality e7 executes to...

CVE-2017-10169

Vulnerability in the Oracle Hospitality 9700 component of Oracle Hospitality Applications subcomponent: Operation Security. The supported version that is affected is 4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hospitality 9700...

CVE-2017-10036

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: NFSv4. Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via NFSv4 to compromise Solaris. Successful attacks of this...

WordPress Etoile Ultimate Product Catalog Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports personal blog sites on PHP and MySQL servers.WordPress Etoile Ultimate Product Catalog is a product catalog editing and management component. Product Manually is a component for...

PT-2017-15203 · Cs Cart · Cs-Cart Japanese Edition +1

Name of the Vulnerable Software and Affected Versions: CS-Cart Japanese Edition versions 4.3.10 and earlier excluding v2 and v3 CS-Cart Multivendor Japanese Edition versions 4.3.10 and earlier excluding v2 and v3 Description: A cross-site request forgery CSRF issue allows remote attackers to hija...

Arbitrary File Download Vulnerability in MS-MCMS Frontend of MDFMS Platform

MS-MCMS is a web management system using pure java development. A java + spring + mybatis web site building system developed by Mingfei Technology Co. MS-MCMS v4.6.0 version of the MS platform exists arbitrary file download vulnerability in the foreground , due to the system failed to...

tcpdump: force printer vulnerability

The force printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via unspecified vectors...

Oracle GlassFish Server Open Source Edition Path Traversal Vulnerability

Oracle GlassFish Server Open Source Edition is the United States Oracle Oracle company's set of open source version of the server used to build Java EE server-side Java applications. A directory traversal vulnerability exists in Oracle GlassFish Server Open Source Edition version 4.1. The...

phpMyAdmin Input Validation Vulnerability

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A security vulnerability exists in version 4.6.x of...