Reflective Cross-Site Scripting Vulnerability in Knight Talent System 'key' Parameter

Knight Talent System is a professional talent system based on PHP + MYSQL as the core development, free + open source. A reflective cross-site scripting vulnerability exists in the search 'key' parameter of the Knight Talent System v4.0 job search function. The vulnerability allows attackers to...

PT-2017-7947 · Mysql Server +3 · Dbd::Mysql +3

Name of the Vulnerable Software and Affected Versions: DBD::mysql versions prior to 4.039 Description: The issue allows attackers to cause a denial of service, specifically an out-of-bounds read, when using server-side prepared statement support. This can be achieved through vectors involving an...

Faraznet CMS Cross-Site Scripting Vulnerability

Faraznet CMS is a content management system. A cross-site scripting vulnerability exists in the ssearch.php page in version 4.x of Faraznet CMS. Due to the program failing to adequately filter user-submitted input. An attacker can exploit the vulnerability to steal cookie-based authentication or...

UBUNTU-CVE-2016-8331

An exploitable remote code execution vulnerability exists in the handling of TIFF images in LibTIFF version 4.0.6. A crafted TIFF document can lead to a type confusion vulnerability resulting in remote code execution. This vulnerability can be triggered via a TIFF file delivered to the applicatio...

Network Scanner Buffer Overflow Vulnerability

MiTec Network Scanner is a multi-threaded port, IP, NetBIOS and SNMP scanner. A buffer overflow vulnerability exists in Network Scanner version 4.0.0, which can be exploited by an attacker to execute arbitrary code within the context of an application, which may also result in a denial of service...

CVE-2016-5525

Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4.3 allows local users to affect integrity via vectors related to Cluster check files...

Subrion CMS Cross-Site Scripting Vulnerability (CNVD-2016-10246)

Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A cross-site scripting vulnerability exists in Subrion CMS version 4.0.5, which stems from the failure of...

Unspecified Vulnerability in Oracle Virtualization Secure Global Desktop (CNVD-2016-10287)

Oracle Virtualization is a suite of virtualization solutions from Oracle Corporation. The solution is used to unify the management of the entire hardware and software architecture from applications to disk, enabling virtualization from the desktop to the data center.Oracle Secure Global Desktop S...

Unspecified Vulnerability in Oracle Sun Systems Products Suite Solaris Cluster Component (CNVD-2016-09693)

Oracle Sun Systems Products Suite is a suite of Sun systems products from Oracle Corporation.Solaris Cluster is one of the enterprise cluster components for the Oracle Sun Solaris operating system. A local security vulnerability exists in the Cluster Geo subcomponent of the Solaris Cluster...

CVE-2016-7097

The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions...

Linux kernel the __sys_recvmmsg function content misreference vulnerability

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A content misreference vulnerability exists in the 'the sysrecvmmsg' function in the net/socket.c file in versions of Linux kernel prior to 4.5.2. A remote attacker could...

ALPINE-CVE-2016-3624

The cvtClump function in the rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service out-of-bounds write by setting the "-v" option to -1...

UBUNTU-CVE-2016-3631

The 1 cpStrips and 2 cpTiles functions in the thumbnail tool in LibTIFF 4.0.6 and earlier allow remote attackers to cause a denial of service out-of-bounds read via vectors related to the bytecounts array variable...

Fastspot BigTree CMS SQL Injection Vulnerability

Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. An SQL injection vulnerability exists in the admin.php page in Fastspot BigTree CMS versions prior to 4.2.11, which can be exploited by an attacker to compromise an...

Macro Expert Elevation of Privilege Vulnerability

Macro Expert is a mouse macro creation tool that records mouse movements and stores them as related macro actions. An elevation of privilege vulnerability exists in Macro Expert version 4.0, which can be exploited by attackers to cause an elevation of privilege...

USN-3092-1 samba vulnerability

Stefan Metzmacher discovered that Samba incorrectly handled certain flags in SMB2/3 client connections. A remote attacker could use this issue to disable client signing and impersonate servers by performing a machine-in-the-middle attack. Samba has been updated to 4.3.11 in Ubuntu 14.04 LTS and...

Kajona cross-site scripting vulnerability (CNVD-2016-08093)

Kajona is an open source CMS written in PHP. A cross-site scripting attack vulnerability exists in Kajona version 4.7. An attacker can use this vulnerability to obtain cookies, inject keyloggers or bypass CSRF protection...

Kajona Directory Traversal Vulnerability

Kajona is an open source CMS written in PHP. A directory traversal vulnerability exists in Kajona version 4.7. An attacker can exploit this vulnerability to obtain information about files present on the system...

CVE-2016-4262

Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code or cause a denial of service memory corruption via unspecified vectors, a different vulnerability than CVE-2016-4256, CVE-2016-4257, CVE-2016-4258, CVE-2016-4259, CVE-2016-4260, and CVE-2016-4261...

LINE for Windows fails to properly verify downloaded files

Overview The auto update function in LINE for Windows provided by LINE Corporation contains a vulnerability where downloaded files are not properly verified. LINE Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and LINE Corporation...