CVE-2017-8153

Huawei VMall for Android with the versions before 1.5.8.5 have a privilege elevation vulnerability due to improper design. An attacker can trick users into installing a malicious app which can send out HTTP requests and execute JavaScript code in web pages without obtaining the Internet access...

Tcpdump ICMP Parser Buffer Overflow Vulnerability

Tcpdump is a set of sniffing tools developed by the Tcpdump team that run under the command line. The tools allow users to intercept and display TCP/IP and other packets sent or received over a network connection to that computer.ICMP parser is one of the Internet Control Message Protocol parsers...

PT-2017-19317 · Osnexus · Quantastor

Name of the Vulnerable Software and Affected Versions: OSNEXUS QuantaStor versions prior to 4.3.1 Description: The issue allows an attacker to inject arbitrary HTML or JavaScript code as a parameter in a REST call, potentially leading to a cross-site scripting XSS attack. When an invalid REST cal...

Symantec VIP Access for Desktop DLL Load Native Code Execution Vulnerability

Symantec VIP Access for Desktop is a suite of online account security protection software from Symantec Symantec. A security vulnerability exists in versions of Symantec VIP Access for Desktop prior to 2.2.4. An attacker could exploit the vulnerability to run an external executable file...

git-annex Arbitrary Command Execution Vulnerability

git-annex is a distributed file synchronization system. A security vulnerability exists in git-annex versions prior to 6.20170818. A remote attacker can use an ssh URL with an initial dash in the hostname to execute arbitrary commands...

Cisco IOS Denial of Service Vulnerability (CNVD-2017-20387)

Cisco IOS is an operating system developed by Cisco for its network devices. A security vulnerability exists in IOS versions prior to 15.24S6, which stems from a program failure to initialize variables. A remote attacker could exploit this vulnerability to cause a denial of service CPU consumptio...

Oracle Berkeley DB Local Vulnerability (CNVD-2017-06551)

Oracle Berkeley DB is the United States Oracle Oracle, an open source embedded database programming library , it can be bound with C, C++, Java, Perl, Python, Tcl and many other languages. data store is one of the data storage components. A security vulnerability exists in the Data Store componen...

Dotclear cross-site scripting vulnerability (CNVD-2017-01936)

Dotclear is a software developer Olivier Meunier developed a free PHP and MySQL-based blog Blog publishing software. A cross-site scripting vulnerability exists in the admin/comments.php file in versions of Dotclear prior to 2.8.2. This vulnerability can be exploited by a remote attacker to injec...

Docker Security Bypass Vulnerability (CNVD-2016-12185)

Docker is an open source application container engine from the American company Docker. A security bypass vulnerability exists in versions of Docker prior to 1.8.3. An attacker can exploit this vulnerability to bypass security restrictions and perform unauthorized operations...

jenkins: Remote code execution vulnerability in remoting module (SECURITY-232)

The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener...

Red Hat Automatic Bug Reporting Tool Privilege Gain Vulnerability

Red Hat Automatic Bug Reporting Tool ABRT is a set of automated bug detection and reporting tools from Red Hat Red Hat. A security vulnerability exists in the abrt-hook-ccpp help process in Red Hat ABRT versions prior to 2.7.1. A local attacker with certain privileges could exploit this...

Aruba Networks CPPM Cross-Site Scripting Vulnerability (CNVD-2015-03502)

Aruba Networks ClearPass Policy Manager is an advanced policy management platform for role- and device-based network access control. A directory traversal security vulnerability exists in Aruba Networks ClearPass Policy Manager CPPM versions prior to 6.4.5, which can be exploited by remote...

OS Property - Joomla Real Estate sqli pre 2.8.1

OS Property - Joomla Real Estate sqli 12th May 2014 - New version 2.8.1 ============== Bug Fixed =============== 1. SQL Injection solved developer did not inform VEL...

Shibboleth Service Provider Denial of Service Vulnerability

Shibboleth is the British Shibboleth Group of a set of open source based on the SAML protocol of the Web single sign-on system . Shibboleth Service Provider SP is one of the service provider . A security vulnerability exists in Shibboleth SP versions prior to 2.5.4. The vulnerability can be...

DEBIAN-CVE-2015-1433

program/lib/Roundcube/rcubewashtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting XSS attacks via the style attribute in an email...

PT-2013-6302 · Zenphoto · Zenphoto

Name of the Vulnerable Software and Affected Versions: Zenphoto versions prior to 1.4.5.4 Description: The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the tableprefix parameter in the wordpress import.php file within the...

DEBIAN-CVE-2012-0786

The transformsave function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augnew file...

CVE-2012-3442

The 1 django.http.HttpResponseRedirect and 2 django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting XSS attacks via a data: URL...

DEBIAN-CVE-2011-4029

The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service removed execution permission via a symlink attack on a temporary lock file...

DEBIAN-CVE-2010-3073

SSLCipher.cpp in EncFS before 1.7.0 does not properly handle integer data sizes when constructing headers intended for randomization of initialization vectors, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms...