Doorkeeper gem cross-site scripting vulnerability

Doorkeeper is based on the Ruby language open source Web application framework in the OAuth 2 Open Authorization Protocol provider . A cross-site scripting vulnerability exists in Doorkeeper gem versions 2.1.0 through 4.2.5, which can be exploited by an attacker to insert cross-site code and obta...

Wireshark epan/dissectors/packet-usb.c file denial of service vulnerability

Wireshark formerly known as Ethereal is a network packet analyzer software developed by the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. A security vulnerability exists in the epan/dissectors/packet-usb.c file in Wireshark...

DEBIAN-CVE-2018-7320

In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the SIGCOMP protocol dissector could crash. This was addressed in epan/dissectors/packet-sigcomp.c by validating operand offsets...

DEBIAN-CVE-2017-15135

It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authentication process. A remote, unauthenticated attacker could potentially use this flaw to bypass the authentication process under very rare an...

libdwarf Memory Misreference Vulnerability

libdwarf is a set of tools for reading and writing DWARF2 debugging information. A memory misreference vulnerability exists in libdwarf versions 20130126 through 20140805 in dwarfdump. A remote attacker can exploit this vulnerability to cause a denial of service program crash with the help of a...

ALPINE-CVE-2018-5335

In Wireshark 2.4.0 to 2.4.3 and 2.2.0 to 2.2.11, the WCP dissector could crash. This was addressed in epan/dissectors/packet-wcp.c by validating the available buffer length...

PT-2018-16863

Name of the Vulnerable Software and Affected Versions Kentico versions 9.0 through 11.0 Description The issue is related to a stack-based buffer overflow that can occur via the SqlName, SqlPswd, Database, UserName, or Password field in a SilentInstall XML document. However, the vendor disputes th...

IBM Tivoli Key Lifecycle Manager Cross-Site Scripting Vulnerability (CNVD-2018-01131)

IBM Tivoli Key Lifecycle Manager enables you to locally create, distribute, back up, archive and manage the lifecycle of keys and certificates in your organization. A cross-site scripting vulnerability exists in IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7. An attacker can exploit this...

CVE-2017-15714

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "format=%27;alert%27xss%27" to the URL an alert window would execute...

Mautic SSO Login Vulnerability

Mautic is an open source marketing automation management software developed and maintained by the Mautic community. The software has features such as monitoring websites, creating web pages, and sending emails.Mautic SSO is one of the single sign-on plugins. A security vulnerability exists in...

Mautic Load Page Cross-Site Scripting Vulnerability

Mautic is an open source marketing automation software. The software monitors and manages websites, sends emails and manages customer resources. A cross-site scripting vulnerability exists in the Mautic loading page in Mautic versions 2.1.0 through 2.11.0. A remote attacker can exploit the...

tcmu-runner Information Disclosure Vulnerability

tcmu-runner is a daemon for handling the userspace side of the LIO TCM-User backstore. An information disclosure vulnerability exists in handlerqcow.so in tcmu-runner versions 0.91-1.2.0. An attacker can exploit this vulnerability to inspect any file with root privileges...

Octopus Deploy 'Variable Set Name' Parameter Cross-Site Scripting Vulnerability

Octopus Deploy is an automation tool from Octopus Deploy Australia for development and deployment of . A cross-site scripting vulnerability exists in the All Variables tag in Octopus Deploy versions 3.4.0-3.13.6. A remote attacker can exploit this vulnerability to inject arbitrary web script or...

Pivotal Spring-LDAP Authentication Bypass Vulnerability

Pivotal Spring-LDAP is the U.S. Pivotal Software, Inc. to simplify LDAP programming in Java in a library . An authentication bypass vulnerability exists in Pivotal Spring-LDAP versions 1.3.0 through 2.3.1. A remote attacker can exploit this vulnerability to bypass the authentication mechanism and...

GSI WiNPAT Portal SQL Injection Vulnerability

GSI WiNPAT Portal is a Web-based industry solution for managing intellectual property from GSI Office Management in Germany. A SQL injection vulnerability exists in the login form in GSI WiNPAT Portal versions 3.2.0.1001 through 3.6.1.0. A remote attacker could exploit this vulnerability to execu...

CVE-2017-10197

Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications subcomponent: Folios. The supported version that is affected is 5.4.2.x through 5.5.1.x. Easily exploitable vulnerability allows physical access to compromise Oracle Hospitality OPERA 5...

Oracle Hospitality OPERA 5 Property Services Unauthorized Access Vulnerability

Oracle Hospitality Applications is a suite of business applications, servers, and storage solutions for hotel management from Oracle Corporation. The solution provides human resource cost management, tracking and management of services throughout a customer's journey to improve customer...

mysql: Server: DML unspecified vulnerability (CPU Apr 2017)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: DML. The supported version that is affected is 5.7.11 to 5.7.17. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

pulp-consumer-client design flaws

pulp-consumer-client is a client for the Pulp platform codebase from the Pulp team. A design vulnerability exists in pulp-consumer-client versions 2.4.0 through 2.6.3, which stems from the program's failure to detect the server's TLS certificate signature. An attacker can exploit the vulnerabilit...

Haxx libcurl Denial of Service Vulnerability

Haxx libcurl is a free , open source client-side URL transport library from the Swedish company Haxx. The library supports FTP, FTPS, TFTP, HTTP and so on. A security vulnerability exists in Haxx libcurl versions 7.7 through 7.55.1. An attacker can exploit this vulnerability to cause a denial of...