SV3C L-SERIES HD CAMERA Cross-Site Scripting Vulnerability

SV3C L-SERIES HD CAMERA is a webcam product from SV3C Technology, China. A cross-site scripting vulnerability exists in SV3C L-SERIES HD CAMERA version V2.3.4.2103-S50-NTD-B20170508B, which originates from the program failing to properly validate user-submitted input. The vulnerability can be...

TeaKKi Cross-Site Scripting Vulnerability

TeaKKi is a team document collaboration software. The software features document synchronization, category management and rights management. A cross-site scripting vulnerability exists in TeaKKi version 2.7. The vulnerability can be exploited by remote attackers to inject arbitrary web script or...

Hiroshi Yuki YukiWiki Denial of Service Vulnerability

Hiroshi Yuki YukiWiki is a Wiki engine. A security vulnerability exists in Hiroshi Yuki YukiWiki 2.1.3 and earlier versions. A remote attacker can exploit this vulnerability to cause a denial of service significant consumption of CPU and memory resources...

Moxa ThingsPro Weak Encryption Vulnerability

Moxa ThingsPro is a suite of IoT gateway and device management solutions from Moxa. A security vulnerability exists in Moxa ThingsPro version 2.1 that stems from the program storing sensitive information in plaintext form. An attacker could exploit the vulnerability to recover access tokens...

Moxa ThingsPro Information Disclosure Vulnerability

Moxa ThingsPro is a suite of IoT gateway and device management solutions from Moxa. A security vulnerability exists in Moxa ThingsPro version 2.1. A remote attacker can exploit this vulnerability by performing a brute force attack to obtain the password of a valid user...

CVE-2018-18391

User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1...

CVE-2018-18395

Hidden Token Access in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1...

CVE-2018-18488

In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids parameter...

Core: information disclosure due to authentication information exposed in a redirect

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0...

Cisco Firepower System Software Detection Engine Denial of Service Vulnerability

Cisco Firepower System Software is a next-generation firewall product NGFW from Cisco. A denial of service vulnerability exists in the implementation of the Server Message Block Version 2 SMBv2 and Version 3 SMBv3 protocols in Cisco Firepower System Software, which stems from the program failing ...

nss: ServerHello.random is all zeros when handling a v2-compatible ClientHello

A flaw was found in the way NSS responded to an SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. A man-in-the-middle attacker could use this flaw in a passive replay attack...

CVE-2018-1749

IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 148484...

CVE-2012-6710

extfinduser in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password= aka an empty array in an action=login request to index.php...

Rausoft ID.prove SQL Injection Vulnerability

Rausoft ID.prove is a list auditing module. The module is capable of auditing and tracking a company's customer, supplier and employee information against a blacklist. A SQL injection vulnerability exists in the login page of Rausoft ID.prove version 2.95. A remote attacker can exploit this...

BSA-2018-710

Security Advisory ID : BSA-2018-710 Component : Apache HTTPD Revision : 1.0: Final In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only...

DEBIAN-CVE-2018-11763

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol...

nss: ServerHello.random is all zeros when handling a v2-compatible ClientHello

A flaw was found in the way NSS responded to an SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. A man-in-the-middle attacker could use this flaw in a passive replay attack...

Micro Focus ArcSight Management Center Unauthenticated File Download Vulnerability

Micro Focus ArcSight Management Center ArcMC is a security management center from Micro Focus UK that centrally manages ArcSight e.g. HP ArcSight Logger, etc. deployments through a unified interface. An unauthenticated file download vulnerability exists in Micro Focus ArcMC versions prior to 2.81...

Micro Focus ArcSight Management Center Cross-Site Scripting Vulnerability

Micro Focus ArcSight Management Center ArcMC is a security management center from Micro Focus UK that centrally manages ArcSight e.g. HP ArcSight Logger, etc. deployments through a unified interface. A cross-site scripting vulnerability exists in Micro Focus ArcMC versions prior to 2.81, which ca...

CVE-2018-6501

Potential security vulnerability of Insufficient Access Controls has been identified in ArcSight Management Center ArcMC for versions prior to 2.81. This vulnerability could be exploited to allow for insufficient access controls...