Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to the main page; the 2 beanReference parameter to the JavaBean viewer page; or the 3 pyTableName to the System database schema...

CVE-2017-11355

Pegasystems PEGA Platform 7.2 ML0 and earlier are affected by multiple XSS vulnerabilities (CVE-2017-11355) allowing remote attackers to inject arbitrary scripts via PATH_INFO, the JavaBean viewer beanReference, or pyTableName on the System database schema modification page; CVE-2017-11356 also a...

CVE-2017-11355

Multiple cross-site scripting XSS vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to the main page; the 2 beanReference parameter to the JavaBean viewer page; or the 3 pyTableName to the System database schema...

RHEL 7 : evince (RHSA-2017:2388)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2388 advisory. The evince packages provide a simple multi-page document viewer for Portable Document Format PDF, PostScript PS, Encapsulated PostScript EPS files,...

Oracle Hospitality Cruise Materials Management Remote Vulnerability

Oracle Hospitality Applications is a suite of business applications, servers and storage solutions for hospitality management from Oracle Corporation. The solution provides human resources cost management, provide customer service throughout the journey tracking management to improve customer...

Important: Red Hat Security Advisory: evince security update

An update for evince is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Moderate: Red Hat Security Advisory: gtk-vnc security, bug fix, and enhancement update

An update for gtk-vnc is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Denial of Service Vulnerability in CAJviewer, CAJ Cloud Reader

CAJviewer and CAJ Cloud Reader are specialized full-text format readers for China Journal Network. A denial of service vulnerability exists in CAJviewer, CAJ Cloud Reader when processing caj files. The latest version of ReaderEx.dll dynamic library function fails to determine whether the pointer ...

JVN#16136413: Installers of Sony PaSoRi related software may insecurely load Dynamic Link Libraries

PaSoRi provided by Sony Corporation is contactless IC card reader/writer. Installers of PaSoRi driver and other related software for Windows contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with t...

[SECURITY] Fedora 24 Update: phpldapadmin-1.2.3-10.fc24

PhpLDAPadmin is a web-based LDAP client. It provides easy, anywhere-accessible, multi-language administration for your LDAP server. Its hierarchical tree-viewer and advanced search functionality make it intuitive to browse and administer your LDAP director y. Since it is a web application, this...

[SECURITY] Fedora 26 Update: phpldapadmin-1.2.3-10.fc26

PhpLDAPadmin is a web-based LDAP client. It provides easy, anywhere-accessible, multi-language administration for your LDAP server. Its hierarchical tree-viewer and advanced search functionality make it intuitive to browse and administer your LDAP director y. Since it is a web application, this...

My IPC Viewer - Certificates or keys found, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application My IPC Viewer published at the 'play' market has multiple vulnerabilities...

[SECURITY] [DSA 3916-1] atril security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3916-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 21, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3916-1] atril security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3916-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 21, 2017 https://www.debian.org/security/faq -...

MS16-015: Description of the security update for Microsoft Excel Viewer 2007: February 9, 2016

Describes a security update that fixes vulnerabilities in Microsoft Office. The most severe of these vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file.SummaryThis security update resolves vulnerabilities in Microsoft Office that could allo...

Virtual Postage (VPA) - Man In The Middle Remote Code Execution

Exploit Title: Virtual Postage VPA - Remote Code Execution via MITM Date: 20/Jul/17 Exploit Author: MaXe Vendor Homepage: https://play.google.com/store/apps/details?id=a2.virtualpostage.com http://archive.is/EdtJT Software Link: N/A Screenshot: N/A Version: 1.0 Tested on: Android 4.1.0 Google API...

VACRON VIG-US731VE 1.0.18-09-B727 IP Camera - Authentication Bypass

Exploit Title: IP Camera VACRON VIG-US731VE Date: 2017-07-18 Exploit Author: anonymous Vendor Homepage: www.vacron.com Version: V1.0.18-09-B727 1. doesn't require credentials to fetch snapshot like this: http://192.168.0.200/ipcam/jpeg 2. allows "viewer" level user to fetch any camera setting, eg...

Vulnerability of Microsoft Office Online Server, Microsoft Excel Viewer, Microsoft Office Compatibility Pack, Microsoft SharePoint Server, Microsoft Office, and Microsoft Excel, allowing a perpetrator to execute arbitrary code

The vulnerabilities of Microsoft Office Online Server, Microsoft Excel Viewer, Microsoft Office Compatibility Pack, Microsoft SharePoint Server, Microsoft Office, and Microsoft Excel are related to object handling in memory. Exploitation of these vulnerabilities can allow a malicious actor to...

PEGA Platform 7.2 ML0 - Missing Access Control Cross-Site Scripting

PEGA Platform 7.2 ML0 - Missing Access Control Cross-Site Scripting Summary ======= 1. Missing access control CVE-2017-11356 2. Multiple cross-site scripting CVE-2017-11355 Vendor ====== "Pegasystems Inc. is the leader in software for customer engagement and operational excellence. Pega’s adaptiv...

[SECURITY] Fedora 25 Update: evince-3.22.1-5.fc25

Evince is simple multi-page document viewer. It can display and print Portable Document Format PDF, PostScript PS and Encapsulated PostScript EPS files. When supported by the document format, evince allows searching for text, copying text to the clipboard, hypertext navigation, table-of-contents...