Dup Scout Enterprise Server Buffer Overflow Vulnerability (Aug 2017)

Dup Scout Enterprise Server is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

nginx: Integer overflow in nginx range filter module leading to memory disclosure

A flaw within the processing of ranged HTTP requests has been discovered in the range filter module of nginx. A remote attacker could possibly exploit this flaw to disclose parts of the cache file header, or, if used in combination with third party modules, disclose potentially sensitive memory b...

The vulnerability of the JNDI component of the Oracle WebLogic Server application server allows a hacker to gain control over the application server.

The vulnerability of the JNDI component of the Oracle WebLogic Server application server is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain control over the Oracle WebLogic Server application server through HTTP requests...

CVE-2017-8654

Microsoft SharePoint Server 2010 Service Pack 2 allows a cross-site scripting XSS vulnerability when it does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability"...

KLA11089 XSS vulnerability in Microsoft Sharepoint Server

An XSS cross-site scripting vulnerability related to an improper sanitizing of web requests was found in Microsoft SharePoint Server. By exploiting this vulnerability malicious users can spoof user interaface. This vulnerability can be exploited remotely via a specially designed web request...

ProcessMaker Enterprise Core Multiple SQL Injection Vulnerabilities

Summary Multiple exploitable SQL Injection vulnerabilities exists in ProcessMarker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability,...

kitto directory traversal vulnerability

kitto is an interactive dashboard framework written using Elixir. A directory traversal vulnerability exists in kitto, which allows remote attackers to submit a specially crafted request to view the contents of system files with WEB privileges...

McAfee Advanced Threat Defense Security Bypass Vulnerability (CNVD-2017-23473)

McAfee Advanced Threat Defense ATD is a suite of threat detection and defense solutions from the U.S.-based company McAfee McAfee. The solution provides malware analysis, shared threat intelligence, and isolation of compromised systems. There is an authentication bypass vulnerability in the Web...

Microsoft .NET Denial of Service Vulnerability

Microsoft .NET Framework is a software framework developed by Microsoft. NET Framework Microsoft Common Object Runtime Library does not properly handle web requests, allowing attackers to exploit the vulnerability by submitting a special request and crashing the application...

CVE-2017-8559

Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access OWA handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability...

CVE-2017-8560

Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access OWA handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability...

.NET Denial of Service Vulnerability

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this...

Microsoft Exchange Server Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access OWA fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive...

Microsoft SharePoint Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

KLA11068 Denial of Service Vulnerability in Microsoft .NET Framework

An improper handling of web requests has been found in Microsoft Common Object Runtime Library. By exploiting this vulnerability malicious users can cause a denial of service. This vulnerability can be exploited by issuing specially designed requests to the .NET web application. Original advisori...

KLA11069 Multiple vulnerabilities in Microsoft Office

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges and spoof user interface. Below is a complete list of vulnerabilities: 1. Multiple vulnerabilities related to improper handling of...

CVE-2017-2847

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configuration resulting in command injection. An attacker can simply send an HTTP...

CVE-2017-1193

IBM Sterling B2B Integrator Standard Edition 5.2 could allow user to obtain sensitive information using an HTTP GET request. IBM X-Force ID: 123667...

Microsoft SharePoint Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

Cross-Site Request Forgery Vulnerability in Multiple IBM Products (CNVD-2017-10743)

IBM Global Retention Policy and Schedule Management is a single retention management system. An unspecified cross-site request forgery vulnerability exists in multiple IBM products, which stems from a program's failure to properly validate HTTP requests. A remote attacker could exploit the...