New vulnerabilities from the NVD: CVE-2016-10766 | | |
New vulnerabilities from the NVD: CVE-2016-10765 | | edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address. Published at: July 29, 2019 at 08:15PM View on website July 29, 2019 at 10:35PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2015-9288 | | The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's credentials Published at: July 29, 2019 at 07:15PM View on website July 29, 2019 at 10:35PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2015-6960 | | |
New vulnerabilities from the NVD: CVE-2015-6253 | | |
New vulnerabilities from the NVD: CVE-2015-5601 | | edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files. Published at: July 29, 2019 at 07:15PM View on website July 29, 2019 at 10:35PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2018-17213 | | An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. A user without valid credentials can bypass the authentication process, obtaining a valid session cookie with guest/pseudo-guest level privileges. This cookie can then be further used to perform other attacks. Published at: July 29, 2019 at 09:15PM View on website July 30, 2019 at 12:35AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2018-17211 | | An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. An unauthenticated attacker can view details about the printers associated with CPS via a crafted HTTP GET request. Published at: July 29, 2019 at 09:15PM View on website July 30, 2019 at 12:35AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2018-11774 | | Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL statements. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of security seem to protect against malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech. Published at: July 29, 2019 at 10:15PM View on website July 30, 2019 at 12:35AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2018-11773 | | Apache VCL versions 2.1 through 2.5 do not properly validate form input when processing a submitted block allocation. The form data is then used as an argument to the php built in function strtotime. This allows for an attack against the underlying implementation of that function. The implementation of strtotime at the time the issue was discovered appeared to be resistant to a malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech. Published at: July 29, 2019 at 10:15PM View on website July 30, 2019 at 12:35AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2018-11772 | | Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree. The cookie data is then used in an SQL statement. This allows for an SQL injection attack. Access to this portion of a VCL system requires admin level rights. Other layers of security seem to protect against malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech. Published at: July 29, 2019 at 10:15PM View on website July 30, 2019 at 12:35AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2018-18570 | | |
New vulnerabilities from the NVD: CVE-2017-18380 | | edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name. Published at: July 30, 2019 at 04:15PM View on website July 30, 2019 at 06:35PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2015-9290 | | In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible before going to Again. Published at: July 30, 2019 at 04:15PM View on website July 30, 2019 at 06:35PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2018-16871 | | A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost. Published at: July 30, 2019 at 08:15PM View on website July 30, 2019 at 10:36PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2017-18381 | | The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials. Published at: July 30, 2019 at 10:15PM View on website July 31, 2019 at 12:35AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2018-16860 | | A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC effectively obtaining a ticket for that principal. Published at: July 31, 2019 at 06:15PM View on website July 31, 2019 at 07:49PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2007-6763 | | SAS Drug Development (SDD) before 32DRG02 mishandles logout actions, which allows a user (who was previously logged in) to access resources by pressing a back or forward button in a web browser. Published at: July 31, 2019 at 09:15PM View on website July 31, 2019 at 11:49PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2015-5297 | | An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code. Published at: August 01, 2019 at 02:15AM View on website August 01, 2019 at 03:49AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2016-10852 | | |
New vulnerabilities from the NVD: CVE-2016-10851 | | cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84). Published at: August 01, 2019 at 06:15PM View on website August 01, 2019 at 07:49PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2016-10850 | | cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83). Published at: August 01, 2019 at 06:15PM View on website August 01, 2019 at 07:49PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2015-9291 | | cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221). Published at: August 01, 2019 at 06:15PM View on website August 01, 2019 at 07:49PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2015-7559 | | It was found that the Apache ActiveMQ client before 5.15.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client. Published at: August 01, 2019 at 05:15PM View on website August 01, 2019 at 07:49PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2014-8183 | | It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations. Published at: August 01, 2019 at 05:15PM View on website August 01, 2019 at 07:49PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2013-7474 | | Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add, or the username parameter to admin/users. Published at: August 01, 2019 at 06:15PM View on website August 01, 2019 at 07:49PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2013-7473 | | Windu CMS 2.2 allows CSRF via admin/users/?mn=admin.message.error to add an admin account. Published at: August 01, 2019 at 06:15PM View on website August 01, 2019 at 07:49PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2016-10824 | | cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90). Published at: August 01, 2019 at 08:15PM View on website August 01, 2019 at 09:50PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2016-10823 | | cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89). Published at: August 01, 2019 at 08:15PM View on website August 01, 2019 at 09:50PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2016-10822 | | |
New vulnerabilities from the NVD: CVE-2016-10815 | | cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120). Published at: August 01, 2019 at 10:15PM View on website August 01, 2019 at 11:49PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2016-10814 | | |
New vulnerabilities from the NVD: CVE-2016-10813 | | cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118). Published at: August 01, 2019 at 10:15PM View on website August 01, 2019 at 11:49PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2014-8184 | | A vulnerability was found in liblouis, versions 2.5.x before 2.5.4. A stack-based buffer overflow was found in findTable() in liblouis. An attacker could create a malicious file that would cause applications that use liblouis (such as Orca) to crash, or potentially execute arbitrary code when opened. Published at: August 02, 2019 at 04:15PM View on website August 02, 2019 at 05:49PM via National Vulnerability Database |
Няма коментари:
Публикуване на коментар