Archive
15 January 2016
Vulnerabilities first published on this day (UTC), newest first.
40 results · Feed
-
Unscored —
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.…
-
Unscored —CVE-2016-1910 Public exploit
The User Management Engine (UME) in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors,…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the Redhen module 7.x-1.x before 7.x-1.11 for Drupal allow remot…
-
Medium 5.4
Dolibarr ERP and CRM contain XSS Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lastname, (2) firstname, (3) email, (4) job, or (5) signature parameter to htdocs/user/card.php.
-
Unscored —
Gajim before 0.16.5 allows remote attackers to modify the roster and intercept messages via a crafted roster-push IQ st…
-
Medium 5.9
OpenStack Nova Potential Xen connection password leak via StorageError
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to o…
-
Unscored —
Huawei S5300 Campus Series switches with software before V200R005SPH008 do not mask the password when uploading files, …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inj…
-
Unscored —
The Routing Engine in Juniper Junos OS 13.2R5 through 13.2R8, 13.3R1 before 13.3R8, 13.3R7 before 13.3R7-S3, 14.1R1 bef…
-
Unscored —
Juniper Junos OS before 13.2X51-D36, 14.1X53 before 14.1X53-D25, and 15.2 before 15.2R1 on EX4300 series switches allow…
-
Unscored —
Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X…
-
Unscored —
Juniper Junos OS before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.1X48 before 12.3X48-D20, and 15.1X49 before 15.1X49…
-
Unscored —
Embedthis Appweb, as used in J-Web in Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 1…
-
Unscored —
Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code via vectors involving a browser plugin.
-
Unscored —
Cisco Aironet 1800 devices with software 7.2, 7.3, 7.4, 8.1(112.3), 8.1(112.4), and 8.1(15.14) have a default account, …
-
Unscored —
The DCERPC Inspection implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 through 9.5.1 allows rem…
-
Unscored —
The IP ingress packet handler on Cisco Aironet 1800 devices with software 8.1(112.3) and 8.1(112.4) allows remote attac…
-
Unscored —
The Admin portal in Cisco Identity Services Engine (ISE) 1.1.x, 1.2.0 before patch 17, 1.2.1 before patch 8, 1.3 before…
-
Unscored —
Cisco Wireless LAN Controller (WLC) devices with software 7.6.x, 8.0 before 8.0.121.0, and 8.1 before 8.1.131.0 allow r…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject …
-
Unscored —
Advantech WebAccess before 8.1 allows remote attackers to read sensitive cleartext information about e-mail project acc…
-
Unscored —
SQL injection vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to execute arbitrary SQ…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Advantech WebAccess before 8.1 allows remote attackers to hijack the…
-
Unscored —
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows attackers to bypass filesystem encryption via XOR calculations.
-
Unscored —
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an u…
-
Unscored —
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to discover credentials by reading detailed e…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11, 7.0 through 7.0.0.9, an…
-
Unscored —
Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input.
-
Unscored —
Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary c…
-
Unscored —
Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file…
-
Unscored —CVE-2016-0857 EPSS 28%
Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code…
-
Unscored —
Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAcces…
-
Unscored —
Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial o…
-
Unscored —
Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of…
-
Unscored —
Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via u…
-
Unscored —CVE-2016-0856 EPSS 17%
Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary cod…
-
Unscored —
Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-d…
-
Unscored —CVE-2016-1898 EPSS 13%
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoc…
-
Unscored —CVE-2016-1897 EPSS 15%
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protoco…