Archive
January 2016
Vulnerabilities first published in this month (UTC), newest first.
669 results · Feed
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Secure Data Space SDS-API before 3.5.7 allow remote attackers to…
-
Unscored —
zarafa-autorespond in Zarafa Collaboration Platform (ZCP) before 7.2.1 allows local users to gain privileges via a syml…
-
Unscored —
Memory leak in Huawei eSpace 8950 IP phones with software before V200R003C00SPC300 allows remote attackers to cause a d…
-
Unscored —
Huawei eSpace 7910 and 7950 IP phones with software before V200R002C00SPC800 allow remote attackers with established se…
-
Unscored —
The Operation and Maintenance Unit (OMU) in Huawei VCN500 with software before V100R002C00SPC200 does not properly inva…
-
Unscored —
The Operation and Maintenance Unit (OMU) in Huawei VCN500 with software before V100R002C00SPC200 allows remote authenti…
-
Unscored —
Huawei VCN500 with software before V100R002C00SPC201 logs passwords in cleartext, which allows remote authenticated use…
-
Unscored —
IBM WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.6 and IBM Integration Bus 9 before 9.0.0.3 and 10 befo…
-
Unscored —
Untrusted search path vulnerability in Apple OS X before 10.11.1 allows local users to bypass intended Gatekeeper restr…
-
Unscored —
Directory Utility in Apple OS X before 10.11.1 mishandles authentication for new sessions, which allows local users to …
-
Unscored —
libxml2 in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to obtain sensitive i…
-
Unscored —
Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote au…
-
Unscored —
libxml2 in Apple iOS before 9.2, OS X before 10.11.2, and tvOS before 9.1 allows remote attackers to obtain sensitive i…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0…
-
Unscored —
Multiple open redirect vulnerabilities in the Aurora starter store in IBM WebSphere Commerce 7.0 through Feature Pack 8…
-
Unscored —
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory cor…
-
Unscored —
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory cor…
-
Unscored —
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based…
-
Unscored —
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory cor…
-
Unscored —
Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x be…
-
Unscored —
Heap-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.09 allows remote attackers to execute arbitrary …
-
Unscored —
Advantech EKI-132x devices with firmware before 2015-12-31 allow remote attackers to bypass authentication via unspecif…
-
Unscored —
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory cor…
-
Unscored —
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory cor…
-
Unscored —
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory cor…
-
Unscored —
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory cor…
-
Unscored —
Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory cor…
-
Unscored —
The VMware Tools HGFS (aka Shared Folders) implementation in VMware Workstation 11.x before 11.1.2, VMware Player 7.x b…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the internationalization feature in the default homescreen app in Mozilla F…
-
Unscored —
The lockscreen feature in Mozilla Firefox OS before 2.5 does not properly restrict failed authentication attempts, whic…
-
Unscored —
Race condition in the lockscreen feature in Mozilla Firefox OS before 2.5 allows physically proximate attackers to bypa…
-
Unscored —
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remo…
-
Critical 10.0
colorscore Command Injection vulnerability
The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth varia…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.6.3 allow remote attackers to inject arbitrary we…
-
Medium 6.1
Symphony CMS XSS Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) email_sendmail[from_name], (2) email_sendmail[from_address], (3…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attac…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the Titan Framework plugin before 1.6 for WordPress allow remote…
-
Unscored —
ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain se…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Field Group module 7.x-1.x before 7.x-1.5 for Drupal allows remote auth…
-
Unscored —
ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information vi…