Archive
January 2017
Vulnerabilities first published in this month (UTC), newest first.
1,083 results · Feed
-
Unscored —
tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file…
-
Unscored —
The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds re…
-
Unscored —
libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a craft…
-
Unscored —
Use-after-free vulnerability in the Samsung Exynos fimg2d driver for Android with Exynos 5433, 54xx, or 7420 chipsets a…
-
Unscored —
Artifex Software MuJS allows attackers to cause a denial of service (crash) via vectors related to incomplete escape se…
-
Unscored —
SQL injection vulnerability in Posts.class.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary S…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the user prompt function in GeniXCMS through 0.0.8 allows remote authentica…
-
Unscored —
The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to conduct SSRF attacks via a URL, as d…
-
Unscored —
SQL injection vulnerability in author.control.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrar…
-
High 8.1
An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, …
KEV Sep 8, 2022 -
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers …
-
Unscored —
The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uplo…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the a…
-
Medium 5.5CVE-2017-5223 Public exploit
Local file disclosure in PHPMailer
An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script…
-
Unscored —
Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote a…
-
Unscored —
arch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local users to obtain sensitive information from kernel…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.…
-
Unscored —
wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofe…
-
Unscored —
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 befor…
-
Unscored —
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random n…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote …
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authent…
-
Unscored —CVE-2016-8206 EPSS 15%
A Directory Traversal vulnerability in servlet SoftwareImageUpload in the Brocade Network Advisor versions released pri…
-
Unscored —
A CSRF vulnerability in Brocade Virtual Traffic Manager versions released prior to and including 11.0 could allow an at…
-
Unscored —
A Directory Traversal vulnerability in FileReceiveServlet in the Brocade Network Advisor versions released prior to and…
-
Unscored —CVE-2016-8207 EPSS 15%
A Directory Traversal vulnerability in CliMonitorReportServlet in the Brocade Network Advisor versions released prior t…
-
Unscored —CVE-2016-8205 EPSS 13%
A Directory Traversal vulnerability in DashboardFileReceiveServlet in the Brocade Network Advisor versions released pri…
-
Unscored —
An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages. (The scope o…
-
Unscored —
Open redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers to redirect users to ar…
-
Unscored —
Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin.
-
Unscored —CVE-2017-5473 Public exploit
Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authenticat…
-
Unscored —
comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments.
-
High 8.8
Shell command injection in Liferay Portal
Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.
-
Unscored —CVE-2016-7426 EPSS 12%
NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations i…
-
Unscored —
NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecifie…
-
Unscored —
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a cra…
-
Unscored —
The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a den…
-
Unscored —
NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows rem…