Archive
13 February 2017
Vulnerabilities first published on this day (UTC), newest first.
124 results · Feed
-
Unscored —
An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Ver…
-
Unscored —
An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed usin…
-
Unscored —
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe…
-
Unscored —
An issue was discovered in Sielco Sistemi Winlog Lite SCADA Software, versions prior to Version 3.02.01, and Winlog Pro…
-
Unscored —CVE-2017-5146 Public exploit
An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Ver…
-
Unscored —
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. An INFORMATION EXPOSURE flaw …
-
Unscored —
An issue was discovered in Schneider Electric homeLYnk Controller, LSS100100, all versions prior to V1.5.0. The homeLYn…
-
Unscored —
An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Ver…
-
Unscored —
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Input sent from a malicious c…
-
Unscored —
An issue was discovered in Schneider Electric Wonderware Historian 2014 R2 SP1 P01 and earlier. Wonderware Historian cr…
-
Unscored —
An issue was discovered in Advantech WebAccess Version 8.1. By accessing a specific uniform resource locator (URL) on t…
-
Unscored —
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe…
-
Unscored —
An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Path Traversal vulner…
-
Unscored —
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe…
-
Unscored —
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe…
-
Unscored —
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Lack of authentication for re…
-
Unscored —
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. There is no CSRF Token genera…
-
Unscored —
An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Cross Site Request Fo…
-
Unscored —
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe…
-
Unscored —
An issue was discovered in VideoInsight Web Client Version 6.3.5.11 and previous versions. A SQL Injection vulnerabilit…
-
Unscored —
An issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. After an adm…
-
Unscored —
An issue was discovered in Advantech WebAccess Version 8.1. To be able to exploit the SQL injection vulnerability, an a…
-
Unscored —
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Users do not have any option …
-
Unscored —
click/install.py in click does not require files in package filesystem tarballs to start with ./ (dot slash), which all…
-
Unscored —
The generate_smb_nt_hash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary command…
-
Unscored —
libdwarf 20151114 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash)…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers…
-
Unscored —
install/index.php in Exponent CMS 2.3.9 allows remote attackers to execute arbitrary commands via shell metacharacters …
-
Unscored —
Samsung devices with Android KK(4.4), L(5.0/5.1), or M(6.0) allow attackers to cause a denial of service (system crash)…
-
Unscored —
Samsung devices with Android KK(4.4) or L(5.0/5.1) allow local users to cause a denial of service (IAndroidShm service …
-
Unscored —
The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate …
-
Unscored —
The timing attack protection in Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock in Crypto++ (ak…
-
Unscored —
The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and applica…
-
Unscored —
pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl c…
-
Unscored —
MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary co…
-
Unscored —
The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificate…
-
Unscored —
Multiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large numb…
-
Unscored —
Bubblewrap before 0.1.3 sets the PR_SET_DUMPABLE flag, which might allow local users to gain privileges by attaching to…
-
Unscored —
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the gi…
-
Critical 9.8
Froxlor guessable password reset token
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.