Archive
March 2017
Vulnerabilities first published in this month (UTC), newest first.
1,302 results · Feed
-
Unscored —
citymont/symetrie v.0.9.6 is vulnerable to a reflected XSS in symetrie-master/app/commands/page.php (model parameter).
-
Unscored —
TheFirstQuestion/HelpMeWatchWho before 2017-03-28 is vulnerable to a reflected XSS in HelpMeWatchWho-master/unaired.php…
-
Unscored —
Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local attac…
-
Unscored —CVE-2017-7374 Public exploit
Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of se…
-
Unscored —
illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons allowing a …
-
Unscored —
illumos smbsrv NULL pointer dereference allows system crash.
-
Unscored —
IBM Rational Quality Manager (RQM) 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows …
-
Unscored —
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to …
-
Unscored —
IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity…
-
Unscored —
IBM Rational Quality Manager 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users …
-
Unscored —
IBM Sterling Order Management 9.2 - 9.5 is vulnerable to cross-site request forgery which could allow an attacker to ex…
-
Unscored —
IBM Kenexa LMS on Cloud 13.1, 13.2, 13.2.2, 13.2.3, 13.2.4 and 14.0.0 are vulnerable to cross-site scripting. This vuln…
-
Unscored —
IBM Jazz Foundation is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when p…
-
Unscored —
IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaSc…
-
Unscored —
The IBM TRIRIGA Application Platform 3.3, 3,4, and 3,5 contain a vulnerability that could allow an authenticated user t…
-
Unscored —
IBM Algorithmics One-Algo Risk Application 4.9.1, 5.0, and 5.1.0 could allow a user to gain access to files in the loca…
-
High 7.5
An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of Lab…
-
Unscored —
Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.
-
Unscored —
The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. NOTE: this issue exists due…
-
Critical 9.8
fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory w…
KEV Jul 7, 2025 -
High 7.8
Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.
-
Unscored —
Snoopy allows remote attackers to execute arbitrary commands. NOTE: this vulnerability exists due to an incomplete fix …
-
Unscored —
-
Unscored —
-
Unscored —
Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitab…
-
Unscored —
Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitab…
-
Medium 4.8CVE-2017-7309 EPSS 63%
MantisBT vulnerable to XSS through config_option parameter in adm_config_report.php
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.…
-
Unscored —
Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack.
-
Unscored —
Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack.
-
Unscored —
Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack.
-
Unscored —
Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack.
-
Unscored —
Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack.
-
Medium 4.8
MantisBT XSS via move_attachments_page.php
A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) setting…
-
Medium 4.8
MantisBT XSS via adm_config_report.php's action parameter
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.
-
Unscored —
The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (…
-
Unscored —
There is Missing SSL Certificate Validation in the Trend Micro Enterprise Mobile Security Android Application before 9.…
-
Unscored —
The vmw_gb_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.7 …
-
Unscored —
Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1. Use the default low-privilege credentials to …
-
Unscored —
In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's configuration utilities for adding (and detect…
-
Unscored —
In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports w…