Archive
March 2017
Vulnerabilities first published in this month (UTC), newest first.
149 results · Clear filters · Feed
-
Unscored —CVE-2017-7374 Public exploit
Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of se…
-
Unscored —
Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.
-
Unscored —CVE-2017-6412 Public exploit
In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310.
-
Unscored —
In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports w…
-
Unscored —
A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.…
-
Unscored —
The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate ce…
-
Unscored —CVE-2009-5147 Public exploit
DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tai…
-
Unscored —
A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remo…
-
Unscored —CVE-2017-5671 Public exploit
Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x bef…
-
Unscored —CVE-2016-10225 Public exploit
The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privi…
-
Unscored —CVE-2017-7183 Public exploit
The TFTP server in ExtraPuTTY 0.30 and earlier allows remote attackers to cause a denial of service (crash) via a large…
-
Unscored —
The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large…
-
Medium 4.3CVE-2015-8309 Public exploit
Cherry Music directory traversal vulnerability
Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."
-
Unscored —
httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for…
-
Unscored —CVE-2017-5899 Public exploit
Directory traversal vulnerability in the setuid root helper binary in S-nail (later S-mailx) before 14.8.16 allows loca…
-
Critical 9.8
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 i…
KEV Nov 3, 2021 -
Critical 9.8
Moodle SQL injection via user preferences
In Moodle 2.x and 3.x, SQL injection can occur via user preferences.
-
Unscored —
An issue was discovered on Miele Professional PST10 devices. The corresponding embedded webserver "PST10 WebServer" typ…
-
Unscored —
Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.
-
Unscored —CVE-2017-6087 Public exploit
EyesOfNetwork ("EON") 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharact…
-
Unscored —
Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote aut…
-
Unscored —
The Konke Smart Plug K does not require authentication for TELNET sessions, which allows remote attackers to obtain "eq…
-
Unscored —
PHPMemcachedAdmin 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related "serializ…
-
Unscored —
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands v…
-
Unscored —CVE-2017-6191 Public exploit
Buffer overflow in APNGDis 2.8 and below allows a remote attacker to execute arbitrary code via a crafted filename.
-
Unscored —
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information…
-
Unscored —
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors.
-
Unscored —CVE-2017-5227 Public exploit
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information b…
-
Unscored —
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 have an error in privilege dropping and unnecessarily exec…
-
Unscored —
A buffer overflow vulnerability in Disk Sorter Enterprise 9.5.12 and earlier allows remote attackers to execute arbitra…
-
Unscored —
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary comm…
-
Unscored —CVE-2017-6970 Public exploit
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow local users to execute arbitrary commands in a privi…
-
High 7.1
Improper Input Validation in Apache Tomcat
The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted…
-
Unscored —CVE-2017-6178 Public exploit
The IofCallDriver function in USBPcap 1.1.0.0 allows local users to gain privileges via a crafted 0x00090028 IOCTL call…
-
Unscored —CVE-2017-6803 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds (formerl…
-
Unscored —CVE-2017-6550 Public exploit
Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitr…
-
Unscored —CVE-2017-6805 Public exploit
Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read …
-
Unscored —
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected a…
-
Unscored —CVE-2016-8855 Public exploit
Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experienc…
-
Unscored —CVE-2017-7184 Public exploit
The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certai…