Archive
10 April 2017
Vulnerabilities first published on this day (UTC), newest first.
98 results · Feed
-
Unscored —
Privilege escalation in Lenovo Customer Care Software Development Kit (CCSDK) versions earlier than 2.0.16.3 allows loc…
-
Unscored —
Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitr…
-
Unscored —
SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to execute arbitrary commands.
-
Unscored —CVE-2017-7648 Public exploit
Foscam networked devices use the same hardcoded SSL private key across different customers' installations, which allows…
-
Unscored —
SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to browse the server's filesyst…
-
Unscored —
Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell …
-
Unscored —
Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synop…
-
Unscored —
The iwmiffr_convert_row32 function in imagew-miff.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attacker…
-
Unscored —
The iw_read_bmp_file function in imagew-bmp.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to c…
-
Unscored —
In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/app_theme/libs…
-
Unscored —
dde-daemon, the daemon process of DDE (Deepin Desktop Environment) 15.0 through 15.3, runs with root privileges and har…
-
Unscored —
dwarf_macro5.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereferen…
-
Unscored —
botan before 1.11.22 improperly validates certificate paths, which allows remote attackers to cause a denial of service…
-
Unscored —
botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers …
-
Unscored —
botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle at…
-
Unscored —
The Curve25519 code in botan before 1.11.31, on systems without a native 128-bit integer type, might allow attackers to…
-
Unscored —
The X509_Certificate::allowed_usage function in botan 1.11.x before 1.11.31 might allow attackers to have unspecified i…
-
Unscored —
Stack-based buffer overflow in SAP NetWeaver 7.0 through 7.5 allows remote attackers to cause a denial of service () by…
-
Unscored —
Buffer overflow in the MobiLink Synchronization Server component in SAP SQL Anywhere 17 and possibly earlier allows rem…
-
Unscored —
Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embe…
-
Unscored —
The (1) v9fs_create and (2) v9fs_lcreate functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS pr…
-
Unscored —
NetApp OnCommand Performance Manager and OnCommand Unified Manager for Clustered Data ONTAP before 7.1P1 improperly bin…
-
Unscored —
Ninka before 1.3.2 might allow remote attackers to obtain sensitive information, manipulate license compliance scan res…
-
Unscored —
NetApp Clustered Data ONTAP 8.1 through 9.1P1, when NFS or SMB is enabled, allows remote attackers to cause a denial of…
-
Unscored —CVE-2017-5607 Public exploit
Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.…
-
Unscored —
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer,…
-
Unscored —
In KeePassX before 0.4.4, a cleartext copy of password data is created upon a cancel of an XML export action. This allo…
-
Unscored —
Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization.
-
Critical 9.8
web2py is vulnerable to password brute-force attack
web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
-
Unscored —
The SAP EP-RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to cause a denial of servic…
-
Unscored —
In ImageMagick 7.0.4-9, an infinite loop can occur because of a floating-point rounding error in some of the color algo…
-
Unscored —
Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel through 4…
-
Unscored —
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asteri…
-
Unscored —
crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to cause a denial of service (API operation calling …
-
Unscored —
Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allow…
-
Unscored —
Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a de…
-
Unscored —
Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows directory traversal.
-
Unscored —
Dell Integrated Remote Access Controller (iDRAC) 6 before 2.85 and 7/8 before 2.30.30.30 has XSS.
-
Unscored —
Stack-based buffer overflow in the havok_write function in drivers/staging/havok/havok.c in Amazon Fire OS before 2016-…
-
Unscored —
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass…