Archive
12 April 2017
Vulnerabilities first published on this day (UTC), newest first.
154 results · Feed
-
Unscored —
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SLSK dissector could go into an infinite loop, triggered by packet…
-
Unscored —
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the IMAP dissector could crash, triggered by packet injection or a mal…
-
Unscored —
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the PacketBB dissector could crash, triggered by packet injection or a…
-
Unscored —
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the RPC over RDMA dissector could go into an infinite loop, triggered …
-
Unscored —
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the NetScaler file parser could go into an infinite loop, triggered by…
-
Unscored —
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WSP dissector could go into an infinite loop, triggered by packet …
-
Unscored —
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the BGP dissector could go into an infinite loop, triggered by packet …
-
Unscored —
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WBXML dissector could go into an infinite loop, triggered by packe…
-
Unscored —
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SIGCOMP dissector could go into an infinite loop, triggered by pac…
-
Unscored —
In Wireshark 2.2.0 to 2.2.5, the DOF dissector could go into an infinite loop, triggered by packet injection or a malfo…
-
Critical 9.8CVE-2015-7564 Public exploit
TeamPass vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) c…
-
Medium 6.1CVE-2015-7562 Public exploit
TeamPass vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) label value of an item or (2) name of a role.
-
Unscored —CVE-2015-7563 Public exploit
Cross-site request forgery (CSRF) vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the au…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the standard template of the comment functionality in appleple a-blog cms 2…
-
Unscored —
The session management of the comment functionality in appleple a-blog cms 2.6.0.1 and earlier allows remote attackers …
-
Unscored —
SQL injection vulnerability in the SetsucoCMS all versions allows remote authenticated attackers to execute arbitrary S…
-
Unscored —
SetsucoCMS all versions allows remote attackers to cause a denial of service via unspecified vectors.
-
Unscored —CVE-2016-4337 Public exploit
SQL injection vulnerability in the mgr.login.php file in Ktools.net Photostore before 4.7.5 allows remote attackers to …
-
Unscored —
SetsucoCMS all versions allows remote authenticated attackers to conduct code injection attacks via unspecified vectors.
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in SetsucoCMS all versions allows remote attackers to hijack the authen…
-
Unscored —
SetsucoCMS all versions does not properly manage sessions, which allows remote attackers to disclose or alter unauthori…
-
Unscored —
Cross-site scripting vulnerability in SetsucoCMS all versions allows remote attackers to inject arbitrary web script or…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in (1) filter/save_forward.cgi, (2) filter/save.cgi, (3) /man/searc…
-
Medium 6.1
JacksonJsonpInterceptor susceptible to cross-site script inclusion (XSSI) attack
JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack.
-
Unscored —
Cross-site scripting (XSS) vulnerability in the dependency graphs in Bugzilla 2.16rc1 through 4.4.11, and 4.5.1 through…
-
Unscored —
Symantec Web Gateway (SWG) before 5.2.5 allows remote authenticated users to execute arbitrary OS commands.
-
Unscored —
Drivers/soc/qcom/spcom.c in the Qualcomm SPCom driver in the Android kernel 2017-03-05 allows local users to gain privi…
-
Unscored —
An attacker that has hijacked a Unitrends Enterprise Backup (before 9.1.2) web server session can leverage api/includes…
-
Unscored —
An unprivileged user of the Unitrends Enterprise Backup before 9.0.0 web server can escalate to root privileges by modi…
-
Unscored —
An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not prop…
-
Unscored —
An issue was discovered in Unitrends Enterprise Backup before 9.1.2. A lack of sanitization of user input in the create…
-
High 7.5
OpenStack Nova-LXD bypass security restrictions
OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.
-
Unscored —
Stack-based buffer overflow in native/mod_manager/node.c in mod_cluster 1.2.9.
-
Unscored —CVE-2016-6808 EPSS 23%
Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.
-
Unscored —
game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations.
-
Unscored —
game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.
-
Unscored —
Stack-based buffer overflow in game-music-emu before 0.6.1.
-
Unscored —
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2…
-
High 7.5
An exploitable Cross-Site Request Forgery vulnerability exists in the Web Application functionality of Moxa AWK-3131A W…
-
High 7.5
An exploitable Cleartext Transmission of Password vulnerability exists in the Web Application functionality of Moxa AWK…