Archive
14 April 2017
Vulnerabilities first published on this day (UTC), newest first.
60 results · Feed
-
Unscored —CVE-2016-0727 Public exploit
The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3u…
-
Unscored —
The web interface in Red Hat QuickStart Cloud Installer (QCI) 1.0 does not mask passwords fields, which allows physical…
-
Unscored —
sudo_noexec.so in Sudo before 1.8.15 on Linux might allow local users to bypass intended noexec command restrictions vi…
-
High 8.6
jackson-dataformat-xml vulnerable to server side request forgery (SSRF)
XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.
-
Unscored —
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtige…
-
Unscored —
Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to in…
-
Unscored —
ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by lev…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the IVYWE (1) Assist plugin before 1.1.2.test20160906, (2) dataB…
-
Unscored —
The Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses weak permissions (755) f…
-
Unscored —
ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for…
-
Unscored —
The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileg…
-
Unscored —
The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side chann…
-
Unscored —
mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service (memory …
-
Unscored —
The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of servic…
-
Unscored —
Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote a…
-
Unscored —CVE-2016-5310 Public exploit
The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP);…
-
Unscored —CVE-2016-5309 Public exploit
The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP);…
-
Unscored —
SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 all…
-
Unscored —
CSRF vulnerability in flatCore version 1.4.6 allows remote attackers to modify CMS configurations.
-
Unscored —
In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to tr…
-
Unscored —CVE-2017-7690 Public exploit
Proxifier for Mac before 2.19.2, when first run, allows local users to gain privileges by replacing the KLoader binary …
-
Unscored —
Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arb…
-
Unscored —CVE-2017-7188 Public exploit
Zurmo 3.1.1 Stable allows a Cross-Site Scripting (XSS) attack with a base64-encoded SCRIPT element within a data: URL i…
-
Unscored —
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read and write to the users database.
-
Unscored —CVE-2017-7696 EPSS 36%
SAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial of service (memory cons…
-
Unscored —
trollepierre/tdm before 2017-04-13 is vulnerable to a reflected XSS in tdm-master/webhook.php (challenge parameter).
-
Unscored —
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database.
-
Unscored —
pmmasterd in Quest Privilege Manager before 6.0.0.061, when configured as a policy server, allows remote attackers to w…
-
Unscored —
Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin/plugin/file_manager/browse…
-
Unscored —
Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse…
-
Unscored —
IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site scripting. This vulnerabi…
-
Unscored —
IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to read system files or…
-
Unscored —
IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to include arbitrary fi…
-
Unscored —
IBM Platform LSF 10.1 contains an unspecified vulnerability that could allow a local user to escalate their privileges …
-
Unscored —
IBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with each request, which could…
-
Unscored —CVE-2015-8356 Public exploit
Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated …
-
Unscored —
Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control.
-
Unscored —
The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to gain privil…
-
Unscored —CVE-2017-7457 Public exploit
XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure.
-
Unscored —
Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView…