Archive
17 April 2017
Vulnerabilities first published on this day (UTC), newest first.
32 results · Feed
-
Unscored —
IBM Marketing Platform 10.0 could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulne…
-
Unscored —
IBM Cognos TM1 10.1 and 10.2 is vulnerable to a denial of service, caused by a stack-based buffer overflow when parsing…
-
Unscored —
IBM Cognos TM1 10.1 and 10.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary …
-
Unscored —
IBM Cognos TM1 10.1 and 10.2 provides a service to return the victim's password with a valid session key. An authentica…
-
Unscored —
Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can tr…
-
Unscored —
IBM API Connect 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system, caused by improper v…
-
Unscored —
IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.0.x is vulnerable to cross-site scripting. Th…
-
Critical 9.8
Deserialization of Untrusted Data in Log4j
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
-
Unscored —
Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.
-
Unscored —
Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked enc…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras.
-
Unscored —
chain_sip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 a…
-
Unscored —
Unspecified vulnerability in Qualcomm components in Android on Nexus 6 and Android One devices.
-
Unscored —
The Qualcomm GPS subsystem in Android on Android One devices allows remote attackers to execute arbitrary code.
-
Critical 9.8
Expected Behavior Violation in Apache Tomcat
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the process…
-
High 7.5CVE-2017-5647 EPSS 17%
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing …
-
High 7.5
Improper Resource Shutdown or Release in Apache Tomcat
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write …
-
Critical 9.1CVE-2017-5648 EPSS 13%
Exposure of Resource to Wrong Sphere in Apache Tomcat
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted appli…
-
Unscored —
Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to conduct a "reflected file download" attack.
-
Unscored —
Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email…
-
Unscored —
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of …
-
Unscored —
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restriction to view unauthorized p…
-
Unscored —
Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment var…
-
Unscored —
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to execute unintended operations via the Project fu…
-
Unscored —
Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to inject arb…
-
Unscored —
Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to injec…
-
Unscored —
Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to injec…
-
Unscored —
Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to cause a denial of service.
-
Unscored —
sourcebans-pp (SourceBans++) 1.5.4.7 has XSS in admin.comms.php via the rebanid parameter.
-
Unscored —
lz4-compress is unmaintained
[According to the developers](https://gitlab.redox-os.org/redox-os/tfs/issues/89) this crate is no longer maintained. The suggested alternative is [`lz4-compression`](https://crates.io/crates/lz4-compression), a maintained fork of `lz4-compress`. See also [lz…
-
Unscored —
Artifex jbig2dec 0.13 has a heap-based buffer over-read leading to denial of service (application crash) or disclosure …
-
Unscored —
The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanis…