Archive
21 April 2017
Vulnerabilities first published on this day (UTC), newest first.
47 results · Feed
-
Unscored —
The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validat…
-
Unscored —
Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates.
-
Unscored —
Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle at…
-
Unscored —
ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, whi…
-
Unscored —
Photopt for Android before 2.0.1 does not verify SSL certificates.
-
Unscored —
ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account an…
-
Unscored —
The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP p…
-
Unscored —
Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates.
-
Unscored —
The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which …
-
Unscored —
The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which all…
-
Unscored —
Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext …
-
Unscored —
Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain p…
-
Critical 9.8CVE-2016-3109 EPSS 28%
Shopware RCE Vulnerability
The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.
-
Critical 9.8CVE-2016-2173 Public exploit
Improper Input Validation in Spring AMQP
org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
-
Unscored —
The Broadcom Wi-Fi driver for Android, as used by BlackBerry smartphones before Build AAE570, allows remote attackers t…
-
Unscored —
Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote att…
-
Unscored —
The backtrack compilation code in the Irregex package (aka IrRegular Expressions) before 0.9.6 for Scheme allows remote…
-
Unscored —
Skia, as used in Google Chrome before 50.0.2661.94, allows remote attackers to bypass the Same Origin Policy and obtain…
-
Unscored —CVE-2016-5399 Public exploit
The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote atta…
-
Unscored —
Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulatio…
-
Unscored —
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI…
-
Unscored —
The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 allows remote attackers to cause a deni…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.
-
Unscored —
-
Unscored —
Information disclosure in Netgear WN604 before 3.3.3; WNAP210, WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0; and WND9…
-
Unscored —
Netgear WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0 reveal wireless passwords and administrative usernames and passw…
-
Unscored —
D-Link DAP-1353 H/W vers. B1 3.15 and earlier, D-Link DAP-2553 H/W ver. A1 1.31 and earlier, and D-Link DAP-3520 H/W ve…
-
Unscored —
Buffer overflow in D-Link DAP-2310 2.06 and earlier, DAP-2330 1.06 and earlier, DAP-2360 2.06 and earlier, DAP-2553 H/W…
-
Critical 9.8
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgea…
KEV Mar 25, 2022 -
Medium 5.4
Openstack Manila Persistent XSS in Metadata field
Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form.
-
Unscored —
Multiple stack-based buffer overflows in unrtf 0.21.9 allow remote attackers to cause a denial-of-service by writing a …
-
Unscored —
Android allows users to cause a denial of service.
-
Unscored —
Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates.
-
Unscored —
Cybozu Garoon before 4.2.1 allows remote attackers to cause a denial of service.
-
Unscored —
Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.
-
Unscored —
Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer before 3.7.8.2.
-
Unscored —
Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers.
-
Unscored —
WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates.
-
Unscored —
Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates.
-
Unscored —
Coordinate Plus App for Android 1.0.2 and earlier and Coordinate Plus App for iOS 1.0.2 and earlier do not verify SSL c…