Archive
April 2017
Vulnerabilities first published in this month (UTC), newest first.
165 results · Clear filters · Feed
-
Unscored —
ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account an…
-
Critical 9.8CVE-2016-2173 Public exploit
Improper Input Validation in Spring AMQP
org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
-
Unscored —CVE-2016-5399 Public exploit
The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote atta…
-
Unscored —
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI…
-
Critical 9.8
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgea…
KEV Mar 25, 2022 -
Unscored —CVE-2015-8285 Public exploit
The webssx.sys driver in QuickHeal 16.00 allows remote attackers to cause a denial of service.
-
Unscored —
SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via …
-
Medium 6.6CVE-2017-7938 Public exploit
Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to ca…
-
Unscored —CVE-2017-7896 Public exploit
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS.
-
Critical 9.8
Deserialization of Untrusted Data in Log4j
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras.
-
High 8.8
MantisBT allows arbitrary password reset
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
-
Unscored —CVE-2016-0727 Public exploit
The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3u…
-
Unscored —
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtige…
-
Unscored —
Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote a…
-
Unscored —CVE-2016-5310 Public exploit
The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP);…
-
Unscored —CVE-2016-5309 Public exploit
The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP);…
-
Unscored —CVE-2017-7690 Public exploit
Proxifier for Mac before 2.19.2, when first run, allows local users to gain privileges by replacing the KLoader binary …
-
Unscored —CVE-2017-7188 Public exploit
Zurmo 3.1.1 Stable allows a Cross-Site Scripting (XSS) attack with a base64-encoded SCRIPT element within a data: URL i…
-
Unscored —
pmmasterd in Quest Privilege Manager before 6.0.0.061, when configured as a policy server, allows remote attackers to w…
-
Unscored —
Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin/plugin/file_manager/browse…
-
Unscored —
Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse…
-
Unscored —CVE-2015-8356 Public exploit
Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated …
-
Unscored —
Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control.
-
Unscored —CVE-2017-7457 Public exploit
XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure.
-
Unscored —
Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView…
-
Unscored —CVE-2017-7643 Public exploit
Proxifier for Mac before 2.19 allows local users to gain privileges via the first parameter to the KLoader setuid progr…
-
Medium 6.1CVE-2017-7725 Public exploit
Concrete CMS vulnerable to cross-site scripting (XSS)
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain na…
-
Unscored —CVE-2014-7920 Public exploit
mediaserver in Android 2.2 through 5.x before 5.1 allows attackers to gain privileges. NOTE: This is a different vulner…
-
Unscored —CVE-2015-8284 Public exploit
SeaWell Networks Spectrum SDC 02.05.00 allows remote viewer users to perform administrative functions.
-
Unscored —CVE-2015-8283 Public exploit
Directory traversal vulnerability in configure_manage.php in SeaWell Networks Spectrum SDC 02.05.00.
-
Unscored —CVE-2015-8282 Public exploit
SeaWell Networks Spectrum SDC 02.05.00 has a default password of "admin" for the "admin" account.
-
Unscored —CVE-2016-1915 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in BlackBerry Enterprise Server 12 (BES12) Self-Service before 12.4…
-
Unscored —CVE-2016-1914 Public exploit
Multiple SQL injection vulnerabilities in the com.rim.mdm.ui.server.ImageServlet servlet in BlackBerry Enterprise Serve…
-
Unscored —
SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arb…
-
Critical 9.8CVE-2015-7564 Public exploit
TeamPass vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) c…
-
Medium 6.1CVE-2015-7562 Public exploit
TeamPass vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) label value of an item or (2) name of a role.
-
Unscored —CVE-2015-7563 Public exploit
Cross-site request forgery (CSRF) vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the au…
-
Unscored —CVE-2016-4337 Public exploit
SQL injection vulnerability in the mgr.login.php file in Ktools.net Photostore before 4.7.5 allows remote attackers to …
-
Unscored —
In SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4, a menu system is encountered when the SSH service is acc…