Archive
April 2017
Vulnerabilities first published in this month (UTC), newest first.
1,569 results · Feed
-
Unscored —
Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitr…
-
Unscored —
WNC01WH firmware 1.0.0.9 and earlier allows authenticated attackers to execute arbitrary OS commands via unspecified ve…
-
Unscored —
Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote code execution via …
-
Unscored —
TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlie…
-
Unscored —
Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Phone Messages funct…
-
Unscored —
Cross-site scripting vulnerability in ASSETBASE 8.0 and earlier allows remote attackers to inject arbitrary web script …
-
Unscored —
CS-Cart Japanese Edition v4.3.10-jp-1 and earlier, CS-Cart Multivendor Japanese Edition v4.3.10-jp-1 and earlier allows…
-
Unscored —
Buffer overflow in WN-G300R3 firmware Ver.1.03 and earlier allows remote attackers to execute arbitrary OS commands via…
-
Unscored —
Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.1 and earlier allows remote attackers to conduc…
-
Critical 9.8
smalruby and smalruby-editor vulnerable to OS Command Injection
smalruby-editor v0.4.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
-
Unscored —
Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitr…
-
Unscored —
Cross-site scripting vulnerability in OneThird CMS v1.73 Heaven's Door and earlier allows remote attackers to inject ar…
-
Unscored —
Cross-site scripting vulnerability in WN-AC1167GR firmware version 1.04 and earlier allows remote authenticated attacke…
-
Unscored —
CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and ea…
-
Unscored —
Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp"…
-
Unscored —
The Business LaLa Call App for Android 1.4.7 and earlier does not verify X.509 certificates from SSL servers, which all…
-
Unscored —
Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inject arbitr…
-
Unscored —
The LaLa Call App for Android 2.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-i…
-
Unscored —
Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arb…
-
Unscored —
Multiple cross-site scripting vulnerabilities in Webmin versions prior to 1.830 allows remote attackers to inject arbit…
-
Unscored —
Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary…
-
Unscored —
Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer version Ver. 3.7.13 and earl…
-
Unscored —
Untrusted search path vulnerability in PrimeDrive Desktop Application 1.4.3 and earlier allows remote attackers to gain…
-
Unscored —
Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in the mail function le…
-
Unscored —
Untrusted search path vulnerability in Self-extracting archive files created by 7-ZIP32.DLL 9.22.00.01 and earlier allo…
-
Unscored —
Cross-site scripting vulnerability in YOP Poll versions prior to 5.8.1 allows remote attackers to inject arbitrary web …
-
Unscored —
Privilege escalation vulnerability in CentreCOM AR260S V2 remote authenticated attackers to gain privileges via the gue…
-
Unscored —
Security guide for website operators allows remote attackers to execute arbitrary OS commands via specially crafted sav…
-
Unscored —
Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to inject arbi…
-
Unscored —
Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arb…
-
Unscored —
The Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509 certificates from SSL s…
-
Unscored —
Untrusted search path vulnerability in installers of the software for SDHC/SDXC Memory Card with embedded NFC functiona…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Knowledge versions prior to v1.7.0 allows remote attackers to hijack…
-
Unscored —CVE-2017-7895 EPSS 11%
The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buf…
-
Unscored —
The UDFclient (before 0.8.8) custom strlcpy implementation has a buffer overflow. UDFclient's strlcpy is used only on s…
-
Unscored —
In Avast Antivirus before v17, an unprivileged user (and thus malware or a virus) can mark an arbitrary process as Trus…
-
Unscored —
In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible …
-
Unscored —
Mura CMS 7.0.6967 allows admin/?muraAction= XSS attacks, related to admin/core/views/carch/list.cfm, admin/core/views/c…
-
Unscored —
LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied upon for a later check of…
-
Medium 5.4
Canvs Canvas Cross-site Scripting (XSS) via title and content fields
cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts > Add New" action, and during creation of new tags and users.