Archive
May 2017
Vulnerabilities first published in this month (UTC), newest first.
1,010 results · Feed
-
Unscored —
VMware Horizon DaaS before 7.0.0 contains a vulnerability that exists due to insufficient validation of data. An attack…
-
Unscored —
There is an escalation of privilege vulnerability in the Intel Solid State Drive Toolbox versions before 3.4.5 which al…
-
Unscored —
PivotX 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .hta…
-
Unscored —
The readString function in util/read.c and util/old/read.c in libming 0.4.8 allows remote attackers to cause a denial o…
-
Unscored —
SSRF vulnerability in remotedownload.php in Allen Disk 1.6 allows remote authenticated users to conduct port scans and …
-
Unscored —
lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via…
-
Unscored —
inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of…
-
Unscored —
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption…
-
Critical 9.8
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, all…
KEV Mar 30, 2023 -
Unscored —
poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted…
-
Unscored —
Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resultin…
-
High 7.5
org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service vulnerable to Improper Certificate Validation
Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't…
-
Unscored —
On Juniper Networks Junos Space versions prior to 16.1R1 when certificate based authentication is enabled for the Junos…
-
Unscored —
On Juniper Networks Junos Space versions prior to 16.1R1, an unauthenticated remote attacker with network access to Jun…
-
Unscored —
On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on…
-
Unscored —
On Juniper Networks products or platforms running Junos OS 12.1X46 prior to 12.1X46-D50, 12.1X47 prior to 12.1X47-D40, …
-
Unscored —
A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions…
-
Unscored —
On Juniper Networks products or platforms running Junos OS 11.4 prior to 11.4R13-S3, 12.1X46 prior to 12.1X46-D60, 12.3…
-
Unscored —
On Juniper Networks products or platforms running Junos OS 12.1X46 prior to 12.1X46-D55, 12.1X47 prior to 12.1X47-D45, …
-
Unscored —
An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an au…
-
Unscored —
On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on…
-
Unscored —
A firewall bypass vulnerability in the host based firewall of Juniper Networks Junos Space versions prior to 16.1R1 may…
-
Unscored —
Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices running Junos OS 14.1X53 prior to 14.1X5…
-
Unscored —
On Juniper Networks SRX Series Services Gateways chassis clusters running Junos OS 12.1X46 prior to 12.1X46-D65, 12.3X4…
-
Medium 6.1
Laravel does not properly constrain the host portion of a password-reset URL
Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.
-
Unscored —
e107 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107_admin/menus.p…
-
Unscored —
The VirtueMart com_virtuemart component 3.0.14 for Joomla! allows SQL injection by remote authenticated administrators …
-
Unscored —
Open Ticket Request System (OTRS) 3.3.9 has XSS in index.pl?Action=AgentStats requests, as demonstrated by OrderBy=[XSS…
-
Unscored —
plugins\codec\libflac_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of servic…
-
Unscored —
plugins\audio_filter\libmpgatofixed32_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a …
-
Unscored —
RealPlayer 16.0.2.32 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) …
-
Unscored —
Open Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 allows remote attackers to redirect users to arbi…
-
Unscored —
RMI vulnerability in Hitachi Device Manager before 8.5.2-01 allows remote attackers to execute internal commands withou…
-
Unscored —
XXE vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Replication Manager before 8.5.2-00 allows auth…
-
Unscored —
Cross-site scripting vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Replication Manager before 8.5…
-
Unscored —
Open Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Tuning Manager before 8.5.2-00 allows…
-
Unscored —
Bram Korsten Note through 1.2.0 is vulnerable to a reflected XSS in note-source\ui\editor.php (edit parameter).
-
Unscored —
The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before…
-
Unscored —
Lansweeper before 6.0.0.65 has XSS in an image retrieval URI, aka Bug 542782.
-
Unscored —
A Cross-Site Request Forgery issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous ver…