Archive
10 May 2017
Vulnerabilities first published on this day (UTC), newest first.
31 results · Feed
-
Unscored —
In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a …
-
Unscored —
Cross-site scripting (XSS) vulnerability in OpenText Tempo Box 10.0.3 allows remote attackers to inject arbitrary web s…
-
Unscored —CVE-2017-8852 Public exploit
SAP SAPCAR 721.510 has a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted CAR archive fil…
-
Unscored —
A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12…
-
Unscored —CVE-2017-8890 Public exploit
The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attacker…
-
Unscored —
Dropbox Lepton 1.2.1 allows DoS (SEGV and application crash) via a malformed lepton file because the code does not ensu…
-
Unscored —
IBM Rational Quality Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary …
-
Unscored —
IBM Rational Team Concert (RTC) is vulnerable to HTML injection. A remote attacker with project administrator privilege…
-
Unscored —
IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav…
-
Unscored —
In F5 BIG-IP 11.2.1, 11.4.0 through 11.6.1, and 12.0.0 through 12.1.2, an unauthenticated user with access to the contr…
-
Unscored —
IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execu…
-
Unscored —
IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar…
-
Critical 9.8
Dolibarr SQL Injection in doli/theme/eldy/style.css.php via the lang parameter
Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter.
-
Critical 9.8
Dolibarr ERP and CRM Insecure Encryption
Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier.
-
Medium 6.1
Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter.
-
Unscored —
A Use After Free in the pdf2swf part of swftools 0.9.2 and earlier allows remote attackers to execute arbitrary code vi…
-
Unscored —
IBM WebSphere Application Server 8.0 and 8.5.5 could provide weaker than expected security. A remote attacker could exp…
-
Unscored —
IBM Team Concert (RTC) is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error whe…
-
Unscored —
Airwatch Agent for Android contains a vulnerability that may allow a device to bypass root detection. Successful exploi…
-
Unscored —
Airwatch Inbox for Android contains a vulnerability that may allow a rooted device to decrypt the local data used by th…
-
Medium 6.8
Dolibarr allows password changes without supplying the current password
Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation.
-
Unscored —
The TIFFWriteDirectoryTagCheckedRational function in tif_dirwrite.c in LibTIFF 4.0.6 allows remote attackers to cause a…
-
Unscored —
CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or log…
-
Unscored —
ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 allow remote authenticated users to discover the Wi…
-
Unscored —
acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to ac…
-
High 8.8
Mautic Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that (1) delete email campaigns or (2) delete contacts.
-
Critical 9.1
The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffe…
-
Unscored —
Symphony 2 2.6.11 has XSS in the meta[navigation_group] parameter to content/content.blueprintssections.php.
-
Unscored —
ASUS RT-AC* and RT-N* devices with firmware through 3.0.0.4.380.7378 allow JSONP Information Disclosure such as the SSI…
-
Unscored —
ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 have Login Page CSRF and Save Settings CSRF.
-
Unscored —
ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a networ…