Archive
12 May 2017
Vulnerabilities first published on this day (UTC), newest first.
174 results · Feed
-
Unscored —
The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows local users t…
-
Unscored —
The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause…
-
Unscored —
In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unautho…
-
Unscored —
Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before 6.5.3…
-
Unscored —
Directory traversal vulnerability in download.php in Synology Photo Station before 6.5.3-3226 allows remote attackers t…
-
Unscored —CVE-2016-10329 EPSS 41%
Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to exe…
-
Unscored —
The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects t…
-
Unscored —
In all Android releases from CAF using the Linux kernel, while processing a voice SVC request which is nonstandard by s…
-
Unscored —
In function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel, prtd is assigned substrea…
-
Unscored —
In core_info_read and inst_info_read in all Android releases from CAF using the Linux kernel, variable "dbg_buf", "dbg_…
-
Unscored —
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign serve…
-
Unscored —
In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that t…
-
Critical 9.8
keycloak-connect and keycloak-js improperly handle invalid tokens
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.
-
Unscored —
It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before …
-
Unscored —
In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but no…
-
High 8.8
CSRF in baserCMS 3.0.10 and earlier
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
-
Unscored —
Cross-site scripting vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, S…
-
High 8.8
CSRF in baserCMS 3.0.10 and earlier
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
-
Unscored —
Cross-site scripting vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote authenticated attac…
-
Unscored —
Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk E…
-
Unscored —
Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk E…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijac…
-
Unscored —
The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward fo…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Feed version 3.0.10 and earlier allows remote attack…
-
Unscored —
Cross-site scripting vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to inject arbitrary w…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attack…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attack…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Uploader version 3.0.10 and earlier allows remote at…
-
Unscored —
Cross-site scripting vulnerability in Splunk Enterprise 6.3.x prior to 6.3.5 and Splunk Light 6.3.x prior to 6.3.5 allo…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijac…
-
Medium 6.1
ADOdb Cross-site scripting vulnerability in old test script
Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
-
High 8.8
baserCMS Cross Site Request Forgery vulnerability
Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
-
Unscored —
H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) v…
-
Unscored —
The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward fo…
-
Medium 5.4
baserCMS Cross-site Scripting vulnerability
Cross-site scripting vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
-
Unscored —
Cross-site scripting vulnerability in SOY CMS with installer 1.8.12 and earlier allows remote attackers to inject arbit…
-
Unscored —
Untrusted search path vulnerability in Installer for PrimeDrive Desktop Application version 1.4.4 and earlier allows re…
-
Unscored —
Directory traversal vulnerability in SOY CMS Ver.1.8.1 to Ver.1.8.12 allows authenticated attackers to read arbitrary f…
-
Unscored —
Untrusted search path vulnerability in installers for The Public Certification Service for Individuals "The JPKI user's…
-
Unscored —
Cross-site scripting vulnerability in Nessus versions 6.8.0, 6.8.1, 6.9.0, 6.9.1 and 6.9.2 allows remote authenticated …