Archive
15 May 2017
Vulnerabilities first published on this day (UTC), newest first.
29 results · Feed
-
Unscored —
IBM Jazz Foundation could allow an authenticated user to obtain sensitive information from stack traces. IBM X-Force ID…
-
Unscored —
IBM QRadar 7.2 and 7.3 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X…
-
Unscored —
IBM Distributed Marketing 8.6, 9.0, and 10.0 could allow a privileged authenticated user to create an instance that get…
-
Unscored —
OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over…
-
Unscored —
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large contro…
-
Unscored —
fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-befo…
-
Unscored —
An integer overflow error within the "foveon_load_camf()" function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before…
-
Unscored —
A boundary error within the "foveon_load_camf()" function (dcraw_foveon.c) when initializing a huffman table in LibRaw-…
-
Unscored —
The Interval International app 3.3 through 3.5.1 for iOS does not verify X.509 certificates from SSL servers, which all…
-
Unscored —
The Warner Bros. ellentube app 3.1.1 through 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which a…
-
Unscored —CVE-2017-8926 Public exploit
Buffer overflow in Halliburton LogView Pro 10.0.1 allows attackers to cause a denial of service or possibly have unspec…
-
Unscored —
The Life Before Us Yo app 2.5.8 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-mi…
-
Unscored —
The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle…
-
Unscored —
The MoboTap Dolphin Web Browser - Fast Private Internet Search app 9.23.0 through 9.23.2 for iOS does not verify X.509 …
-
Unscored —
The Quest Information Systems Indiana Voters app 1.1.24 for iOS does not verify X.509 certificates from SSL servers, wh…
-
Unscored —CVE-2017-8927 Public exploit
Buffer overflow in Larson VizEx Reader 9.7.5 allows attackers to cause a denial of service or possibly have unspecified…
-
Unscored —
The Zipongo - Healthy Recipes and Grocery Deals app before 6.3 for iOS does not verify X.509 certificates from SSL serv…
-
Unscored —
The YottaMark ShopWell - Healthy Diet & Grocery Food Scanner app 5.3.7 through 5.4.2 for iOS does not verify X.509 cert…
-
Unscored —
The Radio Javan app 9.3.4 through 9.6.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-i…
-
Critical 9.8CVE-2017-0252 EPSS 13%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory. aka "Scripting Engine Memory Corruption Vulnerability". This vulnerability is unique from CVE-2017-0223.
-
Critical 9.8CVE-2017-0223 EPSS 15%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory. aka "Scripting Engine Memory Corruption Vulnerability". This vulnerability is unique from CVE-2017-0252.
-
High 7.5
Exposure of Sensitive Information to an Unauthorized Actor in Apache Qpid Broker for Java
The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these Authenticati…
-
Medium 6.3
Moodle External blog editing takeover
In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.
-
Medium 5.3
Moodle Unauthorized searching of arbitrary blogs by typing full url
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.
-
Medium 4.3
Moodle Cross-Site Request Forgery (CSRF)
In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.
-
Unscored —
PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (application u…
-
Unscored —
Libmenu-cache 1.0.2 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (menu un…
-
Unscored —
In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari S…
-
Unscored —
Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected acti…