Archive
18 May 2017
Vulnerabilities first published on this day (UTC), newest first.
41 results · Feed
-
Unscored —
A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote …
-
Unscored —
A vulnerability in a script file that is installed as part of the Cisco Policy Suite (CPS) Software distribution for th…
-
Unscored —
A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote a…
-
Unscored —
A vulnerability in the web framework of the Cisco TelePresence IX5000 Series could allow an unauthenticated, remote att…
-
Unscored —
A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, and 5.1.3 a…
-
Unscored —
Two CalendarXP products have XSS in common parts of HTML files. CalendarXP FlatCalendarXP through 9.9.290 has XSS in if…
-
Medium 6.1
MODX Revolution Reflected XSS
In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the database_type parameter.
-
High 8.8
MODX Revolution allows overwriting .htaccess
In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess.
-
Medium 4.7
MODX Revolution XSS via HTTP Host header
In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning.
-
High 7.0
MODX Revolution Directory Traversal Vulnerability
In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.
-
Medium 5.4
MODX Revolution cross-site scripting vulnerability
In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php.
-
Unscored —
It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to…
-
Unscored —
An absolute path traversal vulnerability (CWE-36) in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated a…
-
Unscored —
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files…
-
Unscored —
In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialo…
-
Unscored —
In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.
-
Unscored —
In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.
-
Unscored —
In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
-
Unscored —
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an in…
-
Unscored —
Ipswitch MOVEit Transfer (formerly DMZ) allows pre-authentication blind SQL injection. The fixed versions are MOVEit Tr…
-
Unscored —
Facebook WhatsApp Messenger before 2.16.323 for Android uses the SD card for cleartext storage of files (Audio, Documen…
-
Unscored —
A vulnerability in MikroTik Version 6.38.5 could allow an unauthenticated remote attacker to exhaust all available CPU …
-
High 7.5
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey functio…
-
Unscored —
An issue, also known as DW201703-006, was discovered in libdwarf 2017-03-21. A heap-based buffer over-read in dwarf_for…
-
High 7.5
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementCont…
-
Unscored —
libav before 12.1 is vulnerable to an invalid read of size 1 due to NULL pointer dereferencing in the nsv_read_chunk fu…
-
Unscored —
The NFSv4 implementation in the Linux kernel through 4.11.1 allows local users to cause a denial of service (resource c…
-
Unscored —
A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in vali…
-
Unscored —
In libytnef in ytnef through 1.9.2, there is a heap-based buffer over-read due to incorrect boundary checking in the SI…
-
High 7.5
Out-of-bounds read in nokogiri
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix f…
-
Unscored —
The Google I/O 2017 application before 5.1.4 for Android downloads multiple .json files from http://storage.googleapis.…
-
Unscored —
An issue, also known as DW201703-005, was discovered in libdwarf 2017-03-21. A heap-based buffer over-read in _dwarf_re…
-
Unscored —
An issue, also known as DW201703-001, was discovered in libdwarf 2017-03-21. In dwarf_formsdata() a few data types were…
-
Unscored —
An issue, also known as DW201703-002, was discovered in libdwarf 2017-03-21. In _dwarf_decode_s_leb128_chk() a byte poi…
-
Unscored —
GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application cra…
-
Unscored —
readelf.c in GNU Binutils 2017-04-12 has a "shift exponent too large for type unsigned long" issue, which might allow r…
-
Unscored —
GNU Binutils 2017-04-03 allows remote attackers to cause a denial of service (NULL pointer dereference and application …
-
Unscored —
GNU Binutils 2.28 allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file with…
-
Unscored —
GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application cra…
-
Unscored —
The print_symbol_for_build_attribute function in readelf.c in GNU Binutils 2017-04-12 allows remote attackers to cause …