Archive
May 2017
Vulnerabilities first published in this month (UTC), newest first.
1,010 results · Feed
-
Unscored —
In QSEE in all Android releases from CAF using the Linux kernel access control may potentially be bypassed due to a pag…
-
Unscored —
The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary …
-
Unscored —
In TrustZone access control policy may potentially be bypassed in all Android releases from CAF using the Linux kernel …
-
Unscored —
A time-of-check time-of-use race condition could potentially exist in the secure file system in all Android releases fr…
-
Unscored —CVE-2017-7952 Public exploit
INFOR EAM V11.0 Build 201410 has SQL injection via search fields, related to the filtervalue parameter.
-
Unscored —CVE-2017-7953 Public exploit
INFOR EAM V11.0 Build 201410 has XSS via comment fields.
-
Medium 4.5CVE-2017-8382 Public exploit
admidio CSRF Vulnerability
admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts.
-
Unscored —
IBM Jazz Foundation could allow an authenticated user to obtain sensitive information from stack traces. IBM X-Force ID…
-
Unscored —
IBM QRadar 7.2 and 7.3 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X…
-
Unscored —
IBM Distributed Marketing 8.6, 9.0, and 10.0 could allow a privileged authenticated user to create an instance that get…
-
Unscored —
OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over…
-
Unscored —
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large contro…
-
Unscored —
fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-befo…
-
Unscored —
An integer overflow error within the "foveon_load_camf()" function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before…
-
Unscored —
A boundary error within the "foveon_load_camf()" function (dcraw_foveon.c) when initializing a huffman table in LibRaw-…
-
Unscored —
The Interval International app 3.3 through 3.5.1 for iOS does not verify X.509 certificates from SSL servers, which all…
-
Unscored —
The Warner Bros. ellentube app 3.1.1 through 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which a…
-
Unscored —CVE-2017-8926 Public exploit
Buffer overflow in Halliburton LogView Pro 10.0.1 allows attackers to cause a denial of service or possibly have unspec…
-
Unscored —
The Life Before Us Yo app 2.5.8 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-mi…
-
Unscored —
The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle…
-
Unscored —
The MoboTap Dolphin Web Browser - Fast Private Internet Search app 9.23.0 through 9.23.2 for iOS does not verify X.509 …
-
Unscored —
The Quest Information Systems Indiana Voters app 1.1.24 for iOS does not verify X.509 certificates from SSL servers, wh…
-
Unscored —CVE-2017-8927 Public exploit
Buffer overflow in Larson VizEx Reader 9.7.5 allows attackers to cause a denial of service or possibly have unspecified…
-
Unscored —
The Zipongo - Healthy Recipes and Grocery Deals app before 6.3 for iOS does not verify X.509 certificates from SSL serv…
-
Unscored —
The YottaMark ShopWell - Healthy Diet & Grocery Food Scanner app 5.3.7 through 5.4.2 for iOS does not verify X.509 cert…
-
Unscored —
The Radio Javan app 9.3.4 through 9.6.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-i…
-
Critical 9.8CVE-2017-0252 EPSS 13%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory. aka "Scripting Engine Memory Corruption Vulnerability". This vulnerability is unique from CVE-2017-0223.
-
Critical 9.8CVE-2017-0223 EPSS 15%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory. aka "Scripting Engine Memory Corruption Vulnerability". This vulnerability is unique from CVE-2017-0252.
-
High 7.5
Exposure of Sensitive Information to an Unauthorized Actor in Apache Qpid Broker for Java
The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these Authenticati…
-
Medium 6.3
Moodle External blog editing takeover
In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.
-
Medium 5.3
Moodle Unauthorized searching of arbitrary blogs by typing full url
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.
-
Medium 4.3
Moodle Cross-Site Request Forgery (CSRF)
In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.
-
Unscored —
PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (application u…
-
Unscored —
Libmenu-cache 1.0.2 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (menu un…
-
Unscored —
In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari S…
-
Unscored —
Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected acti…
-
Unscored —
The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through 4.11.1 mishandles reference counts, which all…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to h…
-
Unscored —
The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service …
-
Unscored —CVE-2017-8928 Public exploit
mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF.