Archive
8 June 2017
Vulnerabilities first published on this day (UTC), newest first.
68 results · Feed
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-…
-
Unscored —
The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of ser…
-
High 8.8
Zend Framework CSRF Vulnerability
Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers.
-
Unscored —
The IP stack in multiple Huawei Campus series switch models allows remote attackers to cause a denial of service (reboo…
-
Unscored —
The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for …
-
Unscored —
AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary…
-
Unscored —
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way th…
-
Unscored —
IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it ea…
-
Unscored —
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they s…
-
Unscored —
IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive inform…
-
Unscored —
IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE…
-
Unscored —
IBM Sterling Order Management 9.2 through 9.5 is vulnerable to cross-site request forgery which could allow an attacker…
-
Unscored —
IBM BigFix Compliance Analytics 1.9.79 uses weaker than expected cryptographic algorithms that could allow an attacker …
-
Unscored —
IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted…
-
Unscored —
IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting. This vulnerability allows users to emb…
-
Unscored —
b/libs/gui/ISurfaceComposer.cpp in Android allows attackers to trigger a denial of service (null pointer dereference an…
-
Unscored —
/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as p…
-
Unscored —
Blue Coat Advanced Secure Gateway 6.6, CacheFlow 3.4, ProxySG 6.5 and 6.6 allows remote attackers to bypass blocked req…
-
Unscored —
Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attacker…
-
Unscored —
SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat En…
-
Unscored —
389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Re…
-
Unscored —
mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, a…
-
Unscored —
server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.
-
Unscored —
389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Re…
-
Unscored —
389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Re…
-
Unscored —
VMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service …
-
High 8.8
Ansible Arbitrary Code Execution
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
-
Unscored —
CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.
-
Unscored —
ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code.
-
Unscored —
The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted seria…
-
Unscored —
pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the …
-
Unscored —
client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as …
-
Unscored —
The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary fi…
-
Unscored —
The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc…
-
Unscored —
Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service.
-
Unscored —
SQL injection vulnerability in ClearPass Policy Manager 6.5.x through 6.5.6 and 6.6.0.
-
Unscored —
Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board re…
-
Unscored —
The user authentication module in Huawei Campus switches S5700, S5300, S6300, and S6700 with software before V200R001SP…
-
Unscored —
Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary c…
-
Unscored —
The DeviceManager in Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers t…