Archive
16 June 2017
Vulnerabilities first published on this day (UTC), newest first.
74 results · Feed
-
Unscored —
The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service …
-
Unscored —
QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest …
-
Unscored —
Memory leak in QEMU (aka Quick Emulator), when built with IDE AHCI Emulation support, allows local guest OS privileged …
-
Unscored —
Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged …
-
Unscored —
QEMU (aka Quick Emulator), when built with USB xHCI controller emulator support, allows local guest OS privileged users…
-
Unscored —
XML external entity (XXE) vulnerability in Citrix XenMobile Server 9.x and 10.x before 10.5 RP3 allows attackers to obt…
-
Unscored —
Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a XSS attack.
-
High 7.5
Logstash Logs Sensitive Information
Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information.
-
Unscored —
Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formula…
-
Unscored —
Kibana Reporting plugin version 2.4.0 is vulnerable to a CSRF vulnerability that could allow an attacker to generate su…
-
Unscored —
Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers cou…
-
Unscored —
Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaSc…
-
Unscored —
With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings a…
-
Unscored —
Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5,…
-
Unscored —
Kibana versions before 4.6.3 and 5.0.1 have an open redirect vulnerability that would enable an attacker to craft a lin…
-
Medium 6.5
Logstash Logs Sensitive Information
Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials.
-
Unscored —
Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack.
-
Unscored —
With X-Pack installed, Kibana versions before 5.3.1 have an open redirect vulnerability on the login page that would en…
-
Unscored —
X-Pack 5.1.1 did not properly apply document and field level security to multi-search and multi-get requests so users w…
-
Unscored —
Kibana versions prior to 5.2.1 configured for SSL client access, file descriptors will fail to be cleaned up after cert…
-
Unscored —
X-Pack Security 5.2.x would allow access to more fields than the user should have seen if the field level security rule…
-
High 7.5
Jetty vulnerable to exposure of sensitive information due to observable discrepancy
Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
-
Unscored —
GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS exte…
-
Unscored —
The msm_bus_dbg_update_request_write function in drivers/platform/msm/msm_bus/msm_bus_dbg.c in android_kernel_huawei_ms…
-
Unscored —
In uClibc 0.9.33.2, there is stack exhaustion (uncontrolled recursion) in the check_dst_limits_calc_pos_1 function in m…
-
Unscored —
In meta/classes/package_ipk.bbclass in Poky in poky-pyro 17.0.0 for Yocto Project through YP Core - Pyro 2.3, attackers…
-
Unscored —
In uClibc 0.9.33.2, there is an out-of-bounds read in the get_subexp function in misc/regex/regexec.c when processing a…
-
Unscored —
In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticat…
-
Unscored —CVE-2017-9602 Public exploit
KBVault Mysql Free Knowledge Base application package 0.16a comes with a FileExplorer/Explorer.aspx?id=/Uploads file-ma…
-
Unscored —
The "FNB Kemp Mobile Banking" by First National Bank of Kemp app 3.0.2 -- aka fnb-kemp-mobile-banking/id571448725 for i…
-
Unscored —
The "Oritani Mobile Banking" by Oritani Bank app 3.0.0 -- aka oritani-mobile-banking/id778851066 for iOS does not verif…
-
Unscored —
The "Peoples Bank Tulsa" by Peoples Bank - OK app 3.0.2 -- aka peoples-bank-tulsa/id1074279285 for iOS does not verify …
-
Unscored —
The "SCSB Shelbyville IL Mobile Banking" by Shelby County State Bank app 3.0.0 -- aka scsb-shelbyville-il-mobile-bankin…
-
Unscored —
The "Your Legacy Federal Credit Union Mobile Banking" by Your Legacy Federal Credit Union app 3.0.1 -- aka your-legacy-…
-
Unscored —
The First Citizens Community Bank fccb/id809930960 app 3.0.1 for iOS does not verify X.509 certificates from SSL server…
-
Unscored —
The "Charlevoix State Bank" by Charlevoix State Bank app 3.0.1 -- aka charlevoix-state-bank/id1128963717 for iOS does n…
-
Unscored —
The "JMCU Mobile Banking" by Joplin Metro Credit Union app 3.0.0 -- aka jmcu-mobile-banking/id716065893 for iOS does no…
-
Unscored —
The avb-bank-mobile-banking/id592565443 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which al…
-
Unscored —
The Freedom First freedom-1st-credit-union-mobile-banking/id1085229458 app 3.0.0 for iOS does not verify X.509 certific…
-
Unscored —
The "PCSB BANK Mobile" by PCSB Bank app 3.0.4 -- aka pcsb-bank-mobile/id1067472090 for iOS does not verify X.509 certif…