Archive
June 2017
Vulnerabilities first published in this month (UTC), newest first.
40 results · Clear filters · Feed
-
High 8.8
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted…
-
High 8.8
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted…
-
High 8.8
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted…
-
High 8.8
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted…
-
High 8.8
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted…
-
High 8.8
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD C…
-
High 8.8
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted…
-
High 7.5
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted…
-
High 7.5
Apache Ignite communicates to an external PHP server where sensitive information is sent
Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server (htt…
-
High 8.8CVE-2017-6086 Public exploit
ViMbAdmin CSRF Vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to (1) add an administrator user via a crafted POST request …
-
High 8.8
In the web management interface in Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially craft…
-
High 8.8
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD C…
-
High 8.8
In the web management interface in Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially craft…
-
High 8.8
Dolibarr ERP and CRM Unsafe File Upload Vulnerability
Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable application.
-
High 8.1
An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure …
-
High 8.1
An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure …
-
High 8.8
An exploitable integer overflow vulnerability exists in the JPEG 2000 parser functionality of IrfanView 4.44. A special…
-
High 8.8
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD C…
-
High 7.7
An exploitable directory traversal vulnerability exists in the web management interface used by the Foscam C1 Indoor HD…
-
High 8.1
An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Cam…
-
High 8.8
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD C…
-
High 7.5
Logstash Logs Sensitive Information
Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information.
-
High 7.5
Jetty vulnerable to exposure of sensitive information due to observable discrepancy
Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
-
High 8.8
Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 20…
KEV Feb 10, 2022 -
High 8.8
Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project…
-
High 7.5
Loaded Databook of Tablib prone to python insertion resulting in command execution
An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerabili…
-
High 7.5
tlslite remote denial of service vulnerability
The tlslite library before 0.4.9 for Python allows remote attackers to trigger a denial of service (runtime exception and process crash).
-
High 7.2
Cloud Foundry UAA password reset vulnerability
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions prior to v3.17.0; and UAA bosh release (ua…
-
High 8.8
Cloud Foundry UAA Privilege Escalation
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release (uaa…
-
High 7.5
Origin Validation Error in Apache NiFi
Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin.
-
High 8.8
Zend Framework CSRF Vulnerability
Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers.
-
High 8.8
Ansible Arbitrary Code Execution
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
-
High 7.5
The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which…
-
High 7.5
The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allo…
-
High 7.8
Ansible Sandbox Escape via Symlink Attack
The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.
-
High 7.5CVE-2015-5175 EPSS 11%
Apache CXF Fediz application plugins are vulnerable to Denial of Service (DoS) attacks
Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.
-
High 8.8
Mercurial has Incorrect Permission Assignment for Critical Resource
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.
-
High 7.5CVE-2017-5664 EPSS 17%
Improper Handling of Exceptional Conditions in Apache Tomcat
The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is prese…
-
High 8.8
BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables obje…
-
High 7.5
Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation
In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.