Archive
June 2017
Vulnerabilities first published in this month (UTC), newest first.
1,033 results · Feed
-
Unscored —
Untrusted search path vulnerability in Installer of electronic tendering and bid opening system available prior to May …
-
Unscored —
Cross-site scripting vulnerability in WP Live Chat Support prior to version 7.0.07 allows remote attackers to inject ar…
-
Unscored —
Untrusted search path vulnerability in the installer of Tera Term 4.94 and earlier allows an attacker to gain privilege…
-
Unscored —
Untrusted search path vulnerability in RW-4040 driver installer for Windows 7 version 2.27 allows an attacker to gain p…
-
Unscored —
Untrusted search path vulnerability in SemiDynaEXE (SemiDynaEXE2008.EXE) ver. 1.0.2 allows an attacker to gain privileg…
-
Unscored —
Untrusted search path vulnerability in RW-5100 driver installer for Windows 7 version 1.0.0.9 and RW-5100 driver instal…
-
Unscored —
In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer scri…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, A…
-
Unscored —
The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342.
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-…
-
Unscored —
The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of ser…
-
High 8.8
Zend Framework CSRF Vulnerability
Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers.
-
Unscored —
The IP stack in multiple Huawei Campus series switch models allows remote attackers to cause a denial of service (reboo…
-
Unscored —
The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for …
-
Unscored —
AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary…
-
Unscored —
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way th…
-
Unscored —
IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it ea…
-
Unscored —
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they s…
-
Unscored —
IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive inform…
-
Unscored —
IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE…
-
Unscored —
IBM Sterling Order Management 9.2 through 9.5 is vulnerable to cross-site request forgery which could allow an attacker…
-
Unscored —
IBM BigFix Compliance Analytics 1.9.79 uses weaker than expected cryptographic algorithms that could allow an attacker …
-
Unscored —
IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted…
-
Unscored —
IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting. This vulnerability allows users to emb…
-
Unscored —
b/libs/gui/ISurfaceComposer.cpp in Android allows attackers to trigger a denial of service (null pointer dereference an…
-
Unscored —
/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as p…
-
Unscored —
Blue Coat Advanced Secure Gateway 6.6, CacheFlow 3.4, ProxySG 6.5 and 6.6 allows remote attackers to bypass blocked req…
-
Unscored —
Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attacker…
-
Unscored —
SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat En…
-
Unscored —
389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Re…
-
Unscored —
mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, a…
-
Unscored —
server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.
-
Unscored —
389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Re…
-
Unscored —
389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Re…
-
Unscored —
VMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service …
-
High 8.8
Ansible Arbitrary Code Execution
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
-
Unscored —
CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.
-
Unscored —
ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code.
-
Unscored —
The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted seria…
-
Unscored —
pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the …