Archive
June 2017
Vulnerabilities first published in this month (UTC), newest first.
1,033 results · Feed
-
Unscored —
Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to ind…
-
Unscored —CVE-2017-8841 Public exploit
Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b3…
-
Unscored —CVE-2017-8839 Public exploit
XSS via orig_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_3…
-
Unscored —CVE-2017-8840 Public exploit
Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before …
-
Unscored —
Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could…
-
Unscored —
Openbravo Business Suite 3.0 is affected by SQL injection. This vulnerability could allow remote authenticated attacker…
-
Critical 9.8
Dolibarr ERP and CRM SQLi
Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search_supervisor and search_statut parameters).
-
Unscored —
Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filt…
-
Critical 9.8
TeamPass SQL injection in users.queries.php
TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php.
-
Unscored —
Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service (application crash) …
-
Unscored —
Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iom…
-
Unscored —
Document Liberation Project libmwaw before 2017-04-08 has an out-of-bounds write caused by a heap-based buffer overflow…
-
Unscored —
Document Liberation Project libstaroffice before 2017-04-07 has an out-of-bounds write caused by a stack-based buffer o…
-
Unscored —CVE-2017-1000367 Public exploit
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process…
-
Unscored —
Directory Traversal exists in RAR 4.x and 5.x because an unpack operation follows any symlinks, including symlinks cont…
-
Unscored —
SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL co…
-
Unscored —
A directory traversal vulnerability exists in core\admin\ajax\developer\extensions\file-browser.php in BigTree CMS thro…
-
Unscored —CVE-2017-9416 Scanner template
Directory traversal vulnerability in tools.file_open in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to re…
-
Unscored —
Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpw…
-
Unscored —
Cross Site Scripting (XSS) exists in Jamroom before 4.2.7 via the Status Update field.
-
Unscored —
A cross-site request forgery vulnerability in Lenovo Service Bridge before version 4 could be exploited by an attacker …
-
Unscored —
In Lenovo Service Bridge before version 4, a user with local privileges on a system could execute code with administrat…
-
Unscored —
In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certific…
-
Unscored —
In Lenovo Service Bridge before version 4, an insecure HTTP connection is used by LSB to send system serial number, mac…
-
Unscored —
In the Lenovo Power Management driver before 1.67.12.24, a local user may alter the trackpoint's firmware and stop the …
-
Unscored —
In Lenovo Active Protection System before 1.82.0.14, an attacker with local privileges could send commands to the syste…
-
Unscored —
In Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc in gmem.cc, which allows attackers to …
-
Unscored —
In LibTIFF 4.0.7, a memory leak vulnerability was found in the function OJPEGReadHeaderInfoSecTablesQTable in tif_ojpeg…
-
Unscored —
In ImageMagick 7.0.5-5, the ReadPALMImage function in palm.c allows attackers to cause a denial of service (memory leak…
-
Unscored —
In Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows a…
-
Unscored —
In ImageMagick 7.0.5-5, the ReadMPCImage function in mpc.c allows attackers to cause a denial of service (memory leak) …
-
Unscored —
In ImageMagick 7.0.5-5, the ReadICONImage function in icon.c:452 allows attackers to cause a denial of service (memory …
-
Unscored —
In LibTIFF 4.0.7, a memory leak vulnerability was found in the function TIFFReadDirEntryLong8Array in tif_dirread.c, wh…
-
Unscored —
Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zul…
-
High 7.5
Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation
In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.
-
Unscored —
Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-s…
-
Unscored —
BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance …
-
Unscored —
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary cod…
-
Unscored —
A Use of Hard-Coded Password issue was discovered in Phoenix Broadband PowerAgent SC3 BMS, all versions prior to v6.87.…
-
Unscored —
PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.1…