Archive
13 July 2017
Vulnerabilities first published on this day (UTC), newest first.
92 results · Feed
-
Unscored —
Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in…
-
Unscored —
Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravity_value resulting potentially leading to modificat…
-
Medium 5.9
txAWS AWSServiceEndpoint defaults to not verifying server certificates
txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information disclosure.
-
Unscored —
Linux foundation ONOS 1.9.0 is vulnerable to a DoS.
-
High 7.5
phpMyAdmin Cookie attribute injection attack
A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18.
-
Unscored —
Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parport_ptr integer is st…
-
Medium 6.1
Cross Site Scripting (XSS) in plotly.js
Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue.
-
Unscored —
Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user …
-
Medium 6.1
phpMyAdmin CSS Injection Vulnerability
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters
-
Medium 6.1
phpMyAdmin Open Redirect
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness
-
Unscored —
kittoframework kitto version 0.5.1 is vulnerable to memory exhaustion in the router resulting in DoS
-
Unscored —
Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure an…
-
Unscored —
Linux foundation ONOS 1.9.0 allows unauthenticated use of websockets.
-
Unscored —
TestTrack Server versions 1.0 and earlier are vulnerable to an authentication flaw in the split disablement feature res…
-
Unscored —
xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting…
-
High 7.8
Null Byte Injection in Plug.Static
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.
-
Medium 6.1
Open Redirect in oauth2_proxy
The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow. This issue was caused by improper input validation and a violation of RFC-6819
-
Unscored —
LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalat…
-
Unscored —
ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Appli…
-
Unscored —
JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the …
-
Unscored —
PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases, tables and columns resulting in p…
-
High 7.5
FedMsg not properly completing message validation
FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on.
-
Unscored —
Audacity 2.1.2 through 2.3.2 is vulnerable to Dll HIjacking in the avformat-55.dll resulting arbitrary code execution.
-
Unscored —
rbenv (all current versions) is vulnerable to Directory Traversal in the specification of Ruby version resulting in arb…
-
High 7.5
phpMyAdmin DoS Vulnerability
phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name
-
High 7.5
phpMyAdmin DoS Vulnerability
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality
-
Critical 9.8
Akeneo PIM vulnerable to shell injection in the mass edition
Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution.
-
Unscored —
Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack
-
Unscored —
Linux foundation ONOS 1.9 is vulnerable to XSS in the device. registration
-
High 8.8
phpMyAdmin SSRF in replication
phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server
-
Unscored —
ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog…
-
Medium 6.1
Content Injection via TileJSON attribute in mapbox.js
Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON Name.
-
Unscored —
RVM automatically loads environment variables from files in $PWD resulting in command execution RVM vulnerable to comma…
-
Unscored —
soundlib/Load_psm.cpp in OpenMPT through 1.26.12.00 and libopenmpt before 0.2.8461-beta26 has a heap buffer overflow wi…
-
Unscored —
The read_user_chunk_callback function in coders\png.c in ImageMagick 7.0.6-1 Q16 2017-06-21 (beta) has memory leak vuln…
-
Unscored —
An elevation of privilege vulnerability in the NVIDIA sound driver could enable a local malicious application to execut…
-
Unscored —CVE-2017-9788 EPSS 57%
In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type '…
-
Unscored —
When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access mem…
-
Unscored —
IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site scripting. This…
-
Unscored —
IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to a denial of service attack…