Archive
19 July 2017
Vulnerabilities first published on this day (UTC), newest first.
30 results · Feed
-
Unscored —
The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid wr…
-
Unscored —
A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of…
-
Unscored —
IBM Emptoris Contract Management 10.0 and 10.1 reveals detailed error messages in certain features that could cause an …
-
Unscored —
IBM InfoSphere Master Data Management Server 11.0 - 11.6 stores user credentials in plain in clear text which can be re…
-
Unscored —
IBM Tivoli Endpoint Manager could allow a remote attacker to conduct phishing attacks, using an open redirect attack. B…
-
Unscored —
IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications is vulnerable to cross-site scripting…
-
Unscored —
IBM Tivoli Endpoint Manager is vulnerable to cross-site request forgery which could allow an attacker to execute malici…
-
Unscored —
IBM Tivoli Endpoint Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt …
-
Unscored —
IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A r…
-
Unscored —
The Screensavercc component in eLux RP before 5.5.0 allows attackers to bypass intended configuration restrictions and …
-
Critical 9.8CVE-2016-6798 Public exploit
XML External Entity Reference in Apache Sling
In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowi…
-
Medium 6.1CVE-2016-5394 Public exploit
Cross site scripting in Apache Sling
In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabili…
-
Unscored —
Cross-site scripting (XSS) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web s…
-
Unscored —
Cross-Site Request Forgery (CSRF) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a reques…
-
Unscored —
Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HT…
-
Unscored —
Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.
-
Unscored —
The Humax Wi-Fi Router model HG100R-* 2.0.6 is prone to an authentication bypass vulnerability via specially crafted re…
-
Unscored —
The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27…
-
Unscored —
In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter.
-
Unscored —CVE-2017-11456 Public exploit
Geneko GWR routers allow directory traversal sequences starting with a /../ substring, as demonstrated by unauthenticat…
-
Unscored —
D-Link DIR-615 before v20.12PTb04 has a second admin account with a 0x1 BACKDOOR value, which might allow remote attack…
-
Unscored —
The ReadJPEGImage function in coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to obtain sensitive i…
-
Unscored —
Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.
-
Unscored —
The ReadSCREENSHOTImage function in coders/screenshot.c in ImageMagick before 7.0.6-1 has memory leaks, causing denial …
-
Unscored —
In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admi…
-
Unscored —
coders/mpc.c in ImageMagick before 7.0.6-1 does not enable seekable streams and thus cannot validate blob sizes, which …
-
Unscored —
The ReadPESImage function in coders\pes.c in ImageMagick 7.0.6-1 has an infinite loop vulnerability that can cause CPU …
-
Unscored —
coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to cause a denial of service (application crash) or…
-
Unscored —
phpSocial (formerly phpDolphin) before 3.0.1 has XSS in the PATH_INFO to the search/tag/ URI.
-
Unscored —
The Google News and Weather application before 3.3.1 for Android allows remote attackers to read OAuth tokens by sniffi…