Archive
21 July 2017
Vulnerabilities first published on this day (UTC), newest first.
35 results · Feed
-
Unscored —
rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting…
-
Critical 9.8
Safemode Gem Has Incomplete List of Disallowed Inputs
rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escal…
-
Unscored —
Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow vulnerability in wcsxfrm/wcsxfrm_l fu…
-
Unscored —CVE-2017-11519 Public exploit
passwd_recovery.lua on the TP-Link Archer C9(UN)_V2_160517 allows an attacker to reset the admin password by leveraging…
-
Unscored —
Stack-based buffer overflow in GCoreServer.exe in the server in Geutebrueck Gcore 1.3.8.42 and 1.4.2.37 allows remote a…
-
Unscored —
Sensitive data can be exposed in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 that can lead to an attacker ga…
-
Unscored —
Builder tools running in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could all…
-
Unscored —
IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 is vulnerable to cross-site scripting. This vulnerability allows use…
-
Unscored —
IBM WebSphere Application Server Proxy Server or On-demand-router (ODR) 7.0, 8.0, 8.5, 9.0 and could allow a local atta…
-
Unscored —
Reports executed in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an…
-
Unscored —
IBM Security Guardium 10.0 and 10.1 processes patches, image backups and other updates without sufficiently verifying t…
-
Medium 6.1
Yii Cross-site Scripting Framework vulnerability
An XSS vulnerability exists in framework/views/errorHandler/exception.php in Yii Framework 2.0.12 affecting the exception screen when debug mode is enabled, because $exception->errorInfo is mishandled.
-
Unscored —
The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local users to cau…
-
Unscored —
The ReadOneJNGImage function in coders/png.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attac…
-
Unscored —
The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0…
-
Unscored —
Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16…
-
High 7.5
The Undertow module of WildFly allows source code disclosure
The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL.
-
Unscored —
libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecifie…
-
Unscored —
phpMyBackupPro 2.5 and earlier does not properly sanitize input strings, which allows remote authenticated users to exe…
-
Unscored —
selinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to cause a denial of service (SSH log…
-
Unscored —
Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed …
-
Unscored —
phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote au…
-
Unscored —
Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signe…
-
Unscored —
The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variable…
-
Unscored —
phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary…
-
Unscored —
The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was great…
-
Unscored —CVE-2015-5195 Public exploit
ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault…
-
Unscored —
The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision valu…
-
Unscored —
The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denia…
-
Unscored —CVE-2017-9415 Public exploit
Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target …
-
Unscored —
Cross-Site Scripting (XSS) exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by th…
-
Unscored —
In Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, the "PING" (aka tag_ipPing) feature within the web inte…
-
Unscored —
Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of admin for the admin account.
-
Unscored —
Cross-Site Request Forgery (CSRF) exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrate…
-
High 8.8
Contao Core directory traversal vulnerability
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.