Archive
25 July 2017
Vulnerabilities first published on this day (UTC), newest first.
54 results · Feed
-
Unscored —
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of servi…
-
Unscored —
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of servi…
-
Unscored —
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of servi…
-
Unscored —
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() …
-
Unscored —
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of servi…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Ektron Content Management System before 9.1.0.184SP3(9.1.0.184.3.127) allow…
-
Unscored —
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the …
-
Unscored —
A vulnerability in the web interface of the Cisco Web Security Appliance (WSA) could allow an authenticated, remote att…
-
Unscored —
A vulnerability in AsyncOS for the Cisco Web Security Appliance (WSA) could allow an unauthenticated, local attacker to…
-
Unscored —
A vulnerability in the CLI parser of the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacke…
-
Unscored —
A vulnerability in certain filtering mechanisms of access control lists (ACLs) for Cisco ASR 5000 Series Aggregation Se…
-
Unscored —
A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning (PCP) Tool could allow an unauthenticat…
-
Unscored —
A vulnerability in the web proxy functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticated…
-
Unscored —
A vulnerability in Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated,…
-
Unscored —
A vulnerability in the gateway GPRS support node (GGSN) of Cisco ASR 5000 Series Aggregation Services Routers 17.3.9.62…
-
Unscored —
A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an authenticate…
-
Unscored —
The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote at…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Alert Service of Cisco Cloud Web Security base revision allows remote a…
-
Unscored —
The oxide::JavaScriptDialogManager function in oxide-qt before 1.9.1 as packaged in Ubuntu 15.04 and Ubuntu 14.04 allow…
-
Unscored —
The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x…
-
Unscored —
Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary…
-
Unscored —
Absolute path traversal vulnerability in the file_manager component of eFront CMS before 3.6.15.5 allows remote authent…
-
Unscored —
scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons…
-
Unscored —
The file_manager component in eFront CMS before 3.6.15.5 allows remote authenticated users to bypass intended file-uplo…
-
Unscored —
hwpapp.dll in Hangul Word Processor allows remote attackers to execute arbitrary code via a crafted heap spray, and by …
-
Unscored —
The cipherstring parsing code in nss_compat_ossl while in multi-keyword mode does not match the expected set of ciphers…
-
Medium 5.5
sosreport sensitive information disclosure via weak permissions of the generated archives
sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.
-
Unscored —
rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by rea…
-
Unscored —
The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitr…
-
Unscored —CVE-2015-2798 Public exploit
SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary …
-
High 7.5
OpenPGP 1.2.0 and earlier decrypts arbitrary messages
s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP me…
-
Unscored —
Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of…
-
Unscored —CVE-2015-5594 Public exploit
The sanitize_string function in ZenPhoto before 1.4.9 utilized the html_entity_decode function after input sanitation, …
-
Unscored —
Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 librar…
-
Unscored —
ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root acces…
-
Unscored —
XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated u…
-
Unscored —
The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote…
-
Unscored —
SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files a…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the DataArchivingService servlet in SAP NetWeaver Portal 7.4 allows remote …