Archive
July 2017
Vulnerabilities first published in this month (UTC), newest first.
1,269 results · Feed
-
Unscored —
The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus …
-
Unscored —
A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. Thus gra…
-
Unscored —
The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Main…
-
Unscored —
Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.1…
-
Unscored —
Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents.
-
Unscored —
A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achie…
-
Unscored —
A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achie…
-
Unscored —CVE-2017-9609 Public exploit
Cross-site scripting (XSS) vulnerability in Blackcat CMS 1.2 allows remote authenticated users to inject arbitrary web …
-
Unscored —CVE-2017-9934 Public exploit
Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability.
-
Medium 5.4
Bolt CMS Stored XSS
Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header.
-
Unscored —
Integer overflow in the ape_decode_frame function in libavcodec/apedec.c in FFmpeg 2.4 through 3.3.2 allows remote atta…
-
Medium 5.4
Bolt stored Cross-site Scripting (XSS)
Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry.
-
Unscored —
In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection i…
-
Unscored —
Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could ena…
-
Unscored —
An issue was discovered in Fuji Electric V-Server Version 3.3.22.0 and prior. A memory corruption vulnerability has bee…
-
Medium 6.5
Moodle Improper Privilege Management
In Moodle 3.x, course creators are able to change system default settings for courses.
-
Medium 4.3
Moodle Information Disclosure
In Moodle 3.3, the course overview block reveals activities in hidden courses.
-
Unscored —
Inteno routers have a JUCI ACL misconfiguration that allows the "user" account to read files, write to files, and add r…
-
Medium 6.5
Moodle User fullname disclosure on user preferences page
Moodle 3.x has user fullname disclosure on the user preferences page.
-
Unscored —
An FR-GV-204 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in fr_dhcp_decode()" and a denial of serv…
-
Unscored —
An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in data2vp_wimax()" - this allows remote atta…
-
Unscored —
An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Buffer over-read in fr_dhcp_decode_suboptions()" and …
-
Unscored —
An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()…
-
Unscored —
An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a d…
-
Unscored —
An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "DHCP - Read overflow when decoding opt…
-
Unscored —
An FR-GV-203 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in decode_tlv()" and a denial of service.
-
Unscored —
An FR-GV-303 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Infinite read in dhcp_attr2vp()" and a denial of serv…
-
Unscored —
An FR-GV-302 issue in FreeRADIUS 3.x before 3.0.15 allows "Infinite loop and memory exhaustion with 'concat' attributes…
-
Unscored —
An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in rad_coalesce()" - this allows remote attac…
-
Unscored —
The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions…
-
Unscored —
The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance and RSA IMG products (RSA Identity Gove…
-
Unscored —
In EMC RSA Authentication Manager 8.2 SP1 and earlier, a malicious RSA Security Console Administrator could craft a tok…
-
Unscored —
The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG products (RSA Identity Gov…
-
Unscored —CVE-2017-8011 EPSS 14%
EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R …
-
Unscored —
In EMC RSA Authentication Manager 8.2 SP1 Patch 1 and earlier, a malicious user logged into the Self-Service Console of…
-
Unscored —
The shoco_decompress function in the API in shoco through 2017-07-17 allows remote attackers to cause a denial of servi…
-
Unscored —
In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformat_parse.c does not restrict the locale leng…
-
Unscored —
The ReadRLEImage function in coders\rle.c in ImageMagick 7.0.6-1 has a large loop vulnerability via a crafted rle file …
-
Unscored —
Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/app_article/sys_article.php via the name parameter in …
-
Unscored —
The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of se…