Archive
July 2017
Vulnerabilities first published in this month (UTC), newest first.
1,269 results · Feed
-
Unscored —
Cobian Backup 11 client allows man-in-the-middle attackers to add and execute new backup tasks when the master server i…
-
Unscored —
Heap buffer overflow in the yr_object_array_set_item() function in object.c in YARA 3.x allows a denial-of-service atta…
-
Unscored —
Adobe Connect versions 9.6.1 and earlier have a clickjacking vulnerability. Successful exploitation could lead to a cli…
-
Unscored —
Adobe Connect versions 9.6.1 and earlier have a reflected cross-site scripting vulnerability. Successful exploitation c…
-
Unscored —
Adobe Connect versions 9.6.1 and earlier have a stored cross-site scripting vulnerability. Successful exploitation coul…
-
Unscored —
Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Sc…
-
Unscored —
Adobe Flash Player versions 26.0.0.131 and earlier have a security bypass vulnerability related to the Flash API used b…
-
Unscored —
Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Sc…
-
Unscored —
cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds…
-
Unscored —
Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTM…
-
Unscored —
Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.
-
High 7.5
mixlib-archive Path Traversal vulnerability
Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using ".." in tar archive entries
-
High 8.1
Akka Java Serialization vulnerability
Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem.
-
Unscored —CVE-2017-1000029 Scanner template
Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that…
-
Unscored —
SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary …
-
Medium 6.1
Content Injection via TileJSON Name in mapbox.js
Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control
-
Unscored —
Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attackers to i…
-
Unscored —
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Trav…
-
Unscored —
MyWebSQL version 3.6 is vulnerable to stored XSS in the database manager component resulting in account takeover or ste…
-
Unscored —
GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior version…
-
Unscored —
Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Managemen…
-
Unscored —
LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents.
-
Unscored —
SYN Flood or FIN Flood attack in ECos 1 and other versions embedded devices results in web Authentication Bypass. "eCos…
-
Unscored —
kittoframework kitto 0.5.1 is vulnerable to directory traversal in the router resulting in remote code execution
-
Unscored —
Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data par…
-
Unscored —
Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission r…
-
Unscored —
gtk-vnc 0.4.2 and older doesn't check framebuffer boundaries correctly when updating framebuffer which may lead to memo…
-
Unscored —
The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, wh…
-
Unscored —
Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code exe…
-
Unscored —
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to a…
-
Unscored —
Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure vulne…
-
Unscored —
Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the string_repeat() function.
-
Unscored —
ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course…
-
Unscored —
Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishi…
-
Critical 9.8
Kubernetes Privilege Escalation
Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.
-
Critical 9.8
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a backup directory with all old secrets, and the key used to encrypt them. These backups were world-readable and not removed …
-
Unscored —
EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root
-
Unscored —
WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute Jav…
-
High 8.8
Cross-site Request Forgery (CSRF)
CSRF in Bitly oauth2_proxy 2.1 during authentication flow
-
Unscored —
kittoframework kitto version 0.5.1 is vulnerable to an XSS in the 404 page resulting in information disclosure