Archive
July 2017
Vulnerabilities first published in this month (UTC), newest first.
1,269 results · Feed
-
Unscored —
A vulnerability in Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated,…
-
Unscored —
A vulnerability in the gateway GPRS support node (GGSN) of Cisco ASR 5000 Series Aggregation Services Routers 17.3.9.62…
-
Unscored —
A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an authenticate…
-
Unscored —
The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote at…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Alert Service of Cisco Cloud Web Security base revision allows remote a…
-
Unscored —
The oxide::JavaScriptDialogManager function in oxide-qt before 1.9.1 as packaged in Ubuntu 15.04 and Ubuntu 14.04 allow…
-
Unscored —
The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x…
-
Unscored —
Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary…
-
Unscored —
Absolute path traversal vulnerability in the file_manager component of eFront CMS before 3.6.15.5 allows remote authent…
-
Unscored —
scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons…
-
Unscored —
The file_manager component in eFront CMS before 3.6.15.5 allows remote authenticated users to bypass intended file-uplo…
-
Unscored —
hwpapp.dll in Hangul Word Processor allows remote attackers to execute arbitrary code via a crafted heap spray, and by …
-
Unscored —
The cipherstring parsing code in nss_compat_ossl while in multi-keyword mode does not match the expected set of ciphers…
-
Medium 5.5
sosreport sensitive information disclosure via weak permissions of the generated archives
sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.
-
Unscored —
rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by rea…
-
Unscored —
The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitr…
-
Unscored —CVE-2015-2798 Public exploit
SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary …
-
High 7.5
OpenPGP 1.2.0 and earlier decrypts arbitrary messages
s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP me…
-
Unscored —
Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of…
-
Unscored —CVE-2015-5594 Public exploit
The sanitize_string function in ZenPhoto before 1.4.9 utilized the html_entity_decode function after input sanitation, …
-
Unscored —
Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 librar…
-
Unscored —
ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root acces…
-
Unscored —
XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated u…
-
Unscored —
The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote…
-
Unscored —
SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files a…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the DataArchivingService servlet in SAP NetWeaver Portal 7.4 allows remote …
-
Unscored —
NetApp OnCommand API Services before 1.2P3 logs the LDAP BIND password when a user attempts to log in using the REST AP…
-
Unscored —CVE-2017-9413 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attack…
-
Unscored —
MEDHOST Connex contains hard-coded credentials that are used for customer database access. An attacker with knowledge o…
-
Unscored —
Cross-site scripting (XSS) vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary…
-
Unscored —
AppUse 4.0 allows shell command injection via a proxy field.
-
Unscored —
aRts 1.5.10 and kdelibs3 3.5.10 and earlier do not properly create temporary directories, which allows local users to h…
-
Unscored —
The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4…
-
Unscored —
Memory leak in AcquireVirtualMemory in ImageMagick before 7 allows remote attackers to cause a denial of service (memor…
-
Unscored —
Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest…
-
Unscored —
Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system f…
-
Unscored —CVE-2017-11499 Public exploit
Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 …
-
Unscored —
The brcmf_cfg80211_mgmt_tx function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel …
-
Unscored —
An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and …