Archive
9 August 2017
Vulnerabilities first published on this day (UTC), newest first.
84 results · Feed
-
High 8.8
Apache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the wors…
-
Unscored —
Rtrlet.class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to obtain Session IDs of logged …
-
Unscored —
Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management …
-
Unscored —CVE-2015-0786 EPSS 24%
Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration…
-
Unscored —
The FileViewer class in Novell ZENworks Configuration Management (ZCM) allows remote authenticated users to read arbitr…
-
Unscored —
SQL injection vulnerability in the ScheduleQuery method of the schedule class in Novell ZENworks Configuration Manageme…
-
Unscored —
com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks Configuration Management (ZCM) allows remo…
-
Unscored —
SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuratio…
-
Unscored —CVE-2015-7894 Public exploit
The DCMProvider service in Samsung LibQjpeg on a Samsung SM-G925V device running build number LRX22G.G925VVRU1AOE2 allo…
-
Critical 9.8
rest-client Gem Vulnerable to Session Fixation
REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.
-
Unscored —
ganglia-web before 3.7.1 allows remote attackers to bypass authentication.
-
Unscored —
Alcatel-Lucent Home Device Manager before 4.1.10, 4.2.x before 4.2.2 allows remote attackers to spoof and make calls as…
-
Unscored —
The mod_nss module before 1.0.11 in Fedora allows remote attackers to obtain cipher lists due to incorrect parsing of m…
-
Medium 5.9
Restkit Does Not Validate TLS certificates
Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the default CERT_NONE value for the cert_reqs argument.
-
Unscored —
Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an o…
-
Medium 4.7
OpenStack Compute (Nova) Improper Access Control
OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissions for.
-
Unscored —
Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service (CPU and…
-
High 7.8
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows al…
KEV Feb 10, 2023 -
Unscored —
Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to …
-
Unscored —
Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a …
-
Unscored —
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than…
-
Unscored —
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than…
-
Unscored —
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than…
-
Unscored —
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than…
-
Unscored —
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than…
-
Medium 6.1
No Charset in Content-Type Header in express
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non…
-
Unscored —
Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attacker…
-
Unscored —CVE-2014-5144 Public exploit
Cross-site scripting (XSS) vulnerability in Telescope before 0.9.3 allows remote authenticated users to inject arbitrar…
-
Unscored —
IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x is vulnerable to cross-site scripting. This vulnerability …
-
Unscored —
IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks,…
-
Unscored —
In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending inva…
-
Unscored —
IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails whi…
-
Unscored —
IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks,…
-
Unscored —
An information disclosure / elevation of privilege vulnerability in the BlackBerry Workspaces Server could potentially …
-
High 7.5
Lemur uses static IV per key
Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.
-
High 7.5
Improper Access Control in Elasticsearch
The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that t…
-
Critical 9.8
salt password information leaked in debug logs
win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.
-
Unscored —
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy…
-
Unscored —
Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate S…
-
Unscored —
Stack buffer overflow in httpd in Asuswrt-Merlin firmware 380.67_0RT-AC5300 and earlier for ASUS devices and ASUS firmw…