Archive
24 August 2017
Vulnerabilities first published on this day (UTC), newest first.
36 results · Feed
-
Unscored —
net/ipv4/route.c in the Linux kernel 4.13-rc1 through 4.13-rc6 is too late to check for a NULL fi field when RTM_F_FIB_…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to injec…
-
Unscored —
Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remote authent…
-
Unscored —
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local file…
-
Unscored —
ONOS before 1.5.0 when using the ifwd app allows remote attackers to cause a denial of service (NULL pointer dereferenc…
-
Unscored —CVE-2015-7259 Public exploit
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid…
-
Unscored —CVE-2015-7896 Public exploit
LibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memo…
-
Unscored —CVE-2015-7257 Public exploit
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrat…
-
Unscored —
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain…
-
Unscored —
The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potenti…
-
Unscored —
The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to cause a…
-
Unscored —
LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connectio…
-
Unscored —
ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the co…
-
Unscored —
Red Hat Enterprise Virtualization Manager 3.6 and earlier gives valid SLAAC IPv6 addresses to interfaces when "boot pro…
-
Medium 5.9
simplejson before 2.6.1 vulnerable to array index error
Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode functio…
-
Unscored —
app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only impacts the users of t…
-
Unscored —
Cross-site scripting (XSS-STORED) vulnerability in the DEVICES OR SENSORS functionality in Paessler PRTG Network Monito…
-
Unscored —
Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows r…
-
Unscored —
Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 al…
-
High 7.5
The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers t…
-
Unscored —
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
-
Unscored —
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
-
Unscored —
Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTM…
-
Unscored —
The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary …
-
Unscored —
The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to …
-
High 7.5
The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote at…
-
Unscored —
The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary…
-
High 7.5
PyJWT vulnerable to key confusion attacks
In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY…
-
Unscored —
The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt blo…
-
Unscored —
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code …
-
Unscored —
Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrators to cause a denia…
-
Unscored —
arch/x86/mm.c in Xen allows local PV guest OS users to gain host OS privileges via vectors related to map_grant_ref.
-
Unscored —
Xen allows local OS guest users to cause a denial of service (crash) or possibly obtain sensitive information or gain p…
-
Unscored —
In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missing NULL check in the ReadMATImage function in cod…
-
Unscored —
An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare …
-
Unscored —
A elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4…