Archive
30 August 2017
Vulnerabilities first published on this day (UTC), newest first.
51 results · Feed
-
Unscored —
A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in lib/openjp2/t2.c in OpenJPEG 2.2.0.…
-
Unscored —
A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vul…
-
Unscored —
A memory allocation failure was discovered in the ReadPNMImage function in coders/pnm.c in GraphicsMagick 1.3.26. The v…
-
Unscored —
An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage fun…
-
Unscored —
IBM Emptoris Services Procurement 10.0.0.5 could allow a remote attacker to include arbitrary files. A remote attacker …
-
Unscored —
IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows use…
-
Unscored —
IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows use…
-
Unscored —
IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to em…
-
Unscored —
IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to…
-
Unscored —
IBM Emptoris Services Procurement 10.0.0.5 could allow a local user to view sensitive information stored locally due to…
-
Unscored —
CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability.
-
Unscored —
CrushFTP 8.x before 8.2.0 has a serialization vulnerability.
-
Unscored —
CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability.
-
Unscored —
CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS.
-
Unscored —
Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Backup before 4.2.5-4396 on W…
-
Unscored —
ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to b…
-
Medium 5.5
Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop
This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random…
-
Unscored —
An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Se…
-
Unscored —
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). An attacker who perfor…
-
Unscored —
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V1.81.2). An attacker with ne…
-
Unscored —
In the Siemens 7KM PAC Switched Ethernet PROFINET expansion module (All versions < V2.1.3), a Denial-of-Service conditi…
-
Unscored —
An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A built-…
-
Unscored —
An Improper Restriction Of Operations Within The Bounds Of A Memory Buffer issue was discovered in Advantech WebAccess …
-
Unscored —
An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A mali…
-
Unscored —
A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially …
-
Unscored —
A stack-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers …
-
Unscored —
A heap-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers h…
-
Unscored —
An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Str…
-
Unscored —
An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to …
-
Unscored —
An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Specially craft…
-
Unscored —
By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives …
-
Unscored —
The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operat…
-
Unscored —
The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows directory traversal attacks for reading arbitrary files via t…
-
High 7.5
Improper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-core
When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to cr…
-
Unscored —
Division-by-zero vulnerabilities in the functions opj_pi_next_cprl, opj_pi_next_pcrl, and opj_pi_next_rpcl in pi.c in O…
-
Unscored —
Integer overflow vulnerability in the bmp24toimage function in convertbmp.c in OpenJPEG before 2.2.0 allows remote atta…
-
Unscored —CVE-2016-10504 Public exploit
Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remot…
-
Unscored —
NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, c…
-
Unscored —
GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version==…
-
Unscored —
Fiyo CMS 2.0.7 has XSS in dapur\apps\app_config\sys_config.php via the site_name parameter.