Archive
August 2017
Vulnerabilities first published in this month (UTC), newest first.
117 results · Clear filters · Feed
-
Unscored —
phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL.
-
Unscored —
Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which al…
-
Unscored —CVE-2014-8677 Public exploit
The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, an…
-
Unscored —
Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attack…
-
High 7.5
RubyGems may allow a maliciously crafted gem to overwrite files
RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
-
Unscored —
Buffer overflow in the web server service in VX Search Enterprise 10.0.14 allows remote attackers to execute arbitrary …
-
Unscored —CVE-2016-10504 Public exploit
Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remot…
-
Unscored —CVE-2017-12865 Public exploit
Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 and earlier allows remote attackers to cause a denial of se…
-
Unscored —CVE-2015-8299 Public exploit
Buffer overflow in the Group messages monitor (Falcon) in KNX ETS 4.1.5 (Build 3246) allows remote attackers to execute…
-
Unscored —CVE-2017-12763 Public exploit
An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privi…
-
Unscored —CVE-2017-10952 Public exploit
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.0.…
-
Unscored —CVE-2014-8393 Public exploit
DLL Hijacking vulnerability in CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015, and Core…
-
Unscored —CVE-2017-12954 Public exploit
The gig::Region::GetSampleFromWavePool function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of…
-
Unscored —CVE-2017-12952 Public exploit
The LoadString function in helper.h in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer …
-
Unscored —CVE-2017-12950 Public exploit
The gig::Region::Region function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL …
-
Unscored —CVE-2017-12953 Public exploit
The gig::Instrument::UpdateRegionKeyTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial…
-
Unscored —CVE-2017-12951 Public exploit
The gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a de…
-
Unscored —CVE-2017-9979 Public exploit
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be …
-
Unscored —CVE-2017-9978 Public exploit
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, a flaw was found with the error message sent as a response…
-
Unscored —CVE-2014-9558 Public exploit
Multiple SQL injection vulnerabilities in SmartCMS v.2.
-
Unscored —
Unrestricted File Upload vulnerability in Photo Gallery 1.2.5.
-
Unscored —
Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 …
-
Unscored —CVE-2017-9650 Public exploit
An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTR…
-
Unscored —CVE-2017-9644 Public exploit
An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteSca…
-
Unscored —CVE-2017-9640 Public exploit
A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5…
-
Unscored —CVE-2015-1325 Public exploit
Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in U…
-
Unscored —
Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arb…
-
Unscored —
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local file…
-
Unscored —CVE-2015-7259 Public exploit
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid…
-
Unscored —CVE-2015-7896 Public exploit
LibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memo…
-
Unscored —CVE-2015-7257 Public exploit
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrat…
-
Unscored —
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain…
-
Unscored —
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before…
-
Critical 9.8
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUploa…
KEV Apr 11, 2022 -
Critical 9.8
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which …
KEV Jan 26, 2023 -
Unscored —CVE-2017-12971 Public exploit
Cross-site scripting (XSS) vulnerability in Apache2Triad 1.5.4 allows remote attackers to inject arbitrary web script o…
-
Unscored —CVE-2017-12970 Public exploit
Cross-site request forgery (CSRF) vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authenticat…
-
Unscored —
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID p…
-
High 8.8
Incorrect Default Permissions in Supervisor
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
-
Unscored —
The novish command-line interface, included in the NoviWare software distribution through NW400.2.6 and deployed on Nov…