Archive
August 2017
Vulnerabilities first published in this month (UTC), newest first.
1,540 results · Feed
-
Unscored —
mktexlsr revision 36855, and before revision 36626 as packaged in texlive allows local users to write to arbitrary file…
-
Unscored —
mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files vi…
-
Unscored —CVE-2014-7859 EPSS 21%
Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322L before …
-
Unscored —
The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not…
-
Unscored —CVE-2014-7857 EPSS 15%
D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 …
-
Unscored —CVE-2014-7858 EPSS 15%
The check_login function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and lo…
-
Unscored —
CRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware before …
-
Unscored —
GNU patch 2.7.2 and earlier allows remote attackers to cause a denial of service (memory consumption and segmentation f…
-
Unscored —
controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable.
-
Unscored —
A Use of Hard-Coded Cryptographic Key issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD…
-
Unscored —
A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, …
-
Unscored —
A Cross-Site Request Forgery (CSRF) issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-3…
-
Unscored —
The acpi_ps_complete_final_op() function in drivers/acpi/acpica/psobject.c in the Linux kernel through 4.12.9 does not …
-
Unscored —
The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flu…
-
Unscored —
In Tidy 5.5.31, the IsURLCodePoint function in attrs.c allows attackers to cause a denial of service (Segmentation Faul…
-
Unscored —
The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the o…
-
Unscored —
net/ipv4/route.c in the Linux kernel 4.13-rc1 through 4.13-rc6 is too late to check for a NULL fi field when RTM_F_FIB_…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to injec…
-
Unscored —
Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remote authent…
-
Unscored —
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local file…
-
Unscored —
ONOS before 1.5.0 when using the ifwd app allows remote attackers to cause a denial of service (NULL pointer dereferenc…
-
Unscored —CVE-2015-7259 Public exploit
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid…
-
Unscored —CVE-2015-7896 Public exploit
LibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memo…
-
Unscored —CVE-2015-7257 Public exploit
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrat…
-
Unscored —
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain…
-
Unscored —
The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potenti…
-
Unscored —
The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to cause a…
-
Unscored —
LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connectio…
-
Unscored —
ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the co…
-
Unscored —
Red Hat Enterprise Virtualization Manager 3.6 and earlier gives valid SLAAC IPv6 addresses to interfaces when "boot pro…
-
Medium 5.9
simplejson before 2.6.1 vulnerable to array index error
Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode functio…
-
Unscored —
app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only impacts the users of t…
-
Unscored —
Cross-site scripting (XSS-STORED) vulnerability in the DEVICES OR SENSORS functionality in Paessler PRTG Network Monito…
-
Unscored —
Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows r…
-
Unscored —
Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 al…
-
High 7.5
The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers t…
-
Unscored —
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
-
Unscored —
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
-
Unscored —
Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTM…
-
Unscored —
The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary …