Archive
September 2017
Vulnerabilities first published in this month (UTC), newest first.
1,228 results · Feed
-
Unscored —
Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to re…
-
Unscored —
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resul…
-
Unscored —
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection v…
-
Medium 4.3
Apache Geode gfsh query vulnerability
When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently execu…
-
High 7.8
Apache Tika does not properly initialize the XML parser or choose handlers
Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other…
-
Unscored —
Unisys Libra 64xx and 84xx and FS601 class systems with MCP-FIRMWARE before 43.211 allow remote authenticated users to …
-
Unscored —
Artifex GSView 6.0 Beta on Windows allows attackers to cause a denial of service or possibly have unspecified other imp…
-
Unscored —
The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SS…
-
Unscored —
Artifex GSView 6.0 Beta on Windows allows attackers to cause a denial of service or possibly have unspecified other imp…
-
Unscored —
Artifex GSView 6.0 Beta on Windows allows attackers to execute arbitrary code or cause a denial of service via a crafte…
-
Unscored —CVE-2017-14942 EPSS 61%
Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication…
-
Unscored —
Inedo ProGet before 4.7.14 does not properly address dangerous package IDs during package addition, aka PG-1060.
-
Unscored —
A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, …
-
Unscored —
A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, …
-
Unscored —
MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDA…
-
Unscored —
_bfd_elf_slurp_version_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU …
-
Unscored —
scan_unit_for_symbols in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binut…
-
Unscored —CVE-2017-14939 Public exploit
decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2…
-
Unscored —
A potential security vulnerability has been identified in HPE Application Performance Management (BSM) Platform version…
-
Unscored —CVE-2017-14620 Public exploit
SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQ…
-
Unscored —
An insufficient access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c …
-
Unscored —
An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9…
-
Unscored —
An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patc…
-
Unscored —
A reflected Cross-Site Scripting(XSS) vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to …
-
Unscored —
An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 …
-
Unscored —
An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9…
-
Unscored —
A directory traversal vulnerability in HPE BSM Platform Application Performance Management System Health product versio…
-
Unscored —
An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 …
-
Unscored —
An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patc…
-
Unscored —
An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9…
-
Unscored —CVE-2017-14702 Public exploit
ERS Data System 1.8.1.0 allows remote attackers to execute arbitrary code, related to "com.branaghgroup.ecers.update.Up…
-
Unscored —
An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view al…
-
Unscored —
Memory leak in decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in…
-
Unscored —
read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binu…
-
Unscored —
decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2…
-
Unscored —
process_debug_info in dwarf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils …
-
Unscored —
Pulse Secure Pulse One On-Premise 2.0.1649 and below does not properly validate requests, which allows remote users to …
-
Unscored —
ExifImageFile::readDQT in ExifImageFileRead.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service …
-
Unscored —CVE-2017-14738 Public exploit
FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize i…
-
Unscored —
In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF …