Archive
6 September 2017
Vulnerabilities first published on this day (UTC), newest first.
26 results · Feed
-
Unscored —
svn-workbench 1.6.2 and earlier on a system with xeyes installed allows local users to execute arbitrary commands by us…
-
High 7.5
LDAP Injection in ldapauth
ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.
-
Unscored —
XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.
-
Medium 5.3
Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to l…
-
Unscored —
simple-php-captcha before commit 9d65a945029c7be7bb6bc893759e74c5636be694 allows remote attackers to automatically gene…
-
Unscored —
XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users t…
-
Unscored —
Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory corruption) or execute…
-
Unscored —
TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to …
-
Unscored —
The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remot…
-
Unscored —
The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape </script> tags in string literals wh…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 allows remo…
-
Unscored —
Honda Moto LINC 1.6.1 does not verify SSL certificates.
-
Unscored —
The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecti…
-
Unscored —
Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled …
-
Unscored —
SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.
-
Unscored —
Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a …
-
Unscored —
Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. NOTE: this vulnerability exi…
-
Unscored —
Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
-
Unscored —
Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database passwo…
-
Unscored —
The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service…
-
Unscored —
A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability c…
-
Unscored —
libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and applica…
-
Unscored —
The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has an issue where memory allocation is excessive be…
-
Unscored —
The AP4_AtomSampleTable::GetSample function in Core/Ap4AtomSampleTable.cpp in Bento4 mp42ts before 1.5.0-616 allows rem…
-
Unscored —
The AP4_AvccAtom::InspectFields function in Core/Ap4AvccAtom.cpp in Bento4 mp4dump before 1.5.0-616 allows remote attac…
-
Unscored —
The AP4_Processor::Process function in Core/Ap4Processor.cpp in Bento4 mp4encrypt before 1.5.0-616 allows remote attack…