Archive
11 September 2017
Vulnerabilities first published on this day (UTC), newest first.
82 results · Feed
-
Unscored —
STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, re…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, re…
-
Unscored —
XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a c…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, re…
-
Unscored —
XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a c…
-
Unscored —
XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a c…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, re…
-
Unscored —
XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified othe…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, re…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, re…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, re…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authentic…
-
Unscored —
Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attacker…
-
Unscored —CVE-2015-4523 Public exploit
Blue Coat Malware Analysis Appliance (MAA) before 4.2.5 and Malware Analyzer G2 allow remote attackers to bypass a virt…
-
Unscored —CVE-2017-14075 Public exploit
This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. An attacker mus…
-
Unscored —CVE-2017-14153 Public exploit
This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. An attacker mus…
-
Unscored —
The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow…
-
Unscored —
In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '…
-
Unscored —
EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices allow remote attackers to obtain sensitive information via a JSONP e…
-
High 8.8
TYPO3 Arbitrary Code Execution
Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute…
-
Unscored —CVE-2017-14263 Public exploit
Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a gues…
-
Unscored —
EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect,…
-
Medium 5.4
Dolibarr cross-site scripting (XSS) vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2) CompanyAddress, (3) CompanyZip, (4) CompanyTown, (5) Fax, (6) EMail, (7) Web, (8…
-
Unscored —
In the SDK in Bento4 1.5.0-616, the AP4_StssAtom class in Ap4StssAtom.cpp contains a Write Memory Access Violation vuln…
-
Unscored —
EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices have XSS in the sms_content parameter in a getSMSlist request.
-
Unscored —
In the SDK in Bento4 1.5.0-616, the AP4_StszAtom class in Ap4StszAtom.cpp file contains a Read Memory Access Violation …
-
Unscored —
ImageMagick 7.0.6-8 Q16 mishandles EOF checks in ReadMPCImage in coders/mpc.c, leading to division by zero in GetPixelC…
-
Unscored —
In the SDK in Bento4 1.5.0-616, AP4_AtomSampleTable::GetSample in Core/Ap4AtomSampleTable.cpp contains a Read Memory Ac…
-
Unscored —CVE-2017-14262 Public exploit
On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName J…
-
Unscored —
In the SDK in Bento4 1.5.0-616, SetItemCount in Core/Ap4StscAtom.h file contains a Write Memory Access Violation vulner…
-
Medium 5.4
Dolibarr ERP and CRM contain XSS Vulnerability
Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the Title parameter to htdocs/admin/menus/edit.php.
-
Unscored —
SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the user_id cookie to header.php, a rela…
-
Unscored —
A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3…
-
Critical 9.8
Dolibarr SQL injection vulnerability in don/list.php
SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter.
-
Unscored —
In the SDK in Bento4 1.5.0-616, the AP4_StscAtom class in Ap4StscAtom.cpp contains a Write Memory Access Violation vuln…
-
Unscored —
SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the group_id cookie to side.php.
-
Unscored —
A heap-based buffer over-read in SampleImage() in MagickCore/resize.c in ImageMagick 7.0.6-8 Q16 allows remote attacker…