Skip to content
OpenAdvisories

Archive

13 September 2017

Vulnerabilities first published on this day (UTC), newest first.

← August 2017 2017 / September /13 October 2017 →
  1. 130
  2. 24
  3. 39
  4. 412
  5. 526
  6. 626
  7. 777
  8. 858
  9. 914
  10. 102
  11. 1182
  12. 1250
  13. 13136
  14. 14130
  15. 1526
  16. 16 
  17. 1720
  18. 1859
  19. 1945
  20. 2051
  21. 2182
  22. 2241
  23. 2311
  24. 24 
  25. 2568
  26. 2630
  27. 2750
  28. 2840
  29. 2948
  30. 301
All Critical High Medium Low Exploited only Public exploit

136 results · Feed

  • Unscored —
    CVE-2017-12249

    A vulnerability in the Traversal Using Relay NAT (TURN) server included with Cisco Meeting Server (CMS) could allow an …

  • Unscored —
    CVE-2017-14431

    Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory …

    xen xen Debian Ubuntu
  • Unscored —
    CVE-2017-1508

    IBM Informix Dynamic Server 12.1 could allow a local user logged in with database administrator user to gain root privi…

    IBM Informix Servers
  • Unscored —
    CVE-2017-1556

    IBM API Connect 5.0.7.0 through 5.0.7.2 is vulnerable to a regular expression attack that could allow an authenticated …

    IBM API Connect
  • High 8.8
    CVE-2017-2816

    An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially craf…

    LibOFX LibOfx libofx libofx Debian Ubuntu
  • Unscored —
    CVE-2017-7560

    It was found that rhnsd PID files are created as world-writable that allows local attackers to fill the disks or to kil…

    Red Hat rhnsd
  • High 7.5
    CVE-2017-7561

    Inconsistent Interpretation of HTTP Requests in Red Hat JBoss EAP

    Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact.

    Red Hat RESTEasy resteasy3.0 resteasy3.0 Debian Ubuntu Maven
  • Unscored —
    CVE-2017-14414

    D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs…

  • Unscored —
    CVE-2017-14430

    D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devi…

  • Unscored —
    CVE-2017-14418

    The D-Link NPAPI extension, as used in conjunction with D-Link DIR-850L REV. B (with firmware through FW208WWb02) devic…

  • Critical 9.8
    CVE-2017-14429

    The DHCP client on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware throu…

  • Unscored —
    CVE-2017-14424

    D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devi…

  • Unscored —
    CVE-2017-14428

    D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devi…

  • Unscored —
    CVE-2017-14425

    D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devi…

  • Unscored —
    CVE-2017-14419

    The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B …

  • Unscored —
    CVE-2017-14421

    D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices have a hardcoded password of wrgac25_dlink.2013gui_di…

  • Unscored —
    CVE-2017-14420

    The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B …

  • Unscored —
    CVE-2017-14427

    D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devi…

  • Unscored —
    CVE-2017-14417

    register_send.php on D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices does not require authentication,…

  • Unscored —
    CVE-2017-14422

    D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devi…

  • Unscored —
    CVE-2017-14415

    D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs…

  • Unscored —
    CVE-2017-14416

    D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs…

  • Unscored —
    CVE-2017-14423

    htdocs/parentalcontrols/bind.php on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices does n…

  • Unscored —
    CVE-2017-14426

    D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devi…

  • Unscored —
    CVE-2017-14413

    D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs…

  • Unscored —
    CVE-2015-7880

    The Entity Registration module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to obtain sensitive event regi…

  • Unscored —
    CVE-2015-2750

    Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote at…

    drupal7 Ubuntu
  • Unscored —
    CVE-2015-2749

    Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to …

    drupal7 Ubuntu
  • Unscored —
    CVE-2015-5168

    Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown im…

    trafficserver trafficserver Debian Ubuntu
  • Unscored —
    CVE-2015-5206

    Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unk…

    trafficserver trafficserver Debian Ubuntu
  • High 8.8
    CVE-2016-8737

    Apache Brooklyn is vulnerable to cross-site request forgery (CSRF)

    In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the att…

    Apache Software Foundation Apache Brooklyn org.apache.brooklyn:brooklyn-rest-resources org.apache.brooklyn:brooklyn-jsgui Maven
  • High 8.8
    CVE-2016-8744

    Deserialization of Untrusted Data in Apache Brooklyn

    Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalli…

    Apache Software Foundation Apache Brooklyn org.apache.brooklyn:brooklyn Maven
  • Unscored —
    CVE-2017-11462

    Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involvin…

    krb5 krb5 Debian Ubuntu
  • High 7.8
    CVE-2017-12612

    Apache Spark Deserialization of Untrusted Data vulnerability

    In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with…

    pyspark org.apache.spark:spark-core_2.11 org.apache.spark:spark-core_2.10 Maven PyPI
  • Medium 5.4
    CVE-2017-3165

    Cross-site Scripting In Apache Brooklyn

    In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of s…

    Apache Software Foundation Apache Brooklyn org.apache.brooklyn:brooklyn Maven
  • Unscored —
    CVE-2017-14124

    In eLux RP 5.x before 5.5.1000 LTSR and 5.6.x before 5.6.2 CR when classic desktop mode is used, it is possible to star…

  • Unscored —
    CVE-2017-6330

    Symantec Encryption Desktop before SED 10.4.1MP2 can allow remote attackers to cause a denial of service (resource cons…

    Symantec Symantec Encryption Desktop
  • Unscored —
    CVE-2017-7441

    In Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean), a cr…

  • Unscored —
    CVE-2017-11350

    Cross-Site Request Forgery (CSRF) exists in cgi-bin/ConfigSet on Axesstel MU553S MU55XS-V1.14 devices.

  • Unscored —
    CVE-2017-11351

    Axesstel MU553S MU55XS-V1.14 devices have a default password of admin for the admin account.