Archive
19 September 2017
Vulnerabilities first published on this day (UTC), newest first.
45 results · Feed
-
Unscored —CVE-2015-4684 Public exploit
Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allow (1) r…
-
Unscored —CVE-2015-4682 Public exploit
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installatio…
-
Unscored —CVE-2015-4681 Public exploit
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users to have unspecified impact via vectors r…
-
Unscored —CVE-2015-4683 Public exploit
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows attackers to obtain sensitive information and potent…
-
Unscored —CVE-2015-4685 Public exploit
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain …
-
Critical 9.8
CodeIgniter and Kohana vulnerable to PHP Object Injection
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare…
-
Unscored —
CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR…
-
Unscored —
Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 a…
-
Unscored —
Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-…
-
Unscored —
AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain …
-
Unscored —
Astaro Security Gateway (aka ASG) 7 allows remote attackers to execute arbitrary code via a crafted request to index.pl…
-
High 8.8CVE-2017-10784 EPSS 16%
WEBrick RCE Vulnerability
The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user nam…
-
High 7.5
Ruby OpenSSL DoS Vulnerability
The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string.
-
Unscored —
The Linux kernel, as used in Red Hat Enterprise Linux 7, kernel-rt, and Enterprise MRG 2 and when booted with UEFI Secu…
-
Unscored —CVE-2017-14311 Public exploit
The Winring0x32.sys driver in NetMechanica NetDecision 5.8.2 allows local users to gain privileges via a crafted 0x9C40…
-
Unscored —
The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of serv…
-
Unscored —
Cisco Cloud Web Security before 3.0.1.7 allows remote attackers to bypass intended filtering protection mechanisms by l…
-
Unscored —
389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entri…
-
Medium 5.4
Kallithea cross-site scripting (XSS) vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name user details, or the (3) repository, (4) repository…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastes…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote att…
-
Unscored —
Pydio (formerly AjaXplorer) before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors,…
-
Medium 6.1
phpBB Open Redirect
Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.
-
Unscored —
The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a de…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Pydio (formerly AjaXplorer) before 6.0.7 allow remote attackers …
-
Unscored —
vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private message…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0 SP2, 6.0.4, and 6.0.5 allows remote…
-
Unscored —
eDeploy makes it easier for remote attackers to execute arbitrary code by leveraging use of HTTP to download files.
-
Unscored —CVE-2014-9619 Public exploit
Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0…
-
Unscored —
Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via…
-
Unscored —
The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote at…
-
Unscored —
Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive inform…
-
Unscored —CVE-2014-9610 Public exploit
Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication a…
-
Unscored —
The admin interface in Landesk Management Suite 9.6 and earlier allows remote attackers to conduct remote file inclusio…
-
Unscored —
In the medialibrary component in QNAP NAS 4.3.3.0229, an un-authenticated, remote attacker can execute arbitrary system…
-
Unscored —
The wiki_decode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to…
-
Unscored —
The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, w…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Kaltura before 13.2.0 allow remote attackers to inject arbitrary…
-
Unscored —
The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in o…
-
Unscored —
The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulti…