Skip to content
OpenAdvisories

Archive

25 September 2017

Vulnerabilities first published on this day (UTC), newest first.

← August 2017 2017 / September /25 October 2017 →
  1. 130
  2. 24
  3. 39
  4. 412
  5. 526
  6. 626
  7. 777
  8. 858
  9. 914
  10. 102
  11. 1182
  12. 1250
  13. 13136
  14. 14130
  15. 1526
  16. 16 
  17. 1720
  18. 1859
  19. 1945
  20. 2051
  21. 2182
  22. 2241
  23. 2311
  24. 24 
  25. 2568
  26. 2630
  27. 2750
  28. 2840
  29. 2948
  30. 301
All Critical High Medium Low Exploited only Public exploit

68 results · Feed

  • Unscored —
    CVE-2015-7544

    redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote aut…

  • High 8.8
    CVE-2015-7293 Public exploit

    Plone vulnerable to cross-site request forgery

    Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.

    plone PyPI
  • Unscored —
    CVE-2015-7510

    Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.

    systemd Debian
  • Unscored —
    CVE-2015-7785

    GANMA! App for iOS does not verify SSL certificates.

  • Unscored —
    CVE-2015-7846

    Huawei S7700, S9700, S9300 before V200R07C00SPC500, and AR200, AR1200, AR2200, AR3200 before V200R005C20SPC200 allows a…

  • Unscored —
    CVE-2015-6592

    Huawei UAP2105 before V300R012C00SPC160(BootRom) does not require authentication to the serial port or the VxWorks shel…

  • Unscored —
    CVE-2015-8375

    Cross-site scripting (XSS) vulnerability in PHP-Fusion 9.

  • Unscored —
    CVE-2015-8251

    OpenStage 60 and OpenScape Desk Phone IP 55G SIP V3, OpenStage 15, 20E, 20 and 40 and OpenScape Desk Phone IP 35G SIP V…

  • Unscored —
    CVE-2015-5666

    ANA App for Android 3.1.1 and earlier, and ANA App for iOS 3.3.6 and earlier does not verify SSL certificates.

  • Unscored —
    CVE-2015-5704

    scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands.

    devscripts Debian
  • Unscored —
    CVE-2015-5184

    Console: CORS headers set to allow all in Red Hat AMQ.

  • Unscored —
    CVE-2015-5182

    Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ.

  • Medium 6.1
    CVE-2015-5169

    Cross-site Scripting in Apache Struts

    Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.

    org.apache.struts:struts2-core Maven
  • Unscored —
    CVE-2015-5327

    Out-of-bounds memory read in the x509_decode_time function in x509_cert_parser.c in Linux kernels 4.3-rc1 and after.

  • Unscored —
    CVE-2015-5183

    Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.

  • Unscored —
    CVE-2015-5181

    The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.

  • Unscored —
    CVE-2015-5263

    pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the ser…

  • Unscored —
    CVE-2011-4667

    The encryption library in Cisco IOS Software 15.2(1)T, 15.2(1)T1, and 15.2(2)T, Cisco NX-OS in Cisco MDS 9222i Multiser…

  • Unscored —
    CVE-2012-6696

    inspircd in Debian before 2.0.7 does not properly handle unsigned integers. NOTE: This vulnerability exists because of …

    inspircd inspircd Debian Ubuntu
  • Unscored —
    CVE-2016-5868

    drivers/net/ethernet/msm/rndis_ipa.c in the Qualcomm networking driver in Android allows remote attackers to execute ar…

  • Unscored —
    CVE-2017-14733

    ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows …

    graphicsmagick graphicsmagick graphicsmagick Debian Ubuntu Alpine
  • Unscored —
    CVE-2017-14734

    The build_msps function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (heap-based bu…

  • Unscored —
    CVE-2017-14731

    ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buff…

    libofx libofx Debian Ubuntu
  • Medium 6.1
    CVE-2017-14735 Public exploit

    OWASP AntiSamy Cross-site Scripting vulnerability

    OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.

    libowasp-antisamy-java org.owasp.antisamy:antisamy libowasp-antisamy-java Debian Ubuntu Maven
  • Unscored —
    CVE-2015-0238

    selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privileg…

  • Unscored —
    CVE-2015-8707

    Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not…

  • Unscored —
    CVE-2014-0997 Public exploit

    WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used …

  • Unscored —
    CVE-2014-8156

    The D-Bus security policy files in /etc/dbus-1/system.d/*.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512…

  • Unscored —
    CVE-2014-8170

    ovirt_safe_delete_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packa…

  • Unscored —
    CVE-2014-8889

    Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware o…

  • Unscored —
    CVE-2017-7974

    A path traversal information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions…

    Schneider Electric U.Motion ICS / OT
  • Unscored —
    CVE-2017-7970

    A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and P…

    Schneider Electric Citect Anywhere PowerSCADA Anywhere ICS / OT
  • Unscored —
    CVE-2017-7972

    A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and P…

    Schneider Electric Citect Anywhere PowerSCADA Anywhere ICS / OT
  • Unscored —
    CVE-2017-7971

    A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and P…

    Schneider Electric PowerSCADA Anywhere Citect Anywhere ICS / OT
  • Unscored —
    CVE-2017-7969

    A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA An…

    Schneider Electric PowerSCADA Anywhere Citect Anywhere ICS / OT
  • Unscored —
    CVE-2017-7973

    A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in whic…

    Schneider Electric U.Motion ICS / OT
  • Unscored —
    CVE-2017-9961

    A vulnerability exists in Schneider Electric's Pro-Face GP Pro EX version 4.07.000 that allows an attacker to execute a…

    Schneider Electric ProFace GP-Pro EX ICS / OT
  • Unscored —
    CVE-2017-9960

    An information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and pri…

    Schneider Electric U.Motion ICS / OT
  • Unscored —
    CVE-2017-9962

    Schneider Electric's ClearSCADA versions released prior to August 2017 are susceptible to a memory allocation vulnerabi…

    Schneider Electric ClearSCADA ICS / OT
  • Unscored —
    CVE-2017-9959

    A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system a…