Archive
27 September 2017
Vulnerabilities first published on this day (UTC), newest first.
50 results · Feed
-
Unscored —CVE-2017-14845 Public exploit
Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.
-
Unscored —CVE-2017-14846 Public exploit
Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.
-
Unscored —CVE-2017-14842 Public exploit
Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.
-
Unscored —CVE-2017-14840 Public exploit
TeamWork TicketPlus allows Arbitrary File Upload in updateProfile.
-
Unscored —CVE-2017-14847 Public exploit
Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.
-
Unscored —CVE-2017-14839 Public exploit
TeamWork Photo Fusion allows Arbitrary File Upload in changeAvatar and changeCover.
-
Unscored —CVE-2017-14844 Public exploit
Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.
-
Unscored —CVE-2017-14838 Public exploit
TeamWork Job Links allows Arbitrary File Upload in profileChange and coverChange.
-
Unscored —CVE-2017-14841 Public exploit
Mojoomla Annual Maintenance Contract (AMC) Management System allows Arbitrary File Upload in profilesetting image handl…
-
Unscored —CVE-2017-14843 Public exploit
Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.
-
Unscored —
Cross-site scripting (XSS) vulnerability in the sample feedback.inc file in VASCO DIGIPASS authentication plug-in for C…
-
Unscored —
Integer overflow in IHDCP.cpp in the media_server component in Android allows remote attackers to execute arbitrary cod…
-
Unscored —
The media_server component in Android allows remote attackers to cause a denial of service via a crafted application.
-
Unscored —
The Googlemaps plugin 3.2 and earlier for Joomla! allows remote attackers with control of a sub-domain belonging to a v…
-
Unscored —
FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions …
-
Unscored —
ZyXEL NWA1100-N, NWA1100-NH, NWA1121-NI, NWA1123-AC, and NWA1123-NI access points; P-660HN-51, P-663HN-51, VMG1312-B10A…
-
Unscored —
print-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service (segmentation fault and process…
-
Unscored —
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and …
-
Unscored —
Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitra…
-
Unscored —
KDE KMail does not encrypt attachments in emails when "automatic encryption" is enabled, which allows remote attackers …
-
Unscored —CVE-2017-11120 Public exploit
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor rep…
-
Unscored —
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Trans…
-
Unscored —
IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vulnerable to cross-site scripting. This vulnerability allows u…
-
Unscored —
IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or …
-
Unscored —
IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbi…
-
Unscored —
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An att…
-
Unscored —
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x befor…
-
Unscored —CVE-2017-14622 Scanner template
Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPres…
-
Unscored —
Multiple open redirect vulnerabilities in OpenText Documentum Webtop 6.8.0160.0073 allow remote attackers to redirect u…
-
Unscored —
The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (integer…
-
Unscored —
The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (out-of-…
-
Unscored —
Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Webtop 6.8.0160.0073 allow remote authent…
-
Unscored —
Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Administrator 7.2.0180.0055 allow remote …
-
Unscored —CVE-2017-14524 Scanner template
Multiple open redirect vulnerabilities in OpenText Documentum Administrator 7.2.0180.0055 allow remote attackers to red…
-
Critical 9.8
Improper Restriction of XML External Entity Reference in Jelly
During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. Thi…
-
Unscored —
Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.
-
Unscored —
All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, …
-
Medium 5.9
Laravel Sensitive Data Exposure
Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.
-
Unscored —CVE-2015-1336 Public exploit
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access …
-
Unscored —CVE-2015-3643 Public exploit
usb-creator before 0.2.38.3ubuntu0.1 on Ubuntu 12.04 LTS, before 0.2.56.3ubuntu0.1 on Ubuntu 14.04 LTS, before 0.2.62ub…