Archive
28 September 2017
Vulnerabilities first published on this day (UTC), newest first.
40 results · Feed
-
Unscored —
It was found that the App Studio component of RHMAP 4.4 executes javascript provided by a user. An attacker could use t…
-
Unscored —
A flaw was discovered in the file editor of millicore, affecting versions before 3.19.0 and 4.x before 4.5.0, which all…
-
High 7.5
Denial of service in Apache Mesos
When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev might crash because the code accidentally calls inappropriate function. A malicious ac…
-
Unscored —
The external_request api call in App Studio (millicore) allows server side request forgery (SSRF). An attacker could us…
-
High 7.5
Use after free in Apache Mesos
When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with …
-
Unscored —
The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent H…
-
Unscored —
The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obt…
-
Unscored —
Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker …
-
Unscored —
An error was found in the X-Pack Security 5.3.0 to 5.5.2 privilege enforcement. If a user has either 'delete' or 'index…
-
Unscored —
The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper. …
-
Unscored —
An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built…
-
Unscored —
Cross site scripting (XSS) vulnerability in SAP Enterprise Portal 7.50 allows remote attackers to inject arbitrary web …
-
Unscored —CVE-2017-14507 Public exploit
Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to exe…
-
Unscored —CVE-2017-14867 EPSS 36%
Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsa…
-
High 7.5CVE-2017-12231 Exploited
A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS 12.4 through 15.6…
KEV Mar 3, 2022 -
High 7.5CVE-2017-12234 Exploited
Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 throug…
KEV Mar 3, 2022 -
Unscored —
A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 thro…
-
High 7.5CVE-2017-12233 Exploited
Multiple vulnerabilities in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS 12.4 throug…
KEV Mar 3, 2022 -
Unscored —
A vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software for Cisco 5760 Wireless LAN Controlle…
-
Unscored —
A vulnerability in the REST API of the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 could allow a…
-
Medium 6.5CVE-2017-12232 Exploited
A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers …
KEV Mar 3, 2022 -
Critical 9.8
The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could a…
KEV Mar 3, 2022 -
Unscored —
A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote atta…
-
Unscored —
A vulnerability in the wireless controller manager of Cisco IOS XE could allow an unauthenticated, adjacent attacker to…
-
High 7.5CVE-2017-12237 Exploited
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS 15.0 through 15.6 and Cisco IOS XE 3…
KEV Mar 3, 2022 -
Medium 6.5CVE-2017-12238 Exploited
A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 S…
KEV Mar 3, 2022 -
Unscored —
A vulnerability in motherboard console ports of line cards for Cisco ASR 1000 Series Aggregation Services Routers and C…
-
Unscored —
A vulnerability in the implementation of the Locator/ID Separation Protocol (LISP) in Cisco IOS XE 3.2 through 16.5 cou…
-
High 7.5CVE-2017-12235 Exploited
A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS 12.2 …
KEV Mar 3, 2022 -
Unscored —
A NULL pointer dereference was discovered in Exiv2::Image::printIFDStructure in image.cpp in Exiv2 0.26. The vulnerabil…
-
Unscored —
There is a heap-based buffer over-read in the Exiv2::Jp2Image::readMetadata function of jp2image.cpp in Exiv2 0.26. A C…
-
Unscored —
There is a heap-based buffer overflow in the Exiv2::l2Data function of types.cpp in Exiv2 0.26. A Crafted input will le…
-
Unscored —
There is a stack consumption vulnerability in the Exiv2::Internal::stringFormat function of image.cpp in Exiv2 0.26. A …
-
Unscored —
In Exiv2 0.26, there is an invalid free in the Image class in image.cpp that leads to a Segmentation fault. A crafted i…
-
Unscored —
There is a heap-based buffer overflow in the Exiv2::s2Data function of types.cpp in Exiv2 0.26. A Crafted input will le…
-
Unscored —
There is a heap-based buffer overflow in the Exiv2::us2Data function of types.cpp in Exiv2 0.26. A Crafted input will l…
-
Unscored —
An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The vulnerab…
-
Unscored —
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was in…
-
Unscored —
An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26. The vulnerability c…
-
Unscored —
An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vu…