Archive
September 2017
Vulnerabilities first published in this month (UTC), newest first.
1,228 results · Feed
-
Unscored —
A vulnerability in the Cisco FindIT Network Discovery Utility could allow an authenticated, local attacker to perform a…
-
Unscored —
A vulnerability in the HTTP web interface for Cisco Wide Area Application Services (WAAS) could allow an unauthenticate…
-
Unscored —
A vulnerability in the handling of IP fragments for the Cisco Small Business SPA300, SPA500, and SPA51x Series IP Phone…
-
Unscored —
A vulnerability in the web interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attack…
-
Unscored —
A vulnerability in the Operations, Administration, Maintenance, and Provisioning (OAMP) credential reset functionality …
-
Unscored —
A vulnerability in the web framework code of Cisco Unified Intelligence Center Software could allow an unauthenticated,…
-
Unscored —
A vulnerability in the CLI of Cisco UCS Central Software could allow an authenticated, local attacker to gain shell acc…
-
Unscored —
A vulnerability in the Secure Shell (SSH) subsystem of Cisco Small Business Managed Switches software could allow an au…
-
Unscored —
ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_output_create in coders/sixe…
-
Unscored —
ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_decode in coders/sixel.c.
-
Unscored —
ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function PostscriptDelegateMessage in coder…
-
Unscored —
Portus 2.2.0 has XSS via the Team field, related to typeahead.
-
High 8.1
Access Restriction Bypass in go-ldap
In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function c…
-
Unscored —
The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Dele…
-
Unscored —
In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potenti…
-
Unscored —CVE-2017-14618 Public exploit
Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject…
-
Unscored —CVE-2017-14619 Public exploit
Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web scri…
-
Unscored —
iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature w…
-
Unscored —
An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login e…
-
Unscored —
An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interfac…
-
Unscored —
IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges.
-
Unscored —CVE-2015-7347 Public exploit
Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1.
-
Medium 5.1
-
Medium 6.1
ember-source vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.
-
Medium 6.1
Improper Neutralization of Input During Web Page Generation in IPython
Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.
-
Unscored —
Use-after-free vulnerability in Decoder.cpp in libpgf before 6.15.32.
-
Unscored —
Use-after-free vulnerability in Open Litespeed before 1.3.10.
-
Unscored —
node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service (bandwidth consumption).
-
Unscored —
WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.
-
Unscored —
Open redirect vulnerability in Joomla! CMS 3.0.0 through 3.4.1.
-
Unscored —
Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1.
-
Unscored —
In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username…
-
Unscored —
bareos-dir, bareos-fd, and bareos-sd in bareos-core in Bareos 16.2.6 and earlier create a PID file after dropping privi…
-
Unscored —
In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these arti…
-
Unscored —
The server daemons in Kannel 1.5.0 and earlier create a PID file after dropping privileges to a non-root account, which…
-
Critical 9.8
Path Traversal in Apache Struts
In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side.
-
Medium 5.9
Apache Struts vulnerable to possible DoS attack when using URLValidator
In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
-
Critical 9.8
Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
-
High 7.5
Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing vali…