Archive
September 2017
Vulnerabilities first published in this month (UTC), newest first.
1,228 results · Feed
-
Medium 5.4
Kallithea cross-site scripting (XSS) vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name user details, or the (3) repository, (4) repository…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastes…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote att…
-
Unscored —
Pydio (formerly AjaXplorer) before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors,…
-
Medium 6.1
phpBB Open Redirect
Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.
-
Unscored —
The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a de…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Pydio (formerly AjaXplorer) before 6.0.7 allow remote attackers …
-
Unscored —
vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private message…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0 SP2, 6.0.4, and 6.0.5 allows remote…
-
Unscored —
eDeploy makes it easier for remote attackers to execute arbitrary code by leveraging use of HTTP to download files.
-
Unscored —CVE-2014-9619 Public exploit
Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0…
-
Unscored —
Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via…
-
Unscored —
The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote at…
-
Unscored —
Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to obtain sensitive inform…
-
Unscored —CVE-2014-9610 Public exploit
Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication a…
-
Unscored —
The admin interface in Landesk Management Suite 9.6 and earlier allows remote attackers to conduct remote file inclusio…
-
Unscored —
In the medialibrary component in QNAP NAS 4.3.3.0229, an un-authenticated, remote attacker can execute arbitrary system…
-
Unscored —
The wiki_decode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to…
-
Unscored —
The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, w…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Kaltura before 13.2.0 allow remote attackers to inject arbitrary…
-
Unscored —
The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in o…
-
Unscored —
The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulti…
-
High 8.1
When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could th…
KEV Mar 25, 2022 -
High 7.5CVE-2017-12616 EPSS 70%
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
-
Unscored —
Pragyan CMS v3.0 is vulnerable to a Boolean-based SQL injection in cms/admin.lib.php via $_GET['forwhat'], resulting in…
-
Unscored —
Pragyan CMS v3.0 is vulnerable to an Error-Based SQL injection in cms/admin.lib.php via $_GET['del_black'], resulting i…
-
Unscored —
AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc…
-
Unscored —
The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitter's server certificates for the /1.1/help/settin…
-
High 7.5
Apache Solr Kerberos delegation token functionality flaws
Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality (when using SecurityAwareZkACLProvider type o…
-
Unscored —
In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undis…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, re…
-
Unscored —
XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified othe…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, re…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, re…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, re…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .djvu file, r…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, re…
-
Unscored —
STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft…