Archive
September 2017
Vulnerabilities first published in this month (UTC), newest first.
1,228 results · Feed
-
Unscored —
qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.
-
Unscored —
SQL injection vulnerability in Sefrengo before 1.6.5 beta2.
-
Unscored —
Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev.
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Swit…
-
Unscored —
The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field.
-
Unscored —
The out function in controllers/member/Login.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header wi…
-
Unscored —
The oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header wi…
-
Unscored —
The call_msg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP heade…
-
Unscored —
The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service via the url parameter…
-
Unscored —
IBM Emptoris Supplier Lifecycle Management 10.1.0.x is vulnerable to cross-site scripting. This vulnerability allows us…
-
Unscored —
IBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows u…
-
Unscored —
IBM WebSphere Portal and Web Content Manager 6.1, 7.0, and 8.0 is vulnerable to cross-site scripting. This vulnerabilit…
-
Unscored —
DeleteBitBuffer in libbitbuf/bitbuffer.c in mp4tools aacplusenc 0.17.5 allows remote attackers to cause a denial of ser…
-
Unscored —
The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl.
-
Unscored —
The "apetag.c" file in MP3Gain 1.5.2.r2 has a vulnerability which results in a stack memory corruption when opening a c…
-
Unscored —
The "mpglibDBL/layer3.c" file in MP3Gain 1.5.2.r2 has a vulnerability which results in a read access violation when ope…
-
Unscored —CVE-2017-9779 Public exploit
OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but w…
-
Unscored —CVE-2017-9834 Public exploit
SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbit…
-
Unscored —
An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to e…
-
Unscored —
Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API …
-
High 7.5
Exposure of Sensitive Information to an Unauthorized Actor in Apache Directory LDAP API
Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.
-
Unscored —
The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 t…
-
Unscored —
Session fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17.B01 allows remote attac…
-
Unscored —CVE-2017-11567 Public exploit
Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the…
-
Unscored —
Lexmark Scan To Network (SNF) 3.2.9 and earlier stores network configuration credentials in plaintext and transmits the…
-
Unscored —CVE-2017-13754 Public exploit
Cross-site scripting (XSS) vulnerability in the "advanced settings - time server" module in Wibu-Systems CodeMeter befo…
-
Unscored —CVE-2017-13713 Public exploit
T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the use…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in NexusPHP allow remote attackers to inject arbitrary web script o…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack the authentication of…
-
Medium 6.1
Django vulnerable to XSS on 500 pages
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affe…
-
Unscored —
Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Netw…
-
Unscored —
Double free vulnerability in the gdImagePngPtr function in libgd2 before 2.2.5 allows remote attackers to cause a denia…
-
Unscored —
XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Netwo…
-
Unscored —
In the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might occur for the additio…
-
Unscored —
In coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of File) check might cause…
-
Unscored —
In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, an integer signedness error might …
-
Unscored —
In libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of Fil…
-
Unscored —
In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of File) check might cau…
-
Unscored —
In coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an EOF (End of File) check …