Archive
September 2017
Vulnerabilities first published in this month (UTC), newest first.
1,228 results · Feed
-
Unscored —
In libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) c…
-
Unscored —
svn-workbench 1.6.2 and earlier on a system with xeyes installed allows local users to execute arbitrary commands by us…
-
High 7.5
LDAP Injection in ldapauth
ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.
-
Unscored —
XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.
-
Medium 5.3
Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to l…
-
Unscored —
simple-php-captcha before commit 9d65a945029c7be7bb6bc893759e74c5636be694 allows remote attackers to automatically gene…
-
Unscored —
XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users t…
-
Unscored —
Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory corruption) or execute…
-
Unscored —
TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to …
-
Unscored —
The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remot…
-
Unscored —
The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape </script> tags in string literals wh…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 allows remo…
-
Unscored —
Honda Moto LINC 1.6.1 does not verify SSL certificates.
-
Unscored —
The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecti…
-
Unscored —
Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled …
-
Unscored —
SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.
-
Unscored —
Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a …
-
Unscored —
Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. NOTE: this vulnerability exi…
-
Unscored —
Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
-
Unscored —
Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database passwo…
-
Unscored —
The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service…
-
Unscored —
A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability c…
-
Unscored —
libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and applica…
-
Unscored —
The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has an issue where memory allocation is excessive be…
-
Unscored —
The AP4_AtomSampleTable::GetSample function in Core/Ap4AtomSampleTable.cpp in Bento4 mp42ts before 1.5.0-616 allows rem…
-
Unscored —
The AP4_AvccAtom::InspectFields function in Core/Ap4AvccAtom.cpp in Bento4 mp4dump before 1.5.0-616 allows remote attac…
-
Unscored —
The AP4_Processor::Process function in Core/Ap4Processor.cpp in Bento4 mp4encrypt before 1.5.0-616 allows remote attack…
-
Unscored —
IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it wou…
-
Unscored —
IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it cou…
-
Unscored —
IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site request forgery…
-
Unscored —
IBM QRadar Network Security 5.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra…
-
Unscored —
IBM QRadar Network Security 5.4 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data.…
-
Unscored —
IBM QRadar Network Security 5.4 supports interaction between multiple actors and allows those actors to negotiate which…
-
Unscored —
Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology firmware versions…
-
High 8.8
An exploitable use-after-free exists in the PDF parsing functionality of Lexmark Perspective Document Filters 11.3.0.24…
-
High 7.5
An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIE…
-
High 7.5
An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially c…
-
High 7.5
An exploitable code execution vulnerability exists in the image rendering functionality of Lexmark Perceptive Document …
-
High 8.8
An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when co…
-
High 8.8
An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pix…