Archive
September 2017
Vulnerabilities first published in this month (UTC), newest first.
1,228 results · Feed
-
Unscored —
A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and P…
-
Unscored —
A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and P…
-
Unscored —
A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and P…
-
Unscored —
A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA An…
-
Unscored —
A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in whic…
-
Unscored —
A vulnerability exists in Schneider Electric's Pro-Face GP Pro EX version 4.07.000 that allows an attacker to execute a…
-
Unscored —
An information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and pri…
-
Unscored —
Schneider Electric's ClearSCADA versions released prior to August 2017 are susceptible to a memory allocation vulnerabi…
-
Unscored —
A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system a…
-
Unscored —
An improper access control vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and pr…
-
Unscored —
A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the web serv…
-
Unscored —
An authentication bypass vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prio…
-
Medium 6.1
Plone Cross-site Scripting Vulnerability
Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.
-
Unscored —
Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticate…
-
High 7.5
Plone Header Injection
Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.
-
Medium 5.9
Plone unauthorized member addition vulnerability
Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.
-
Unscored —
Multiple hardcoded credentials in Xsuite 2.x.
-
Unscored —CVE-2015-4669 Public exploit
The MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to access databases on the s…
-
Unscored —
Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web si…
-
Medium 6.1CVE-2015-6748 Public exploit
Improper Neutralization of Input During Web Page Generation in Jsoup
Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.
-
High 8.8
protobuf susceptible to buffer overflow
protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
-
Unscored —
Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.
-
Unscored —
Cisco IOS before 12.2(33)SXI allows remote authenticated users to cause a denial of service (device reboot).
-
Unscored —
Cisco IOS before 12.2(33)SXI allows local users to cause a denial of service (device reboot).
-
Unscored —
Server Side Request Forgery vulnerability in Vebto Pixie Image Editor 1.4 and 1.7 allows remote attackers to disclose i…
-
Unscored —
SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers t…
-
Unscored —
The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls f…
-
Unscored —
IBM API Connect 5.0.0.0 through 5.0.7.2 could allow an authenticated user to generate an API token when not subscribed …
-
Unscored —
IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by …
-
Unscored —CVE-2017-1235 Public exploit
IBM WebSphere MQ 8.0 could allow an authenticated user to cause a premature termination of a client application thread …
-
Unscored —
IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi…
-
Unscored —
IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs w…
-
Unscored —
IBM API Connect 5.0.0.0 through 5.0.7.2 could allow a remote attacker to hijack the clicking action of the victim. By p…
-
Unscored —
Mahara 15.04 before 15.04.14 and 16.04 before 16.04.8 and 16.10 before 16.10.5 and 17.04 before 17.04.3 are vulnerable …
-
Unscored —
The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Bi…
-
High 8.8
Gem in a Box vulnerable to Cross-site Request Forgery
geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.
-
Medium 5.4
Gem in a Box vulnerable to Cross-site Scripting
geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file.
-
Unscored —
Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme fi…
-
Unscored —
Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual ed…
-
Unscored —
Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus d…