Archive
6 October 2017
Vulnerabilities first published on this day (UTC), newest first.
35 results · Feed
-
Unscored —
The pre-install script in texlive 3.1.20140525_r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226_r32…
-
Unscored —
Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit al…
-
Medium 5.9
http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.2 allow remote attackers t…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticat…
-
Unscored —CVE-2015-2147 Public exploit
Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arb…
-
Unscored —CVE-2015-2145 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers t…
-
Unscored —
The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP Easy…
-
Unscored —CVE-2015-2142 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote auth…
-
Unscored —
Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arb…
-
Unscored —CVE-2015-2143 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote atta…
-
Unscored —
Cross-site scripting (XSS) vulnerability in OpenKM before 6.4.19 allows remote authenticated users to inject arbitrary …
-
Unscored —CVE-2017-15084 Public exploit
The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22.
-
Unscored —
QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 (for QTS 4.2.x), 5.…
-
Unscored —
The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.
-
High 7.5
Koji blacklisted paths workaround
Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.
-
Unscored —CVE-2017-13068 Public exploit
QNAP has already patched this vulnerability. This security concern allows a remote attacker to perform an SQL injection…
-
Unscored —
The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to unauthorized log configuration changes.
-
Unscored —
The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to a denial of service attack.
-
Unscored —
Heap-based buffer overflow in Google Chrome before M40 allows remote attackers to cause a denial of service (unpaged me…
-
Unscored —
nanohttp in libcsoap allows remote attackers to cause a denial of service (NULL pointer dereference and application cra…
-
Unscored —
Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers …
-
Unscored —
The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain a…
-
Unscored —
Docker before 1.5 allows local users to have unspecified impact via vectors involving unsafe /tmp usage.
-
Unscored —
CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via …
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remot…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin befo…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attacke…
-
Unscored —
libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successf…
-
Unscored —
p_lx_elf.cpp in UPX 3.94 mishandles ELF headers, which allows remote attackers to cause a denial of service (applicatio…
-
High 8.8
Subrion CMS CSRF Vulnerability
There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing (for example) an attack against the query pa…
-
Unscored —
An Unquoted Search Path issue was discovered in mySCADA myPRO Versions 7.0.26 and prior. Application services utilize u…
-
Unscored —
The clusterLoadConfig function in cluster.c in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds…
-
Unscored —
LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3.98.2 and 3.98 has a heap-based buffer over-read in fill_bu…
-
Unscored —
LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a stack-based buffer overflow in unpack_read_samples in fronten…