Archive
10 October 2017
Vulnerabilities first published on this day (UTC), newest first.
84 results · Feed
-
Unscored —
A denial of service (DoS) attack in Symantec Endpoint Encryption before SEE 11.1.3HF2 allows remote attackers to make a…
-
Unscored —
A denial of service (DoS) attack in Symantec Encryption Desktop before SED 10.4.1 MP2HF1 allows remote attackers to mak…
-
Medium 6.5
XML External Entity Reference in Apache NiFi
An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prio…
-
Unscored —
MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to …
-
Unscored —
Gurunavi App for iOS before 6.0.0 does not verify SSL certificates which could allow remote attackers to perform man-in…
-
High 7.5
Zend Framework Information Disclosure
Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.
-
Unscored —
Node.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of service.
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in ATutor LMS version 2.2.
-
Medium 6.3
salt leaks git usernames and passwords to the log
salt before 2015.5.5 leaks git usernames and passwords to the log.
-
Unscored —
Rakuten card App for iOS 5.2.0 through 5.2.4 does not verify SSL certificates which might allow remote attackers to exe…
-
Unscored —CVE-2015-8239 Public exploit
The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts o…
-
Unscored —
The sys_amd64 IRET Handler in the kernel in FreeBSD 9.3 and 10.1 allows local users to gain privileges or cause a denia…
-
Unscored —
niconico App for iOS before 6.38 does not verify SSL certificates which could allow remote attackers to execute man-in-…
-
Unscored —
UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands.
-
Unscored —
Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices…
-
Unscored —
libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG file, relate…
-
Unscored —
XML external entity (XXE) vulnerability in the import package functionality of the deployment module in Lansweeper befo…
-
Unscored —
The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are …
-
Unscored —
The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are …
-
Unscored —
Trapeze TransitMaster is vulnerable to information disclosure (emails / hashed passwords) via a modified userID field i…
-
Unscored —
Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain a…
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project o…
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private…
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a private project of ano…
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private pro…
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project…
-
Unscored —
A persistent (stored) XSS vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticat…
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another …
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project …
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of…
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of an…
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another u…
-
Unscored —
include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of …
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of anoth…
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of anot…
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project o…
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of anot…
-
Unscored —
In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project o…
-
Unscored —
Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administr…