Skip to content
OpenAdvisories

Archive

12 October 2017

Vulnerabilities first published on this day (UTC), newest first.

← September 2017 2017 / October /12 November 2017 →
  1. 110
  2. 264
  3. 343
  4. 456
  5. 543
  6. 635
  7. 7 
  8. 8 
  9. 913
  10. 1084
  11. 1155
  12. 1223
  13. 1398
  14. 143
  15. 156
  16. 1643
  17. 1741
  18. 1854
  19. 19229
  20. 2019
  21. 2112
  22. 2260
  23. 23118
  24. 2434
  25. 257
  26. 2631
  27. 27102
  28. 288
  29. 2930
  30. 3031
  31. 3146
All Critical High Medium Low Exploited only Public exploit

23 results · Feed

  • Critical 9.8
    CVE-2016-8736

    Apache OpenMeetings RCE

    Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack.

    Apache Software Foundation Apache OpenMeetings org.apache.openmeetings:openmeetings-parent Maven
  • Unscored —
    CVE-2016-9263

    WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to con…

    wordpress Debian
  • Unscored —
    CVE-2017-15290

    Mirasys Video Management System (VMS) 6.x before 6.4.6, 7.x before 7.5.15, and 8.x before 8.1.1 has a login process in …

  • Unscored —
    CVE-2015-6358

    Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allo…

  • Medium 5.3
    CVE-2017-12849

    Silverstripe CMS User Enumeration

    Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.

    silverstripe/cms Packagist
  • Unscored —
    CVE-2017-15287 Public exploit Scanner template

    There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices, as demonstrated by the "Name des Bou…

  • Unscored —
    CVE-2017-15268

    Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, rel…

    qemu Debian
  • Medium 5.3
    CVE-2017-10862

    Insufficient Data Verification in io.really:jwt-scala

    jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token.

    reallyl IO jwt-scala io.really:jwt-scala Maven
  • Unscored —
    CVE-2017-10864

    Untrusted search path vulnerability in Installer of HIBUN Confidential File Viewer prior to 11.20.0001 allows an attack…

    Hitachi Solutions Installer of HIBUN Confidential File Viewer
  • Unscored —
    CVE-2017-10865

    Untrusted search path vulnerability in HIBUN Confidential File Decryption program prior to 10.50.0.5 allows an attacker…

    Hitachi Solutions HIBUN Confidential File Decryption program
  • Unscored —
    CVE-2017-10857

    Cybozu Office 10.0.0 to 10.6.1 allows authenticated attackers to bypass access restriction to perform arbitrary actions…

    Cybozu Cybozu Office
  • Unscored —
    CVE-2017-10863

    Untrusted search path vulnerability in HIBUN Confidential File Decryption program prior to 10.50.0.5 allows an attacker…

    Hitachi Solutions HIBUN Confidential File Decryption program
  • Unscored —
    CVE-2017-9514

    Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not…

    Atlassian Bamboo
  • Medium 5.5
    CVE-2017-15280

    Umbraco CMS XXE Vulnerability

    XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialo…

    UmbracoCms.Web NuGet
  • Medium 5.4
    CVE-2017-15284 Public exploit

    OctoberCMS Cross-Site Scripting

    Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context …

    october/rain Packagist
  • Unscored —
    CVE-2017-15285

    X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because t…

  • Unscored —
    CVE-2017-15277 Public exploit EPSS 19%

    ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when pro…

    imagemagick imagemagick graphicsmagick graphicsmagick Debian Ubuntu Alpine
  • Unscored —
    CVE-2017-15286

    SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases w…

    sqlite3 sqlite Debian Alpine
  • Medium 5.4
    CVE-2017-15278

    TeamPass Cross-Site Scripting (XSS)

    Cross-Site Scripting (XSS) was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data (in /sources/folders.queries.php). An attacker could execute arbitrary HTML and script code in a browser in the context of t…

    nilsteampassnet/teampass Packagist
  • Medium 5.4
    CVE-2017-15279

    Umbraco CMS vulnerable to stored XSS

    Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publi…

    UmbracoCms.Web NuGet
  • Unscored —
    CVE-2017-15281

    ReadPSDImage in coders/psd.c in ImageMagick 7.0.7-6 allows remote attackers to cause a denial of service (application c…

    imagemagick imagemagick Debian Ubuntu
  • Unscored —
    CVE-2017-12192

    The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • Unscored —
    CVE-2017-15274

    security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in conjunction wi…

    linux-raspi2 linux-hwe linux-riscv linux-gcp Debian Ubuntu