Archive
18 October 2017
Vulnerabilities first published on this day (UTC), newest first.
54 results · Feed
-
Unscored —
In GNU Libextractor 1.4, there is a NULL Pointer Dereference in the EXTRACTOR_nsf_extract_method function of plugins/ns…
-
Unscored —
In GNU Libextractor 1.4, there is a heap-based buffer overflow in the EXTRACTOR_png_extract_method function in plugins/…
-
Unscored —
In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR_nsfe_extract_method f…
-
Unscored —
Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary w…
-
Unscored —
The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url param…
-
Unscored —
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remo…
-
Unscored —
Request smuggling due to improper header parsing in net/http
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead o…
-
Unscored —
SQL injection vulnerability in the login form in GSI WiNPAT Portal 3.2.0.1001 through 3.6.1.0 allows remote attackers t…
-
Unscored —CVE-2015-7714 Public exploit
Multiple SQL injection vulnerabilities in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allow remote ad…
-
Unscored —CVE-2015-7715 Public exploit
Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows…
-
Unscored —
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.…
-
Unscored —
Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to b…
-
Unscored —CVE-2017-15359 Public exploit
In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory …
-
Unscored —
The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior…
-
Unscored —CVE-2017-14956 Public exploit
AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "…
-
Unscored —
Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome,…
-
Unscored —
The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated user…
-
Unscored —
sharenfs 0.6.4, when built with commits bcdd594 and 7d08880 from the zfs repository, provides world readable access to …
-
High 7.5
Information Exposure in Netty
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveragin…
-
Unscored —
An issue was discovered in EMC NetWorker (prior to 8.2.4.9, all supported 9.0.x versions, prior to 9.1.1.3, prior to 9.…
-
Unscored —
scanf and related functions in glibc before 2.15 allow local users to cause a denial of service (segmentation fault) vi…
-
Unscored —
The SumaHo application 3.0.0 and earlier for Android and the SumaHo "driving capability" diagnosis result transmission …
-
Unscored —
Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource …
-
Unscored —
cmds/servicemanager/service_manager.c in Android before commit 7d42a3c31ba78a418f9bdde0e0ab951469f321b5 allows attacker…
-
High 8.8
JBoss Keycloak CSRF Vulnerability
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.
-
Unscored —
ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to ve…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Foreman before 1.5.2 allow remote authenticated users to inject …
-
Unscored —
The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a req…
-
Medium 5.3
Akeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over …
-
Unscored —
EMC Isilon OneFS (versions prior to 8.1.0.1, versions prior to 8.0.1.2, versions prior to 8.0.0.6, version 7.2.1.x) is …
-
Unscored —
An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service (hyperviso…
-
Unscored —
An integer overflow was discovered in pdf_read_new_xref_section in pdf/pdf-xref.c in Artifex MuPDF 1.11.
-
Unscored —
The embedded web server on ABB Fox515T 1.0 devices is vulnerable to Local File Inclusion. It accepts a parameter that s…
-
Unscored —
An issue was discovered in Xen 4.4.x through 4.9.x allowing ARM guest OS users to cause a denial of service (prevent ph…
-
Unscored —
An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the h…
-
Unscored —
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS be…
-
Unscored —
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (memory leak) …
-
Unscored —
An issue was discovered in Xen 4.5.x through 4.9.x allowing attackers (who control a stub domain kernel or tool stack) …
-
Unscored —
An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service (hypervisor c…
-
Unscored —
An issue was discovered in Xen through 4.9.x allowing x86 guest OS users to cause a denial of service (hypervisor crash…