Archive
19 October 2017
Vulnerabilities first published on this day (UTC), newest first.
229 results · Feed
-
Unscored —
musl libc before 1.1.17 has a buffer overflow via crafted DNS replies because dns_parse_callback in network/lookup_name…
-
Unscored —
An Uncontrolled Search Path Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. An uncontrolled…
-
Unscored —
An Unquoted Search Path or Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. An unquoted sear…
-
Unscored —CVE-2017-15645 Public exploit
CSRF exists in Webmin 1.850. By sending a GET request to at/create_job.cgi containing dir=/&cmd= in the URI, an attacke…
-
Unscored —
In PHPSUGAR PHP Melody before 2.7.3, page_manager.php has XSS via the page_title parameter.
-
Unscored —CVE-2017-15646 Public exploit
Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Dow…
-
Unscored —
On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a cr…
-
Unscored —CVE-2017-15644 Public exploit
SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/…
-
Unscored —CVE-2017-15643 Public exploit
An active network attacker (MiTM) can achieve remote code execution on a machine that runs IKARUS Anti Virus 2.16.7. IK…
-
Unscored —CVE-2017-15649 Public exploit
net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls…
-
Unscored —
The tzdriver module in Huawei Mate 7 (Mate7-TL10) smartphones before V100R001CHNC00B126SP03 allows local users to gain …
-
Unscored —
The TEEOS module in Huawei Mate 7 (Mate7-TL10) smartphones before V100R001CHNC00B126SP03 allows local users with root p…
-
Unscored —CVE-2015-6668 Public exploit
The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the…
-
Unscored —
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows…
-
Unscored —
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address…
-
Unscored —
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata, which allows remote ad…
-
Unscored —
All versions prior to V2.06.00.00 of ZTE ZXDT22 SF01, an monitoring system of ZTE energy product, are impacted by direc…
-
Medium 5.4
Cross-site Scripting in Apache NiFi
In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.
-
Critical 9.8
Injection in Apache NiFi
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a rep…
-
High 7.5
Improper Authentication In Apache NiFi
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user.
-
Unscored —
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determ…
-
Unscored —CVE-2017-15639 Public exploit
tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the…
-
Unscored —
In lsx_aiffstartread in aiff.c in Sound eXchange (SoX) 14.4.2, there is a Use-After-Free vulnerability triggered by sup…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection…
-
Unscored —
Vulnerability in the Oracle Trade Management component of Oracle E-Business Suite (subcomponent: User Interface). Suppo…
-
Unscored —
Vulnerability in the Oracle Trade Management component of Oracle E-Business Suite (subcomponent: User Interface). Suppo…
-
Unscored —
Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: HA for MySQL). Suppo…
-
Unscored —
Vulnerability in the Oracle Trade Management component of Oracle E-Business Suite (subcomponent: User Interface). Suppo…
-
Unscored —
Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcompon…
-
Unscored —
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The…
-
Unscored —
Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: WebConnect).…
-
Unscored —
Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications (subcomponent: Security). Suppor…
-
Unscored —
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Smart Card IO). Supported versions that are aff…
-
Unscored —
Vulnerability in the Oracle Hyperion Financial Reporting component of Oracle Hyperion (subcomponent: Workspace). The su…
-
Unscored —
Vulnerability in the Oracle Hospitality Suite8 component of Oracle Hospitality Applications (subcomponent: PMS). Suppor…
-
Unscored —
Vulnerability in the Oracle Applications Technology Stack component of Oracle E-Business Suite (subcomponent: Oracle Fo…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported version…
-
Unscored —
Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Core …
-
Unscored —
Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions tha…
-
Unscored —
Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Web Container). Suppo…