Archive
23 October 2017
Vulnerabilities first published on this day (UTC), newest first.
118 results · Feed
-
Unscored —
In Symantec Endpoint Encryption before SEE 11.1.3HF3, a kernel memory leak is a type of resource leak that can occur wh…
-
Unscored —
In Symantec Encryption Desktop before SED 10.4.1 MP2HF1, a kernel memory leak is a type of resource leak that can occur…
-
Unscored —
The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physi…
-
Unscored —CVE-2015-2878 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hija…
-
Unscored —CVE-2015-5533 Public exploit
SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordP…
-
Unscored —
Cross-site scripting (XSS) vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 …
-
Unscored —CVE-2011-4334 Public exploit
edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated use…
-
Unscored —CVE-2011-4333 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in LabWiki 1.1 and earlier allow remote attackers to inject arbitra…
-
Unscored —
reseed seeds random numbers from an insecure HTTP request to random.org during installation, which makes it easier for …
-
Unscored —
foo2zjs before 20110722dfsg-3ubuntu1 as packaged in Ubuntu, 20110722dfsg-1 as packaged in Debian unstable, and 20090908…
-
High 8.1
Potential Command Injection in codem-transcode
The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe.
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in out/out.UsrMgr.php in LetoDMS (formerly MyDMS) before 3.3.9 allo…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attack…
-
Unscored —
SQL injection vulnerability in LetoDMS_Core/Core/inc.ClassDMS.php in LetoDMS (formerly MyDMS) before 3.3.8 allows remot…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to …
-
High 7.5
Directory Traversal in st
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
-
Critical 9.8
Potential Command Injection in printer
The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command.
-
Unscored —
Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated…
-
Unscored —
The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploita…
-
Unscored —
The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.p…
-
Unscored —
In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag.
-
Unscored —CVE-2017-15808 Public exploit
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.
-
Unscored —
The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.
-
Medium 6.1
Pallets Werkzeug cross-site scripting vulnerability
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a fiel…
-
High 7.5
Improper Access Control in Apache Derby
In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file.
-
Unscored —
In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic w…
-
Unscored —
XSS exists in the E-Sic 1.0 /cadastro/index.php URI (aka the requester's registration area) via the nome parameter.
-
Unscored —
An authentication bypass exists in the E-Sic 1.0 /index (aka login) URI via '=''or' values for the username and passwor…
-
Unscored —
The certificate import component in IDEMIA (formerly Morpho) MorphoSmart 1300 Series (aka MSO 1300 Series) devices allo…
-
Unscored —
Cisco Small Business SA520 and SA540 devices with firmware 2.1.71 and 2.2.0.7 allow ../ directory traversal in scgi-bin…
-
Unscored —
SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI).
-
Unscored —
osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly …
-
Unscored —CVE-2017-15687 Public exploit
DOM Based Cross Site Scripting (XSS) exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.…
-
Unscored —
SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php (aka the zip code search s…
-
Unscored —
Extreme EXOS 16.x, 21.x, and 22.x allows administrators to obtain a root shell via vectors involving a privileged proce…
-
Unscored —
Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to hijack sessions by determining SessionID values.
-
Unscored —
Extreme EXOS 16.x, 21.x, and 22.x allows administrators to obtain a root shell via vectors involving an exsh debug shel…
-
Unscored —
Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to trigger a buffer overflow leading to a reboot.
-
Unscored —
Extreme EXOS 16.x, 21.x, and 22.x allows administrators to bypass the "exsh restricted shell" protection mechanism and …