Archive
26 October 2017
Vulnerabilities first published on this day (UTC), newest first.
31 results · Feed
-
Unscored —
IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications (IBM BigFix Platform 9.2 and 9.5) is …
-
Unscored —
IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) generates an error message in error logs that includes se…
-
Unscored —
IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) does not perform an authentication check for a critical r…
-
Unscored —
IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) transmits sensitive or security-critical data in cleartex…
-
Unscored —
IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) stores sensitive information in URL parameters. This may …
-
Unscored —
IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) discloses sensitive information to unauthorized users. Th…
-
Unscored —
IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) could allow a remote attacker to obtain sensitive informa…
-
Unscored —
IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) uses insufficiently random numbers or values in a securit…
-
Unscored —
Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors.
-
Unscored —
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecifi…
-
Unscored —CVE-2014-2023 Public exploit
Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin all…
-
Unscored —
Before Thornberry NDoc version 8.0, laptop clients and the server have default database (Cache) users set up with a sin…
-
Unscored —
In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_ext…
-
Unscored —
The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection…
-
Unscored —
The agent in Bomgar Remote Support 15.2.x before 15.2.3, 16.1.x before 16.1.5, and 16.2.x before 16.2.4 allows DLL hija…
-
High 7.5
Keycloak CSRF Vulnerability
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
-
Medium 5.4
Keycloak Reflected XSS
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.
-
High 7.2
Keycloak Oauth Implementation Error
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource cou…
-
Unscored —
System boot process is not adequately secured In Lenovo E95 and ThinkCentre M710s/M710t because systems were shipped fr…
-
Unscored —
In Paessler PRTG Network Monitor 17.3.33.2830, it's possible to create a Map as a read-only user, by forging a request …
-
Medium 4.8
Ignite Realtime Openfire Server has Cross-site Scripting vulnerability in admin console
The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the po…
-
Unscored —
A flaw was found in GlusterFS in versions prior to 3.10. A null pointer dereference in send_brick_req function in glust…
-
Unscored —CVE-2017-15908 EPSS 24%
In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger a…
-
Unscored —
A Cross-Site Scripting (XSS) vulnerability in Fortinet FortiWLC 6.1-x (6.1-2, 6.1-4 and 6.1-5); 7.0-x (7.0-7, 7.0-8, 7.…
-
Unscored —
An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, …
-
Unscored —
A reflected Cross-Site Scripting (XSS) vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.…
-
Unscored —
SQL injection vulnerability in phpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands vi…
-
Unscored —
The London Trust Media Private Internet Access (PIA) application before 1.3.3.1 for Android allows remote attackers to …
-
Unscored —
D-Link DGS-1500 Ax devices before 2.51B021 have a hardcoded password, which allows remote attackers to obtain shell acc…
-
Medium 5.3
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly…