Archive
29 October 2017
Vulnerabilities first published on this day (UTC), newest first.
30 results · Feed
-
Unscored —CVE-2017-16227 EPSS 46%
The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of servic…
-
Critical 9.8
Dulwich RCE Vulnerability
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and…
-
Unscored —
SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administr…
-
Unscored —
elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory alloca…
-
Unscored —
In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced u…
-
Unscored —
In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure t…
-
Unscored —
In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password l…
-
Unscored —
The altivec_unavailable_exception function in arch/powerpc/kernel/traps.c in the Linux kernel before 2.6.19 on 64-bit s…
-
Unscored —CVE-2017-15968 Public exploit
MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter.
-
Unscored —CVE-2017-15974 Public exploit
tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.
-
Unscored —CVE-2017-15975 Public exploit
Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability…
-
Unscored —CVE-2017-15970 Public exploit
PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.
-
Unscored —CVE-2017-15976 Public exploit
ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-20…
-
Unscored —CVE-2017-15956 Public exploit
ConverTo Video Downloader & Converter 1.4.1 allows Arbitrary File Download via the token parameter to download.php.
-
Unscored —CVE-2017-15969 Public exploit
PG All Share Video 1.0 allows SQL Injection via the PATH_INFO to search/tag, friends/index, users/profile, or video_cat…
-
Unscored —CVE-2017-15958 Public exploit
D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.
-
Unscored —CVE-2017-15961 Public exploit
iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php.
-
Unscored —CVE-2017-15957 Public exploit
my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.
-
Unscored —CVE-2017-15965 Public exploit
The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in…
-
Unscored —CVE-2017-15972 Public exploit
SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.ph…
-
Unscored —CVE-2017-15973 Public exploit
Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view.php.
-
Unscored —CVE-2017-15960 Public exploit
Article Directory Script 3.0 allows SQL Injection via the id parameter to author.php or category.php.
-
Unscored —
rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to b…
-
Unscored —CVE-2017-15959 Public exploit
Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-20…
-
Unscored —CVE-2017-15967 Public exploit
Mailing List Manager Pro 3.0 allows SQL Injection via the edit parameter to admin/users in a sort=login action, or the …
-
Unscored —CVE-2017-15966 Public exploit
The Zh YandexMap (aka com_zhyandexmap) component 6.1.1.0 for Joomla! allows SQL Injection via the placemarklistid param…
-
Unscored —CVE-2017-15963 Public exploit
iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser p…
-
Unscored —CVE-2017-15962 Public exploit
iStock Management System 1.0 allows Arbitrary File Upload via user/profile.
-
Unscored —CVE-2017-15971 Public exploit
Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sen…
-
Unscored —CVE-2017-15964 Public exploit
Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.