Skip to content
OpenAdvisories

Archive

30 October 2017

Vulnerabilities first published on this day (UTC), newest first.

← September 2017 2017 / October /30 November 2017 →
  1. 110
  2. 264
  3. 343
  4. 456
  5. 543
  6. 635
  7. 7 
  8. 8 
  9. 913
  10. 1084
  11. 1155
  12. 1223
  13. 1398
  14. 143
  15. 156
  16. 1643
  17. 1741
  18. 1854
  19. 19229
  20. 2019
  21. 2112
  22. 2260
  23. 23118
  24. 2434
  25. 257
  26. 2631
  27. 27102
  28. 288
  29. 2930
  30. 3031
  31. 3146
All Critical High Medium Low Exploited only Public exploit

31 results · Feed

  • Unscored —
    CVE-2017-1000255

    On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn …

    linux-hwe linux Debian Ubuntu
  • Unscored —
    CVE-2017-10151

    Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). Sup…

    Oracle Identity Manager
  • Critical 9.8
    CVE-2013-4366

    Hostname verification in Apache HttpClient 4.3 was disabled by default

    http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.

    org.apache.httpcomponents:httpclient httpcomponents-client Debian Maven
  • Critical 9.8
    CVE-2012-4449

    Use of a Broken or Risky Cryptographic Algorithm in Apache Hadoop

    Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.

    org.apache.hadoop:hadoop-client Maven
  • Unscored —
    CVE-2012-5636

    Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.…

  • Unscored —
    CVE-2014-0072

    ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0…

  • Unscored —
    CVE-2014-0073

    The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) befo…

  • Unscored —
    CVE-2017-16230

    In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add pay…

  • Unscored —
    CVE-2017-14919

    Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (unc…

    nodejs Alpine
  • Unscored —
    CVE-2017-15888

    Cross-site scripting (XSS) vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allo…

    Synology Synology Audio Station
  • High 7.5
    CVE-2012-0881 EPSS 17%

    Denial of service in Apache Xerces2

    Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.

    xerces:xercesImpl libxerces2-java libxerces2-java Debian Ubuntu Maven
  • High 7.5
    CVE-2014-0115

    Apache Storm log viewer path traversal vulnerability

    Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to log.

    org.apache.storm:storm Maven
  • Unscored —
    CVE-2009-1197

    Apache jUDDI before 2.0 allows attackers to spoof entries in log files via vectors related to error logging of keys fro…

  • Unscored —
    CVE-2009-1198

    Cross-site scripting (XSS) vulnerability in Apache jUDDI before 2.0 allows remote attackers to inject arbitrary web scr…

  • Unscored —
    CVE-2017-15920 Public exploit

    In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointe…

  • Unscored —
    CVE-2017-15921 Public exploit

    In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointe…

  • High 7.5
    CVE-2015-0226

    Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J

    Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series…

    wss4j org.apache.ws.security:wss4j org.apache.wss4j:wss4j-ws-security-dom Debian Maven
  • Unscored —
    CVE-2015-0224 EPSS 15%

    qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted…

  • Unscored —
    CVE-2015-7549

    The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a …

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2015-3249

    The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial o…

    trafficserver trafficserver Debian Ubuntu
  • Unscored —
    CVE-2013-4246

    libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access …

  • Unscored —
    CVE-2012-5357 Public exploit EPSS 68%

    Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to tru…

  • Unscored —
    CVE-2012-5358

    The XSLTCompiledTransform function in Ektron Content Management System (CMS) before 8.02 SP5 configures the XSL with en…

  • High 7.5
    CVE-2014-3526

    Apache Wicket Sensitive Data Exposure

    Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.

    org.apache.wicket:wicket-core Maven
  • Unscored —
    CVE-2014-3624

    Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to…

    trafficserver Debian
  • High 8.8
    CVE-2016-3090

    Apache Struts RCE Vulnerability

    The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.

    org.apache.struts:struts2-parent Maven
  • Unscored —
    CVE-2017-7411 Public exploit EPSS 67%

    An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentE…

  • Unscored —
    CVE-2017-12460

    An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10. An aut…

  • Unscored —
    CVE-2017-15597

    An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin would be accomp…

    xen xen xen Debian Ubuntu Alpine
  • Unscored —
    CVE-2017-9377

    A command injection was identified on Barco ClickShare Base Unit devices with CSM-1 firmware before 1.7.0.3 and CSC-1 f…

  • Unscored —
    CVE-2017-9450

    The Amazon Web Services (AWS) CloudFormation bootstrap tools package (aka aws-cfn-bootstrap) before 1.4-19.10 allows lo…