Archive
October 2017
Vulnerabilities first published in this month (UTC), newest first.
172 results · Clear filters · Feed
-
Unscored —
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when pro…
-
Unscored —CVE-2017-15220 Public exploit
Flexense VX Search Enterprise 10.1.12 is vulnerable to a buffer overflow via an empty POST request to a long URI beginn…
-
Unscored —
Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via …
-
Unscored —CVE-2017-15235 Public exploit
The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authenticatio…
-
Unscored —CVE-2017-15236 Public exploit
Tiandy IP cameras 5.56.17.120 do not properly restrict a certain proprietary protocol, which allows remote attackers to…
-
Unscored —CVE-2017-5721 Public exploit
Insufficient input validation in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versio…
-
Unscored —CVE-2015-8239 Public exploit
The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts o…
-
Unscored —
Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices…
-
High 7.5
Uncontrolled Resource Consumption in Apache ZooKeeper
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suff…
-
Unscored —
The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attack…
-
Unscored —
Buffer overflow in Sync Breeze Enterprise 10.0.28 allows remote attackers to have unspecified impact via a long usernam…
-
Unscored —CVE-2015-2147 Public exploit
Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arb…
-
Unscored —CVE-2015-2145 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers t…
-
Unscored —
The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP Easy…
-
Unscored —CVE-2015-2142 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote auth…
-
Unscored —CVE-2015-2143 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote atta…
-
Unscored —CVE-2017-15084 Public exploit
The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22.
-
Unscored —CVE-2017-13068 Public exploit
QNAP has already patched this vulnerability. This security concern allows a remote attacker to perform an SQL injection…
-
Unscored —CVE-2017-14083 Public exploit
A vulnerability in Trend Micro OfficeScan 11.0 and XG allows remote unauthenticated users who can access the system to …
-
Unscored —CVE-2017-14086 Public exploit
Pre-authorization Start Remote Process vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated …
-
Unscored —CVE-2017-14085 Public exploit
Information disclosure vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can ac…
-
Unscored —
A potential Man-in-the-Middle (MitM) attack vulnerability in Trend Micro OfficeScan 11.0 and XG may allow attackers to …
-
Unscored —CVE-2017-14087 Public exploit
A Host Header Injection vulnerability in Trend Micro OfficeScan XG (12.0) may allow an attacker to spoof a particular H…
-
Unscored —CVE-2017-14089 Public exploit
An Unauthorized Memory Corruption vulnerability in Trend Micro OfficeScan 11.0 and XG may allow remote unauthenticated …
-
Unscored —CVE-2017-15035 Public exploit
EmTec PyroBatchFTP before 3.18 allows remote servers to cause a denial of service (application crash).
-
Critical 9.8
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter…
KEV Dec 10, 2021 -
Unscored —
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE…
-
Unscored —
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL c…
-
High 7.8
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb…
KEV Sep 9, 2024 -
High 7.2
October CMS PHP Code Execution
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.
-
Unscored —CVE-2017-0806 Public exploit
An elevation of privilege vulnerability in the Android framework (gatekeeperresponse). Product: Android. Versions: 6.0,…
-
Unscored —CVE-2017-0807 Public exploit
An elevation of privilege vulnerability in the Android framework (ui framework). Product: Android. Versions: 4.4.4, 5.0…
-
High 8.1
Unrestricted Upload of File with Dangerous Type Apache Tomcat
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP fil…
KEV Mar 25, 2022 -
Unscored —
Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote…
-
Unscored —
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu…
-
Unscored —
dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vec…
-
Unscored —
Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or exec…
-
Unscored —CVE-2017-14848 Public exploit
WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.
-
Unscored —
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu…
-
Unscored —
Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-s…