Archive
October 2017
Vulnerabilities first published in this month (UTC), newest first.
1,398 results · Feed
-
Unscored —
elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory alloca…
-
Unscored —
In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced u…
-
Unscored —
In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure t…
-
Unscored —
In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password l…
-
Unscored —
The altivec_unavailable_exception function in arch/powerpc/kernel/traps.c in the Linux kernel before 2.6.19 on 64-bit s…
-
Unscored —CVE-2017-15968 Public exploit
MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter.
-
Unscored —CVE-2017-15974 Public exploit
tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.
-
Unscored —CVE-2017-15975 Public exploit
Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability…
-
Unscored —CVE-2017-15970 Public exploit
PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.
-
Unscored —CVE-2017-15976 Public exploit
ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-20…
-
Unscored —CVE-2017-15956 Public exploit
ConverTo Video Downloader & Converter 1.4.1 allows Arbitrary File Download via the token parameter to download.php.
-
Unscored —CVE-2017-15969 Public exploit
PG All Share Video 1.0 allows SQL Injection via the PATH_INFO to search/tag, friends/index, users/profile, or video_cat…
-
Unscored —CVE-2017-15958 Public exploit
D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.
-
Unscored —CVE-2017-15961 Public exploit
iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php.
-
Unscored —CVE-2017-15957 Public exploit
my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.
-
Unscored —CVE-2017-15965 Public exploit
The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in…
-
Unscored —CVE-2017-15972 Public exploit
SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.ph…
-
Unscored —CVE-2017-15973 Public exploit
Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view.php.
-
Unscored —CVE-2017-15960 Public exploit
Article Directory Script 3.0 allows SQL Injection via the id parameter to author.php or category.php.
-
Unscored —
rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to b…
-
Unscored —CVE-2017-15959 Public exploit
Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-20…
-
Unscored —CVE-2017-15967 Public exploit
Mailing List Manager Pro 3.0 allows SQL Injection via the edit parameter to admin/users in a sort=login action, or the …
-
Unscored —CVE-2017-15966 Public exploit
The Zh YandexMap (aka com_zhyandexmap) component 6.1.1.0 for Joomla! allows SQL Injection via the placemarklistid param…
-
Unscored —CVE-2017-15963 Public exploit
iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser p…
-
Unscored —CVE-2017-15962 Public exploit
iStock Management System 1.0 allows Arbitrary File Upload via user/profile.
-
Unscored —CVE-2017-15971 Public exploit
Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sen…
-
Unscored —CVE-2017-15964 Public exploit
Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.
-
Unscored —
bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to an "Access violation near NULL on destination operand" …
-
Unscored —
bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow and crash when processing …
-
Unscored —
bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow (with a resultant invalid …
-
Unscored —
The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus fin…
-
Unscored —
In the com_tag component 1.7.6 for Joomla!, a SQL injection vulnerability is located in the `tag` parameter to index.ph…
-
Unscored —
Xavier PHP Management Panel 2.4 allows SQL injection via the usertoedit parameter to admin/adminuseredit.php or the log…
-
Unscored —
Perch Content Management System 3.0.3 allows unrestricted file upload (with resultant XSS) via the Asset Title field in…
-
Unscored —
Simple ASC Content Management System v1.2 has XSS in the location field in the sign function, related to guestbook.asp,…
-
Unscored —
The installation scripts in the Gentoo dev-db/mysql, dev-db/mariadb, dev-db/percona-server, dev-db/mysql-cluster, and d…
-
Unscored —
dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, miscalculates D…
-
Unscored —
dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles NULL…
-
Unscored —
Artica Pandora FMS version 7.0 is vulnerable to remote PHP code execution through the manager files function. This is o…
-
Unscored —
Artica Pandora FMS version 7.0 leaks a full installation pathname via GET data when intercepting the main page's graph …