Archive
October 2017
Vulnerabilities first published in this month (UTC), newest first.
1,398 results · Feed
-
Unscored —
Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code.
-
Critical 9.8
SaltStack Salt Directory traversal vulnerability in minion id validation
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: t…
-
High 7.5
SaltStack Salt Denial of Service via a crafted authentication request
SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.
-
Unscored —
The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML …
-
Unscored —
Cisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy, which makes it easier for remote att…
-
Unscored —
The get_login_ip_config_file function in Eyou Mail System before 3.6 allows remote attackers to execute arbitrary comma…
-
Unscored —CVE-2017-15081 Public exploit
In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.
-
Unscored —
When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable R…
-
Unscored —
Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used b…
-
Unscored —
In Symantec Endpoint Encryption before SEE 11.1.3HF3, a kernel memory leak is a type of resource leak that can occur wh…
-
Unscored —
In Symantec Encryption Desktop before SED 10.4.1 MP2HF1, a kernel memory leak is a type of resource leak that can occur…
-
Unscored —
The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physi…
-
Unscored —CVE-2015-2878 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hija…
-
Unscored —CVE-2015-5533 Public exploit
SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordP…
-
Unscored —
Cross-site scripting (XSS) vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 …
-
Unscored —CVE-2011-4334 Public exploit
edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated use…
-
Unscored —CVE-2011-4333 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in LabWiki 1.1 and earlier allow remote attackers to inject arbitra…
-
Unscored —
reseed seeds random numbers from an insecure HTTP request to random.org during installation, which makes it easier for …
-
Unscored —
foo2zjs before 20110722dfsg-3ubuntu1 as packaged in Ubuntu, 20110722dfsg-1 as packaged in Debian unstable, and 20090908…
-
High 8.1
Potential Command Injection in codem-transcode
The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe.
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in out/out.UsrMgr.php in LetoDMS (formerly MyDMS) before 3.3.9 allo…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attack…
-
Unscored —
SQL injection vulnerability in LetoDMS_Core/Core/inc.ClassDMS.php in LetoDMS (formerly MyDMS) before 3.3.8 allows remot…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to …
-
High 7.5
Directory Traversal in st
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
-
Critical 9.8
Potential Command Injection in printer
The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command.
-
Unscored —
Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated…
-
Unscored —
The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploita…
-
Unscored —
The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.p…
-
Unscored —
In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag.
-
Unscored —CVE-2017-15808 Public exploit
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.
-
Unscored —
The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.
-
Medium 6.1
Pallets Werkzeug cross-site scripting vulnerability
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a fiel…
-
High 7.5
Improper Access Control in Apache Derby
In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file.
-
Unscored —
In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic w…
-
Unscored —
XSS exists in the E-Sic 1.0 /cadastro/index.php URI (aka the requester's registration area) via the nome parameter.
-
Unscored —
An authentication bypass exists in the E-Sic 1.0 /index (aka login) URI via '=''or' values for the username and passwor…
-
Unscored —
The certificate import component in IDEMIA (formerly Morpho) MorphoSmart 1300 Series (aka MSO 1300 Series) devices allo…
-
Unscored —
Cisco Small Business SA520 and SA540 devices with firmware 2.1.71 and 2.2.0.7 allow ../ directory traversal in scgi-bin…