Archive
November 2017
Vulnerabilities first published in this month (UTC), newest first.
1,068 results · Feed
-
Unscored —CVE-2017-1000405 Public exploit
The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd() function insid…
-
High 7.5
Password change doesn't result in Karaf clearing cache
OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used until the Karaf cache is manually cleared (e.g. via restart).
-
Unscored —
elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validat…
-
Unscored —
The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heigh…
-
Unscored —
A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may b…
-
Unscored —
The rngapi_reset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service …
-
High 7.5
Restlet Framework allows remote attackers to access arbitrary files via a crafted REST API HTTP request
Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is relate…
-
High 7.5
Restlet Framework Ja-rs extension is vulnerable to XXE when using SimpleXMLProvider
Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request. This affects use of the Jax-rs extension.
-
Unscored —
An issue was discovered on D-Link DIR-605L Model B before FW2.11betaB06_hbrf devices, related to the code that handles …
-
Medium —
Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2, and org.apache.cxf.fediz:fediz-spring3
Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.…
-
Unscored —
A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authentica…
-
Unscored —
A vulnerability in Cisco NX-OS System Software running on Cisco MDS Multilayer Director Switches, Cisco Nexus 7000 Seri…
-
Unscored —
A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an…
-
Unscored —
A vulnerability in Cisco Jabber for Windows could allow an unauthenticated, local attacker to access sensitive communic…
-
Unscored —
A vulnerability in certain system script files that are installed at boot time on Cisco Application Policy Infrastructu…
-
Unscored —
A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an…
-
Unscored —
Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject a…
-
Unscored —
A vulnerability in Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to conduct a cross-site s…
-
Unscored —
A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to read the cont…
-
Unscored —
A "Cisco WebEx Network Recording Player Out-of-Bounds Vulnerability" exists in Cisco WebEx Network Recording Player for…
-
Unscored —
A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a com…
-
Unscored —
A vulnerability in Cisco Meeting Server versions prior to 2.2.2 could allow an authenticated, remote attacker to cause …
-
Unscored —
A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Pl…
-
Unscored —
A vulnerability in Cisco WebEx Meeting Center could allow an authenticated, remote attacker to initiate connections to …
-
Unscored —
A vulnerability in Cisco NX-OS System Software patch installation could allow an authenticated, local attacker to write…
-
Unscored —
A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Pl…
-
Unscored —
A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a com…
-
Unscored —
A vulnerability in Cisco NX-OS System Software could allow an authenticated, local attacker to bypass signature verific…
-
Unscored —
A SQL Injection vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remot…
-
Unscored —
A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a com…
-
Unscored —
A vulnerability in Cisco WebEx Network Recording Player for WebEx Recording Format (WRF) files could allow an attacker …
-
Unscored —
A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (.arf) files coul…
-
Unscored —
A vulnerability in Cisco WebEx Event Center could allow an authenticated, remote attacker to view unlisted meeting info…
-
Unscored —
A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email S…
-
Unscored —
Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attac…
-
Unscored —
A vulnerability in the Local Packet Transport Services (LPTS) ingress frame-processing functionality of Cisco IOS XR So…
-
Unscored —
Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject a…
-
Unscored —
A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a com…
-
Unscored —
A vulnerability in the TCL scripting subsystem of Cisco NX-OS System Software could allow an authenticated, local attac…
-
Unscored —
A vulnerability in the Open Agent Container (OAC) feature of Cisco Nexus Series Switches could allow an unauthenticated…