6 November 2017

29 results · Feed

• Unscored —
  CVE-2017-16638

  The Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the "qemu" group to gain root privileges b…

  Nov 6, 2017
• Unscored —
  CVE-2017-13681

  Symantec Endpoint Protection prior to SEP 12.1 RU6 MP9 could be susceptible to a privilege escalation vulnerability, wh…

  Symantec Symantec Endpoint Protection
  Nov 6, 2017
• Unscored —
  CVE-2017-13680

  Prior to SEP 12.1 RU6 MP9 & SEP 14 RU1 Symantec Endpoint Protection Windows endpoint can encounter a situation whereby …

  Symantec Symantec Endpoint Protection
  Nov 6, 2017
• Unscored —
  CVE-2017-6331 Public exploit

  Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a…

  Symantec Symantec Endpoint Protection
  Nov 6, 2017
• Unscored —
  CVE-2017-16637

  In Vectura Perfect Privacy VPN Manager v1.10.10 and v1.10.11, when resetting the network data via the software client, …

  Nov 6, 2017
• Unscored —
  CVE-2017-16635

  In TinyWebGallery v2.4, an XSS vulnerability is located in the `mkname`, `mkitem`, and `item` parameters of the `Add/Cr…

  Nov 6, 2017
• Unscored —
  CVE-2017-16636

  In Bludit v1.5.2 and v2.0.1, an XSS vulnerability is located in the new page, new category, and edit post function body…

  Nov 6, 2017
• Unscored —
  CVE-2017-12719

  An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A remote …

  Nov 6, 2017
• Unscored —
  CVE-2017-14023

  An Improper Input Validation issue was discovered in Siemens SIMATIC PCS 7 V8.1 prior to V8.1 SP1 with WinCC V7.3 Upd 1…

  Nov 6, 2017
• Unscored —
  CVE-2017-14029

  An Uncontrolled Search Path Element issue was discovered in Trihedral VTScada 11.3.03 and prior. The program will execu…

  Nov 6, 2017
• Unscored —
  CVE-2017-14025

  An Improper Input Validation issue was discovered in ABB FOX515T release 1.0. An improper input validation vulnerabilit…

  Nov 6, 2017
• Unscored —
  CVE-2017-14031

  An Improper Access Control issue was discovered in Trihedral VTScada 11.3.03 and prior. A local, non-administrator user…

  Nov 6, 2017
• Unscored —
  CVE-2017-14016 Public exploit EPSS 16%

  A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. The applicat…

  Nov 6, 2017
• Unscored —
  CVE-2017-15306

  The kvm_vm_ioctl_check_extension function in arch/powerpc/kvm/powerpc.c in the Linux kernel before 4.13.11 allows local…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Nov 6, 2017
• Unscored —
  CVE-2015-7878

  Cross-site scripting (XSS) vulnerability in the Taxonomy Find module 6.x-2.x through 6.x-1.2 and 7.x-2.x through 7.x-1.…

  Nov 6, 2017
• High 7.8
  CVE-2015-7529

  SoSReport Predictable Tmp File Names

  sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$dat…

  sosreport sosreport sosreport Debian Ubuntu PyPI
  Nov 6, 2017
• Unscored —
  CVE-2017-16001 Public exploit

  In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently s…

  Nov 6, 2017
• High 7.6
  CVE-2017-7425

  Multiple Reflected XSS in iManager

  Multiple potential reflected XSS issues exist in NetIQ iManager versions before 2.7.7 Patch 10 HF2 and 3.0.3.2.

  NetIQ NetIQ iManager
  Nov 6, 2017
• Unscored —
  CVE-2017-11177

  TRITON AP-EMAIL 8.2 before 8.2 IB does not properly restrict file access in an unspecified directory.

  Nov 6, 2017
• Unscored —
  CVE-2017-15672

  The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers t…

  ffmpeg ffmpeg libav Debian Ubuntu
  Nov 6, 2017
• Unscored —
  CVE-2017-16563

  Cross-Site Request Forgery (CSRF) in the Basic Settings screen on Vonage (Grandstream) HT802 devices allows attackers t…

  Nov 6, 2017
• Unscored —
  CVE-2017-16564

  Stored Cross-site scripting (XSS) vulnerability in /cgi-bin/config2 on Vonage (Grandstream) HT802 devices allows remote…

  Nov 6, 2017
• Unscored —
  CVE-2017-16565

  Cross-Site Request Forgery (CSRF) in /cgi-bin/login on Vonage (Grandstream) HT802 devices allows attackers to authentic…

  Nov 6, 2017
• Unscored —
  CVE-2017-16569

  An Open URL Redirect issue exists in Zurmo 3.2.1.57987acc3018 via an http: URL in the redirectUrl parameter to app/inde…

  Nov 6, 2017
• Unscored —
  CVE-2017-16524 Public exploit EPSS 30%

  Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_…

  Nov 6, 2017
• High 8.8
  CVE-2017-16570 Public exploit

  Cross-Site Request Forgery (CSRF) in keystone

  KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header.

  keystone npm
  Nov 6, 2017
• Unscored —
  CVE-2017-15039

  Cross-site scripting (XSS) exists in Zurmo 3.2.1.57987acc3018 via a data: URL in the redirectUrl parameter to app/index…

  Nov 6, 2017
• Unscored —
  CVE-2017-16548

  The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' characte…

  rsync rsync rsync Debian Ubuntu Alpine
  Nov 6, 2017
• Unscored —
  CVE-2017-16547

  The DrawImage function in magick/render.c in GraphicsMagick 1.3.26 does not properly look for pop keywords that are ass…

  graphicsmagick graphicsmagick graphicsmagick Debian Ubuntu Alpine
  Nov 6, 2017