Archive
8 November 2017
Vulnerabilities first published on this day (UTC), newest first.
21 results · Feed
-
Unscored —CVE-2017-11512 EPSS 80%
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pat…
-
Unscored —
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pat…
-
Unscored —
bgpd in FRRouting (FRR) before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3 and other products, al…
-
Unscored —
It was discovered that the fix for CVE-2017-12150 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluste…
-
Unscored —
It was discovered that the fix for CVE-2017-12151 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluste…
-
Unscored —
It was discovered that the fix for CVE-2017-12163 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluste…
-
Unscored —
backintime (aka Back in Time) before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notif…
-
Unscored —
Custom Permissions is a lightweight module that allows permissions to be created and managed through an administrative …
-
Unscored —
The Permissions by Term module extends Drupal by adding functionality for restricting access to single nodes via taxono…
-
Unscored —
RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting (XSS) attack via the ser…
-
Critical 9.8CVE-2015-3933 Public exploit
MetalGenix GeniXCMS vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the (1) email parameter or (2) userid parameter to register.php.
-
High 8.8CVE-2017-9096 Public exploit
Improper Restriction of XML External Entity Reference in iText
The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.
-
Unscored —
Special crafted InPage document leads to arbitrary code execution in InPage reader.
-
Medium 5.9
MFSBGN03791 rev.1 - HPE Content Manager Workgroup Service, Denial of Service (DoS)
A potential security vulnerability has been identified in HPE Content Manager Workgroup Service v9.00. The vulnerability could be remotely exploited to allow Denial of Service (DoS).
-
Unscored —
In sam2p 0.49.4, there are integer overflows (with resultant heap-based buffer overflows) in input-bmp.ci in the functi…
-
Unscored —
Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Pat…
-
Unscored —
Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private …
-
Unscored —
The Gentoo mail-filter/assp package 1.9.8.13030 and earlier allows local users to gain privileges by leveraging access …
-
Critical 9.8
Unsafe deserialization in MLAlchemy
An exploitable vulnerability exists in the YAML parsing functionality in the parse_yaml_query method in parser.py in MLAlchemy before 0.2.2. When processing YAML-Based queries for data, a YAML parser can execute arbitrary Python commands resulting in command …
-
Critical 9.8
Unsafe deserialization in owlmixin
An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. A "Load YAML" string or file (aka load_yaml or load_yamlf) can execute arbitrary Python commands resulting in command execution because load is used …
-
Critical 9.8
Unsafe pyyaml load usage in PyAnyAPI
An exploitable vulnerability exists in the YAML parsing functionality in the YAMLParser method in Interfaces.py in PyAnyAPI before 0.6.1. A YAML parser can execute arbitrary Python commands resulting in command execution because load is used where safe_load s…