Archive
17 November 2017
Vulnerabilities first published on this day (UTC), newest first.
100 results · Feed
-
Unscored —
On Jooan IP Camera A5 2.3.36 devices, an insecure FTP server does not require authentication, which allows remote attac…
-
High 8.8
Opencast RCE Vulnerability
Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0.
-
Unscored —
exiv2 0.26 contains a Stack out of bounds read in webp parser
-
Medium 6.5
Opencast has Incorrect Permission Assignment
In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restrict…
-
Unscored —
Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser
-
Unscored —
Exiv2 0.26 contains a heap buffer overflow in tiff parser
-
Medium 6.1
filp whoops Cross-site Scripting vulnerability
The dump function in Util/TemplateHelper.php in filp whoops before 2.1.13 has XSS.
-
Unscored —
Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almos…
-
Critical 9.1
SimpleXML has XML External Entity (XXE) vulnerability
SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on.
-
Unscored —
The Snap7 Server version 1.4.1 can be crashed when the ItemCount field of the ReadVar or WriteVar functions of the S7 p…
-
Medium 6.1CVE-2017-1000163 Scanner template
Phoenix Arbitrary URL Redirect
The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks.
-
Unscored —
VMware Workstation (12.x before 12.5.8) installer contains a DLL hijacking issue that exists due to some DLL files load…
-
Unscored —
hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds acc…
-
Unscored —
ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote cod…
-
Unscored —
The workstation logging function in Philips IntelliSpace Cardiovascular (ISCV) 2.3.0 and earlier and Xcelera R4.1L1 and…
-
Unscored —
On BIG-IP versions 11.6.0-11.6.2 (fixed in 11.6.2 HF1), 12.0.0-12.1.2 HF1 (fixed in 12.1.2 HF2), or 13.0.0-13.0.0 HF2 (…
-
High 7.5
jqueryFileTree vulnerable to Directory Traversal
jqueryFileTree 2.1.5 and older Directory Traversal
-
Unscored —
QuickerBB version <= 0.7.2 is vulnerable to arbitrary file writes which can lead to remote code execution. This can lea…
-
Medium 6.5
scalarmult() vulnerable to degenerate public keys
sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate public keys
-
Unscored —
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. A denial of service may occur.
-
Unscored —
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. There is XSS in the administration interface.
-
Unscored —
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. Cookies can be stolen, manipulated, and reused.
-
High 7.5
Next.js Directory Traversal Vulnerability
ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.
-
Unscored —CVE-2017-16819 Public exploit
A stored cross-site scripting vulnerability in the Icon Time Systems RTC-1000 v2.5.7458 and earlier time clock allows r…
-
Unscored —
Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files…
-
Unscored —
Jool 3.5.0-3.5.1 is vulnerable to a kernel crashing packet resulting in a DOS.
-
Unscored —
An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. The ioqueue component may issu…
-
Critical 9.8
alchemist.vim vulnerable to remote code execution
Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server. A malicious website can execute requests against an ephemeral port on localhost that are then evaluated as elixir code.
-
Unscored —
Lynx before 2.8.9dev.16 is vulnerable to a use after free in the HTML parser resulting in memory disclosure, because HT…
-
Unscored —
samtools htslib library version 1.4.0 and earlier is vulnerable to buffer overflow in the CRAM rANS codec resulting in …
-
Unscored —
ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resul…
-
Unscored —
VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds…
-
Unscored —
VMware Workstation (12.x before 12.5.8) and Fusion (8.x before 8.5.9) contain a guest RPC NULL pointer dereference vuln…
-
Unscored —
VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds…
-
Unscored —
VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds…
-
Unscored —
VMware vCenter Server (6.5 prior to 6.5 U1 and 6.0 prior to 6.0 U3c) does not correctly handle specially crafted LDAP n…
-
Unscored —
VMware Workstation (12.x before 12.5.8) and Fusion (8.x before 8.5.9) contain a heap buffer-overflow vulnerability in V…
-
Unscored —
The flash-based vSphere Web Client (6.0 prior to 6.0 U3c and 5.5 prior to 5.5 U3f) i.e. not the new HTML5-based vSphere…
-
Unscored —
VMware NSX Edge (6.2.x before 6.2.9 and 6.3.x before 6.3.5) contains a moderate Cross-Site Scripting (XSS) issue which …
-
Unscored —
Cross-site scripting vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multi…