Archive
27 November 2017
Vulnerabilities first published on this day (UTC), newest first.
55 results · Feed
-
Unscored —
Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when used on Windo…
-
Unscored —
Seagate ST500LT015 hard disk drives, when operating in eDrive mode on Lenovo ThinkPad W541 laptops with BIOS 2.21, allo…
-
Unscored —
Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when in sleep mode…
-
Unscored —CVE-2017-15275 EPSS 21%
Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to …
-
Unscored —
Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted …
-
Unscored —
IBM Jazz technology based products might divulge information that might be useful in helping attackers through error me…
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Unscored —
IBM Jazz Foundation products could allow an authenticated user to obtain sensitive information from stack traces. IBM X…
-
Unscored —
IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user to cause a shared memory leak by MQ applications using d…
-
Unscored —
IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST …
-
Unscored —
IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 could allow an authenticated attack…
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Unscored —
IBM Rhapsody DM products could reveal sensitive information in HTTP 500 Internal Server Error responses. IBM X-Force ID…
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows …
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Unscored —
An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to…
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows …
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows …
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows …
-
Unscored —CVE-2017-16994 Public exploit
The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, …
-
High 8.1
TeamPass Improper Privilege Management
TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. It is then possible to copy any arbitrary item into a directory controlled by the attacker, edit any item within a read-only directory, delete an arbitra…
-
High 7.5
TeamPass arbitrary file upload vulnerability
An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote Command Execution. To exploit this vulnerability, an authenticated attacker has to tamper with parameter…
-
Medium 5.4
TeamPass stored cross-site scripting (XSS) vulnerability
Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the (1) URL value of an item or (2) user log history. To exploit the vulnerability, the atta…
-
Medium 4.9
TeamPass Improper Privilege Management
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user (including admin), or modify attributes of any arbitrary user except administrator.…
-
Medium 4.9
TeamPass Improper Privilege Management
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify any arbitrary roles within the application, or delete any arbitrary role. To exploit the vulnerabilit…
-
Unscored —
Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. The vulnerab…
-
Unscored —
In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an author…
-
Unscored —
When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same c…
-
Unscored —
A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators…
-
Unscored —
The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipc…
-
High 8.8
Deserialization of Untrusted Data in swagger-codegen
A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'g…
-
Unscored —
Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91.
-
Unscored —
GitPHP by xiphux is vulnerable to OS Command Injections
-
Unscored —
An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts p…
-
Critical 9.8
Arbitrary Code Execution in mathjs
math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
-
High —
Arbitrary JavaScript Execution in typed-function
typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
-
Critical 9.8
Arbitrary Code Execution in mathjs
math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
-
Unscored —
The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users…
-
Unscored —
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shel…