Archive
November 2017
Vulnerabilities first published in this month (UTC), newest first.
1,068 results · Feed
-
Unscored —CVE-2017-16952 Public exploit
KMPlayer 4.2.2.4 allows remote attackers to cause a denial of service via a crafted NSV file.
-
Unscored —CVE-2017-16951 Public exploit
Winamp Pro 5.66 Build 3512 allows remote attackers to cause a denial of service via a crafted WAV, WMV, AU, ASF, AIFF, …
-
Unscored —
The files function in the administration section in CS-Cart 4.6.2 and earlier allows attackers to execute arbitrary PHP…
-
Unscored —
Pebble Smartwatch devices through 4.3 mishandle UUID storage, which allows attackers to read an arbitrary application's…
-
Unscored —
An issue was discovered in EMC ScaleIO 2.0.1.x. A buffer overflow vulnerability in the SDBG service may potentially all…
-
Unscored —
An issue was discovered in EMC ScaleIO 2.0.1.x. In a Linux environment, one of the support scripts saves the credential…
-
Unscored —
An issue was discovered in EMC ScaleIO 2.0.1.x. A vulnerability in message parsers (MDM, SDS, and LIA) could potentiall…
-
Unscored —
EMC RSA Authentication Manager before 8.2 SP1 P6 has a cross-site scripting vulnerability that could potentially be exp…
-
Unscored —
An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versio…
-
Unscored —
In Hitachi Vantara Pentaho BA Platform through 8.0, a CSRF issue exists in the Business Analytics application.
-
Unscored —
Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when used on Windo…
-
Unscored —
Seagate ST500LT015 hard disk drives, when operating in eDrive mode on Lenovo ThinkPad W541 laptops with BIOS 2.21, allo…
-
Unscored —
Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when in sleep mode…
-
Unscored —CVE-2017-15275 EPSS 21%
Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to …
-
Unscored —
Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted …
-
Unscored —
IBM Jazz technology based products might divulge information that might be useful in helping attackers through error me…
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Unscored —
IBM Jazz Foundation products could allow an authenticated user to obtain sensitive information from stack traces. IBM X…
-
Unscored —
IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user to cause a shared memory leak by MQ applications using d…
-
Unscored —
IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST …
-
Unscored —
IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 could allow an authenticated attack…
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Unscored —
IBM Rhapsody DM products could reveal sensitive information in HTTP 500 Internal Server Error responses. IBM X-Force ID…
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows …
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed…
-
Unscored —
An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to…
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows …
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows …
-
Unscored —
IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows …
-
Unscored —CVE-2017-16994 Public exploit
The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, …
-
High 8.1
TeamPass Improper Privilege Management
TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. It is then possible to copy any arbitrary item into a directory controlled by the attacker, edit any item within a read-only directory, delete an arbitra…
-
High 7.5
TeamPass arbitrary file upload vulnerability
An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote Command Execution. To exploit this vulnerability, an authenticated attacker has to tamper with parameter…
-
Medium 5.4
TeamPass stored cross-site scripting (XSS) vulnerability
Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the (1) URL value of an item or (2) user log history. To exploit the vulnerability, the atta…
-
Medium 4.9
TeamPass Improper Privilege Management
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user (including admin), or modify attributes of any arbitrary user except administrator.…
-
Medium 4.9
TeamPass Improper Privilege Management
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify any arbitrary roles within the application, or delete any arbitrary role. To exploit the vulnerabilit…
-
Unscored —
Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. The vulnerab…
-
Unscored —
In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an author…
-
Unscored —
When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same c…
-
Unscored —
A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators…