Archive
December 2017
Vulnerabilities first published in this month (UTC), newest first.
1,107 results · Feed
-
Unscored —
Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted met…
-
Unscored —
Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint.
-
Unscored —
Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the d…
-
Unscored —
A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunctio…
-
Unscored —
Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates tha…
-
Unscored —
custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the descrip…
-
Unscored —
Red Lion HMI panels allow remote attackers to cause a denial of service (software exception) via an HTTP POST request t…
-
Unscored —
In Wireshark before 2.2.12, the MRDISC dissector misuses a NULL pointer and crashes. This was addressed in epan/dissect…
-
Unscored —
PHPJabbers Star Rating Script 4.0 has stored XSS via a rating item.
-
Unscored —
PHPJabbers Night Club Booking Software has stored XSS in the name parameter in the reservations tab.
-
Unscored —
PHPJabbers PHP Newsletter Script 4.2 has stored XSS in lists in the admin panel.
-
Unscored —
PHPJabbers File Sharing Script 1.0 has stored XSS in the comments section.
-
Unscored —
Biometric Shift Employee Management System has XSS via the index.php holiday_name parameter in an edit_holiday action.
-
Unscored —
PHP Scripts Mall Muslim Matrimonial Script has SQL injection via the view-profile.php mem_id parameter.
-
Unscored —
PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.
-
Unscored —
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter.
-
Unscored —
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter.
-
Unscored —
PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php.
-
Unscored —
Biometric Shift Employee Management System has CSRF via index.php in an edit_holiday action.
-
Unscored —
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/slider_edit.php edit_id parameter.
-
Unscored —
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter.
-
Unscored —
Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=addition_deduction req…
-
Unscored —
Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competency_criteria …
-
Unscored —
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter.
-
Unscored —
Biometric Shift Employee Management System has XSS via the expense_name parameter in an index.php?user=expenses request.
-
Unscored —
Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the inde…
-
Unscored —
Biometric Shift Employee Management System has XSS via the Last_Name parameter in an index.php?user=ajax request.
-
Unscored —
Use-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c in the Linux kernel through 4.14.10 …
-
Unscored —
The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before …
-
Unscored —
The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allo…
-
Unscored —
jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechani…
-
Unscored —
The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary comma…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the …
-
Unscored —
The rs_filter_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary fil…
-
Unscored —
XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before …
-
Unscored —
The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application cras…
-
Critical 9.8
Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arb…
-
Unscored —
ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (CPU consumption) via a flood of IP packet…
-
Unscored —
BA SYSTEMS BAS Web on BAS920 devices (with Firmware 01.01.00*, HTTPserv 00002, and Script 02.*) and ISC2000 devices all…
-
High 8.8
In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a th…