Archive
1 December 2017
Vulnerabilities first published on this day (UTC), newest first.
41 results · Feed
-
Unscored —
connoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, which allows remote attackers to m…
-
Unscored —
In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as ro…
-
Unscored —
libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicio…
-
Unscored —CVE-2017-16895 Public exploit
The (1) arq_updater, (2) arqcommitter, (3) standardrestorer, (4) arqglacierrestorer, and (5) arqs3glacierrestorer helpe…
-
Unscored —
The application Piwigo is affected by an SQL injection vulnerability in version 2.9.2 and possibly prior. This vulnerab…
-
Unscored —
Encryption key exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to decrypt log …
-
Unscored —
Password file exposure in firmware in iSmartAlarm CubeOne version 2.2.4.8 and earlier allows attackers to execute arbit…
-
Unscored —CVE-2017-15357 Public exploit
The setpermissions function in the auto-updater in Arq before 5.9.7 for Mac allows local users to gain root privileges …
-
Unscored —
The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange message…
-
Unscored —
The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for…
-
Unscored —
HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically proximate attackers to trigger associa…
-
Medium 6.2
Moderate severity vulnerability that affects org.apache.struts:struts2-rest-plugin
In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
-
Critical 9.8
Apache Qpid Broker vulnerable to authentication port spoofing
In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of which is an HTTP port, then the broker can be tricked by a remote unauthenticated attacker connecting to the HTTP port int…
-
High 7.5
Apache Qpid Broker-J vulnerable to Denial of Service (DoS) via uncontrolled resource consumption
In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to exhaust all available memory and eventua…
-
Unscored —
PWR-Q200 does not use random values for source ports of DNS query packets, which allows remote attackers to conduct DNS…
-
Unscored —
Improper authentication issue in PTW-WMS1 firmware version 2.000.012 allows remote attackers to log in to the device wi…
-
Unscored —
SQL injection vulnerability in the A-Member and A-Member for MT cloud versions 3.8.6 and earlier allows an attacker to …
-
Unscored —
StreamRelay.NET.exe ver2.14.0.7 and earlier allows remote attackers to cause a denial of service via unspecified vector…
-
Unscored —
PTW-WMS1 firmware version 2.000.012 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
-
Unscored —
SQL injection vulnerability in the A-Reserve and A-Reserve for MT cloud versions 3.8.6 and earlier allows an attacker t…
-
Unscored —
Buffer overflow in PTW-WMS1 firmware version 2.000.012 allows remote attackers to conduct denial-of-service attacks via…
-
Unscored —
sDNSProxy.exe ver1.1.0.0 and earlier allows remote attackers to cause a denial of service via unspecified vectors.
-
Unscored —
Untrusted search path vulnerability in Music Center for PC version 1.0.00 allows an attacker to gain privileges via a T…
-
Unscored —
Untrusted search path vulnerability in Media Go version 3.2.0.191 and earlier allows an attacker to gain privileges via…
-
Unscored —
PTW-WMS1 firmware version 2.000.012 allows remote attackers to bypass access restrictions to obtain or delete data on t…
-
Unscored —
Directory traversal vulnerability in QND Advance/Standard allows an attacker to read arbitrary files via a specially cr…
-
Unscored —CVE-2017-11283 EPSS 43%
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for Co…
-
Unscored —
Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation c…
-
Unscored —
Adobe Flash Player has an exploitable memory corruption vulnerability in the text handling function. Successful exploit…
-
Unscored —
Adobe ColdFusion has an XML external entity (XXE) injection vulnerability. This affects Update 4 and earlier versions f…
-
Unscored —CVE-2017-11284 EPSS 43%
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for Co…
-
Unscored —
Adobe ColdFusion has a cross-site scripting (XSS) vulnerability. This affects Update 4 and earlier versions for ColdFus…
-
Unscored —
fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be d…
-
Unscored —
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. This was addressed in epan/disse…
-
Unscored —
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the NetBIOS dissector could crash. This was addressed in epan/dissecto…
-
Unscored —
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the IWARP_MPA dissector could crash. This was addressed in epan/dissec…
-
Unscored —
Indeo Otter through 1.7.4 mishandles a "</script>" substring in an initial DP payload, which allows remote attackers to…
-
Unscored —
Adobe RoboHelp has an Open Redirect vulnerability. This affects versions before RH12.0.4.460 and RH2017 before RH2017.0…
-
Unscored —
Adobe RoboHelp has a cross-site scripting (XSS) vulnerability. This affects versions before RH12.0.4.460 and RH2017 bef…
-
Unscored —
Inedo Otter before 1.7.4 has directory traversal in filesystem-based rafts via vectors involving '/' characters or init…