Archive
11 December 2017
Vulnerabilities first published on this day (UTC), newest first.
52 results · Feed
-
High 8.8
A memory corruption vulnerability exists in the .PSD parsing functionality of ACDSee Ultimate 10.0.0.292. A specially c…
-
Unscored —CVE-2014-8358 Public exploit
Huawei EC156, EC176, and EC177 USB Modem products with software before UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014…
-
Unscored —
The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exceptio…
-
Unscored —
IBM Connections 6.0 could allow an unauthenticated remote attacker to gain unauthenticated or unauthorized access to no…
-
Unscored —
IBM Support Tools for Lotus WCM (IBM WebSphere Portal 7.0, 8.0, 8.5 and 9.0) is vulnerable to cross-site scripting. Thi…
-
Unscored —
IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) 3.0.0.0 through 3.0.0.7 is vulnerable to SQL injection.…
-
Unscored —
IBM Sterling File Gateway 2.2 could allow an authenticated user to change other user's passwords. IBM X-Force ID: 13129…
-
Unscored —
IBM Sterling File Gateway 2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Unscored —
IBM Sterling File Gateway 2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
-
Unscored —
IBM Jazz Foundation Products could disclose sensitive information during a scan that could lead to further attacks agai…
-
Unscored —
IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow a local user to crash the queue manager agent thread and expose some sen…
-
Unscored —
IBM Connections Engagement Center 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed a…
-
Unscored —
IBM Sterling File Gateway 2.2 could allow a remote attacker to traverse directories on the system. An attacker could se…
-
Unscored —
Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 share a fixed small pool of hardcoded keys,…
-
Unscored —
Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 use AES-128 with ECB mode to encrypt voice …
-
Unscored —
Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 do not provide sufficient protections again…
-
Unscored —
Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill val…
-
Unscored —
Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake fa…
-
Unscored —
The Backup and Restore feature in Mobotap Dolphin Browser for Android 12.0.2 suffers from an arbitrary file write vulne…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the console in Puppet Enterprise before 2015.2.1 allows remote attackers to…
-
Unscored —
The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the JSESSIONID cookie in a…
-
Unscored —
The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which …
-
Unscored —CVE-2017-11319 Public exploit
Perspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and …
-
Unscored —CVE-2017-17111 Public exploit
Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-detai…
-
Unscored —CVE-2017-17110 Public exploit
Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.
-
Critical 9.8
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote…
KEV Aug 18, 2022 -
Unscored —
The configuration file import for applications, spyware and vulnerability objects functionality in the web interface in…
-
Unscored —
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.13, and 8.0.x before 8.0.6 allows remote…
-
Unscored —
The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, …
-
Unscored —
Palo Alto Networks GlobalProtect Agent before 4.0.3 allows attackers with administration rights on the local station to…
-
Unscored —
A Cross-site Scripting issue was discovered in PHOENIX CONTACT FL COMSERVER BASIC 232/422/485, FL COMSERVER UNI 232/422…
-
Unscored —
A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4…
-
Unscored —
A DLL Hijacking vulnerability in QNAP Qsync for Windows (exe) version 4.2.2.0724 and earlier could allow remote attacke…
-
Unscored —
Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authenti…
-
Critical 9.8
Remote Code Execution in Apache Synapse
In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by inject…
-
Unscored —
Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allow…
-
Unscored —
In Ivanti Service Desk (formerly LANDESK Management Suite) versions between 2016.3 and 2017.3, an Unrestricted Direct O…
-
Unscored —
sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by th…
-
Unscored —
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROW…
-
Unscored —
In HDF5 1.10.1, there is an out of bounds read vulnerability in the function H5T_conv_struct_opt in H5Tconv.c in libhdf…