14 December 2017

35 results · Feed

• Medium 4.7
  CVE-2017-16355

  Phusion Passenger information disclosure

  In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file n…

  passenger passenger passenger Debian Ubuntu RubyGems
  Dec 14, 2017
• Unscored —
  CVE-2017-5264 Public exploit

  Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated …

  Rapid7 Nexpose
  Dec 14, 2017
• High 7.5
  CVE-2016-10703

  Denial of Service in ecstatic

  A regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js of the ecstatic npm package, before version 2.0.0, allows a remote attacker to overload and crash a server by passing a maliciously crafted string.

  ecstatic npm
  Dec 14, 2017
• Unscored —
  CVE-2017-7344

  A privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privi…

  Fortinet FortiClientWindows Network devices
  Dec 14, 2017
• High 8.8
  CVE-2017-17520

  tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER envir…

  Dec 14, 2017
• Unscored —
  CVE-2017-17511

  KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, …

  kildclient kildclient Debian Ubuntu
  Dec 14, 2017
• Unscored —
  CVE-2017-17527

  delphi_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by th…

  pasdoc Debian
  Dec 14, 2017
• Unscored —
  CVE-2017-17515

  etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environ…

  metview Debian
  Dec 14, 2017
• Unscored —
  CVE-2017-17524

  library/www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROW…

  swi-prolog swi-prolog Debian Ubuntu
  Dec 14, 2017
• High 8.8
  CVE-2017-17514

  boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment varia…

  nip2 Debian
  Dec 14, 2017
• Unscored —
  CVE-2017-17530

  common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environ…

  geomview Debian
  Dec 14, 2017
• Unscored —
  CVE-2017-17528

  backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified…

  scummvm scummvm Debian Ubuntu
  Dec 14, 2017
• Unscored —
  CVE-2017-17531

  gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environme…

  global global Debian Ubuntu
  Dec 14, 2017
• Unscored —
  CVE-2017-17525

  guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by t…

  postbooks Ubuntu
  Dec 14, 2017
• Unscored —
  CVE-2017-17526

  Input.cc in Bernard Parisse Giac 1.2.3.57 does not validate strings before launching the program specified by the BROWS…

  giac giac Debian Ubuntu
  Dec 14, 2017
• Unscored —
  CVE-2017-17521

  uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER …

  fontforge fontforge Debian Ubuntu
  Dec 14, 2017
• Unscored —
  CVE-2017-17533

  default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment …

  Dec 14, 2017
• Unscored —
  CVE-2017-17532

  examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the…

  kiwi kiwi Debian Ubuntu
  Dec 14, 2017
• High 8.8
  CVE-2017-17516

  Reddit Terminal Viewer (RTV) vulnerable to argument injection attacks

  scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted U…

  rtv rtv rtv Debian Ubuntu PyPI
  Dec 14, 2017
• Unscored —
  CVE-2017-17522

  Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWS…

  python-py jython python2 Debian Azure Linux
  Dec 14, 2017
• Unscored —
  CVE-2017-17513

  TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment v…

  texlive-bin texlive-bin texlive-base texlive-base Debian Ubuntu
  Dec 14, 2017
• Unscored —
  CVE-2017-17519

  batteriesConfig.mlp in OCaml Batteries Included (aka ocaml-batteries) 2.6 does not validate strings before launching th…

  ocaml-batteries ocaml-batteries Debian Ubuntu
  Dec 14, 2017
• Unscored —
  CVE-2017-17518

  swt/motif/browser.c in White_dune (aka whitedune) 0.30.10 does not validate strings before launching the program specif…

  whitedune Debian
  Dec 14, 2017
• Unscored —
  CVE-2017-17529

  af/util/xp/ut_go_file.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BR…

  abiword abiword Debian Ubuntu
  Dec 14, 2017
• Unscored —
  CVE-2017-17534

  uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environme…

  mensis Ubuntu
  Dec 14, 2017
• Unscored —
  CVE-2017-17517

  libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSE…

  sylpheed sylpheed Debian Ubuntu
  Dec 14, 2017
• Unscored —
  CVE-2017-17535

  lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER e…

  gjots2 Ubuntu
  Dec 14, 2017
• Unscored —
  CVE-2017-5663

  In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/cen…

  Apache Software Foundation Apache Fineract
  Dec 14, 2017
• Unscored —
  CVE-2017-17680

  In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in coders/xpm.c, which …

  imagemagick imagemagick Debian Ubuntu
  Dec 14, 2017
• Unscored —
  CVE-2017-17683

  Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c44 \\.\PSMEMDriver DeviceIoControl request.

  Dec 14, 2017
• Unscored —
  CVE-2017-17684

  Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c04 \\.\PSMEMDriver DeviceIoControl request.

  Dec 14, 2017
• Unscored —
  CVE-2017-17682

  In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, wh…

  imagemagick imagemagick Debian Ubuntu
  Dec 14, 2017
• Unscored —
  CVE-2017-17681

  In ImageMagick 7.0.7-12 Q16, an infinite loop vulnerability was found in the function ReadPSDChannelZip in coders/psd.c…

  imagemagick imagemagick Debian Ubuntu
  Dec 14, 2017
• Unscored —
  CVE-2017-17671

  vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an un…

  Dec 14, 2017
• Unscored —
  CVE-2017-17672 Public exploit EPSS 15%

  In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file dele…

  Dec 14, 2017