Skip to content
OpenAdvisories

Archive

29 December 2017

Vulnerabilities first published on this day (UTC), newest first.

← November 2017 2017 / December /29 January 2018 →
  1. 141
  2. 26
  3. 38
  4. 422
  5. 560
  6. 657
  7. 730
  8. 830
  9. 986
  10. 103
  11. 1152
  12. 1258
  13. 13104
  14. 1435
  15. 1536
  16. 165
  17. 174
  18. 1831
  19. 1913
  20. 20134
  21. 2151
  22. 2235
  23. 2316
  24. 2428
  25. 2540
  26. 2619
  27. 2723
  28. 2826
  29. 2926
  30. 3024
  31. 314
All Critical High Medium Low Exploited only Public exploit

26 results · Feed

  • Unscored —
    CVE-2015-3302 Public exploit EPSS 22%

    The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before …

    Web / CMS
  • Unscored —
    CVE-2015-8008

    The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allo…

  • Unscored —
    CVE-2013-4578

    jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechani…

  • Unscored —
    CVE-2014-0121

    The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary comma…

  • Unscored —
    CVE-2014-0120

    Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the …

  • Unscored —
    CVE-2014-4978

    The rs_filter_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary fil…

  • Unscored —
    CVE-2014-3630

    XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before …

  • Unscored —
    CVE-2014-8119

    The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application cras…

  • Critical 9.8
    CVE-2014-9515

    Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arb…

  • Unscored —
    CVE-2017-17901

    ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (CPU consumption) via a flood of IP packet…

  • Unscored —
    CVE-2017-17974

    BA SYSTEMS BAS Web on BAS920 devices (with Firmware 01.01.00*, HTTPserv 00002, and Script 02.*) and ISC2000 devices all…

  • High 8.8
    CVE-2017-17973

    In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a th…

    tiff Ubuntu
  • Unscored —
    CVE-2017-17910

    On Hoermann BiSecur devices before 2018, a vulnerability can be exploited by recording a single radio transmission. An …

  • Medium 6.5
    CVE-2017-17760

    Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV

    OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used.

    opencv-contrib-python opencv opencv-python opencv Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2017-17971

    Dolibarr ERP and CRM contain XSS Vulnerability

    The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Unscored —
    CVE-2017-17933

    cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS vi…

  • Unscored —
    CVE-2017-17917 Public exploit

    SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute…

    rails Debian
  • Unscored —
    CVE-2017-17920

    SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execu…

    rails Debian
  • High 8.1
    CVE-2017-17919

    SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute…

    rails Debian
  • Unscored —
    CVE-2017-17916

    SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execu…

    rails Debian
  • High 7.5
    CVE-2013-7400

    The Direct Mail (direct_mail) TYPO3 extension improperly discloses sensitive information

    The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes.

    directmailteam/direct-mail Packagist
  • High 7.5
    CVE-2014-3651

    Keycloak vulnerable to uncontrolled resource consumption

    JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation.

    org.keycloak:keycloak-core Maven
  • Unscored —
    CVE-2016-3695

    The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware …

    linux Debian
  • Medium 6.1
    CVE-2017-16876

    mistune Cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.

    mistune mistune mistune Debian Ubuntu PyPI
  • Unscored —
    CVE-2017-17968 Public exploit EPSS 39%

    A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remo…

  • Unscored —
    CVE-2014-4914

    The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows r…