Archive
December 2017
Vulnerabilities first published in this month (UTC), newest first.
1,107 results · Feed
-
Unscored —
Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPr…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functi…
-
Unscored —
Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) comp…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/ad…
-
Unscored —
The RPC service in Tripwire (formerly nCircle) IP360 VnE Manager 7.2.2 before 7.2.6 allows remote attackers to bypass a…
-
Unscored —
The __hash_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context-dependent attackers to…
-
Unscored —
Heap-based buffer overflow in the __get_page function in lib/dbm/src/h_page.c in Mozilla Network Security Services (NSS…
-
Unscored —
Heap-based buffer overflow in the alloc_segs function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) …
-
Unscored —
Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS)…
-
Unscored —CVE-2017-9608 Public exploit
The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (…
-
Unscored —CVE-2015-7889 Public exploit
The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions …
-
Unscored —
SQL injection vulnerability in phpMyBackupPro when run in multi-user mode before 2.5 allows remote attackers to execute…
-
Unscored —CVE-2014-8389 EPSS 51%
cgi-bin/mft/wireless_mft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive BU-3026 with firmware 1.43 21…
-
Medium 6.5
Denial of Service in mqtt
MQTT.js 2.x.x prior to 2.15.0 issue in handling PUBLISH tickets may lead to an attacker causing a denial-of-service condition.
-
Unscored —CVE-2016-6914 Public exploit
Ubiquiti UniFi Video before 3.8.0 for Windows uses weak permissions for the installation directory, which allows local …
-
Unscored —
Cross-site scripting (XSS) vulnerability in User Policy editor in Synology MailPlus Server before 1.4.0-0415 allows rem…
-
Unscored —CVE-2017-13056 Public exploit
The launchURL function in PDF-XChange Viewer 2.5 (Build 314.0) might allow remote attackers to execute arbitrary code v…
-
Unscored —
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could reveal sensitive information from an error message that could lead to…
-
Unscored —
An undisclosed vulnerability in CLM applications (including IBM Rational Collaborative Lifecycle Management 4.0, 5.0, a…
-
Unscored —
IBM Team Concert (RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0) is vulnerable to cr…
-
Unscored —
ImageMagick 7.0.7-17 Q16 x86_64 has memory leaks in coders/msl.c, related to MSLPopImage and ProcessMSLScript, and asso…
-
Unscored —
The File_read_line function in epan/wslua/wslua_file.c in Wireshark through 2.2.11 does not properly strip '\n' charact…
-
Unscored —
PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the …
-
Unscored —
PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter.
-
Unscored —
PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attack…
-
Unscored —
PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title parameter.
-
Unscored —
PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a …
-
Unscored —
PHP Scripts Mall Resume Clone Script has SQL Injection via the forget.php username parameter.
-
Unscored —
PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a cr…
-
Unscored —
PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter.
-
Unscored —
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c,…
-
Unscored —
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadMNGImage in coders/png.c, rel…
-
Unscored —
In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadNewsProfile in coders/tiff.c,…
-
Unscored —
In ImageMagick 7.0.7-16 Q16, a vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows at…
-
Unscored —
packages/core/contact.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?p=core/contact request,…
-
Unscored —CVE-2017-17875 Public exploit
The JEXTN FAQ Pro extension 4.0.0 for Joomla! has SQL Injection via the id parameter in a view=category action.
-
Unscored —CVE-2017-17876 Public exploit
Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a …
-
High 8.8
After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain…
-
Unscored —
Siemens LOGO! Soft Comfort (All versions before V8.2) lacks integrity verification of software packages downloaded via …