Archive
23 January 2018
Vulnerabilities first published on this day (UTC), newest first.
64 results · Feed
-
High 7.5
Apache NiFi host header poisoning issue
A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x rele…
-
Critical 9.8
Apache NiFi XSS issue in context path handling
A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x rel…
-
Unscored —
Symantec Reporter 9.5 prior to 9.5.4.1 and 10.1 prior to 10.1.5.5 does not restrict excessive authentication attempts f…
-
Unscored —
install.php in Minecraft Servers List Lite before commit c1cd164 and Premium Minecraft Servers List before 2.0.4 does n…
-
Unscored —
The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds r…
-
Unscored —CVE-2018-5359 Public exploit
The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining syste…
-
Unscored —
The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged users to caus…
-
Unscored —CVE-2017-17999 Public exploit
SQL injection vulnerability in RISE Ultimate Project Manager 1.9 allows remote attackers to execute arbitrary SQL comma…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbit…
-
Unscored —
A potential security vulnerability has been identified with the command line shell of the HP ThinPro operating system 6…
-
Unscored —
Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1. The vulnera…
-
Unscored —
A potential security vulnerability has been identified with HP Web Jetadmin before 10.4 SR2. This vulnerability could p…
-
Unscored —
Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1. The vulnera…
-
Unscored —
HP has identified a potential security vulnerability with HP Enterprise LaserJet Printers and MFPs, HP OfficeJet Enterp…
-
Unscored —
The vulnerability allows attacker to extract binaries into protected file system locations in HP Support Assistant befo…
-
Unscored —
Insufficient Solution DLL Signature Validation allows potential execution of arbitrary code in HP LaserJet Enterprise p…
-
Unscored —
HP has identified a potential security vulnerability before IG_11_00_00.10 for DesignJet T790, T795, T1300, T2300, befo…
-
Unscored —
A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmw…
-
Unscored —
A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSE…
-
Unscored —
A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated w…
-
Unscored —
A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.…
-
Unscored —
An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.…
-
Unscored —
An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and …
-
Unscored —
When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up …
-
Unscored —
An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to…
-
Unscored —
On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the P…
-
High 8.8
CSRF vulnerability in Jenkins Translation Assistance plugin
Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to override localized strings displayed to all users on the current Jenkins instance if the …
-
High 8.8
XXE vulnerability in Jenkins PMD Plugin
Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial…
-
High 8.8
XXE vulnerability in Jenkins DRY Plugin
Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial…
-
High 8.8
CSRF vulnerability in Jenkins Release plugin
Jenkins Release Plugin 2.9 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to trigger release builds.
-
High 8.8
XML External Entity Reference in Jenkins FindBugs Plugin
Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or d…
-
High 8.8
XXE vulnerability Jenkins Warnings Plugin
Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or d…
-
High 8.8
XXE vulnerability in Jenkins Checkstyle Plugin
Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or…
-
Medium 4.8
Incorrect permission checks in Pipeline: Nodes and Processes plugin
On Jenkins instances with Authorize Project plugin, the authentication associated with a build may lack the Computer/Build permission on some agents. This did not prevent the execution of Pipeline `node` blocks on those agents due to incorrect permissions che…
-
Unscored —
The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the co…
-
Unscored —
Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authe…
-
Medium 5.5
SilverStripe CSV Excel Macro Injection
In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain macros and scripts, which may be executed if imported without sanitization into common software (including Microsoft Exce…
-
Unscored —
Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for ex…
-
Unscored —CVE-2016-5345 Public exploit
Buffer overflow in the Qualcomm radio driver in Android before 2017-01-05 on Android One devices allows local users to …
-
Unscored —
This vulnerability allows remote attackers to overwrite files on vulnerable installations of NetGain Systems Enterprise…