Archive
January 2018
Vulnerabilities first published in this month (UTC), newest first.
81 results · Clear filters · Feed
-
High 7.5
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Installer). Supported versions that are affecte…
-
High 8.8
WPGlobus plugin Stored XSS & CSRF security vulnerability
The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php.
-
High 8.2
MX series, SRX series: Junos OS: Denial of service vulnerability in Flowd on devices with ALG enabled.
On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in memory corruption leading to a flowd daemon crash. Sustained crafted response packets lead to repeated crashe…
-
High 7.4
Security Bulletin: Junos OS: MAC move limit configured to drop traffic may forward traffic.
QFX and EX Series switches configured to drop traffic when the MAC move limit is exceeded will forward traffic instead of dropping traffic. This can lead to denials of services or other unintended conditions. Affected releases are Juniper Networks Junos OS: 1…
-
High 7.8
Junos Space: Local privilege escalation vulnerability in Junos Space
Junos Space is affected by a privilege escalation vulnerability that may allow a local authenticated attacker to gain root privileges.
-
High 7.0
VladTheEnterprising allows local users to obtain sensitive information by reading MySQL root password from temporary file
Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed.
-
High 7.8
lean-ruport allows local users to obtain sensitive information by listing the process
test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
-
High 7.8
backup-agoddard and backup_checksum have Information Exposure vulnerability
(1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for Ruby place credentials on the openssl command line, which allows local users to obtain sensitive information by listing the…
-
High 7.8
point-cli allows local users to obtain sensitive information by listing the process
lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
-
High 7.8
kajam allows local users to obtain sensitive information by listing the process
vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump command line in the capture function and (2) mysql command line in the restore function, which allows local users to o…
-
High 7.8
codders-dataset Process Table Local Plaintext Credential Disclosure
(1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
-
High 7.8
Cap-Strap gem for Ruby places credentials on the useradd command line
lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive information by listing the process.
-
High 7.8
brbackup exposes database password to unauthorized users
lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive information by listing the process.
-
High 7.8
lynx doesn't properly sanitize user input and exposes database password to unauthorized users
The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.
-
High 7.8
lawn-login exposes database password to unauthorized users
The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
-
High 7.8
Kcapifony gem for Ruby places database user passwords on the command line
lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg_dump, (3) mysql, and (4) psql command lines, which allows local users to obtain sensitive information by listing the processes.
-
High 7.0
Privilege Escalation in Hibernate Validator
In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege esca…
-
High 7.1
Apache Geode gfsh authorization vulnerability
When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the user is able to obtain status information and control cluster members even without CLUSTER:MANAGE p…
-
High 7.5
Apache Geode OQL method invocation vulnerability
When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user coul…
-
High 8.8
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow…
KEV Nov 3, 2021 -
High 7.5
Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents
Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents are processed, aka ".NET and .NET Core Denial Of Service Vu…
-
High 7.8
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow…
KEV Nov 3, 2021 -
High 7.5
Improper Certificate Validation in Microsoft .NET Framework components
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature B…
-
High 7.5
ChakraCore RCE Vulnerability
Microsoft ChakraCore allows an attacker to bypass Control Flow Guard (CFG) in conjunction with another vulnerability to run arbitrary code on a target system, due to how the Chakra scripting engine handles accessing memory, aka "Scripting Engine Security Feat…
-
High 7.5
Apache Sling JCR ContentLoader XmlReader Arbitrary File Load
The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2…
-
High 7.8
In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD)…
-
High 7.8
In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD)…
-
High 7.5
Cisco node-jose improper validation of JWT signature
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (J…
-
High 7.1
In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a syml…
-
High 7.5
XXE Vulnerability in XMLBundle 0.1.7
XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result in denial of service attacks.
-
High 8.1
Disabled users able to log in with third party SSO plugin
Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address
-
High 7.8
Android SVG vulnerable to XML External Entity (XXE)
AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution
-
High 8.8CVE-2017-1000499 Public exploit
phpMyAdmin CSRF Vulnerability
phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.
-
High 8.1
pysaml2 Improper Authentication vulnerability
pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.
-
High 7.5
phpBB Server-Side Request Forgery (SSRF)
phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application.
-
High 7.5
Syncthing vulnerable to symlink traversal and arbitrary file overwrite
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
-
High 8.8
Integer Overflow or Wraparound in OpenCV.
In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 a…
-
High 7.8
fs-git command injection vulnerability
fs-git is a file system like api for git repository. The fs-git version 1.0.1 module relies on child_process.exec, however, the buildCommand method used to construct exec strings does not properly sanitize data and is vulnerable to command injection across al…
-
High 7.5
Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames
An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users.
-
High 8.8
Craft CMS PHP Code Injection Vulnerability
Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension.