CVEs

113,126 total · page 2182 of 2,263

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2016-9249	F5, Inc. Big Ip (ltm, Aam, Afm, Apm, Asm, Link Controller, Pem, Webaccelerator, Websafe)	Hig	0.49	7.5	0.02	Jan 31, 2017	An undisclosed traffic pattern received by a BIG-IP Virtual Server with TCP Fast Open enabled may cause the Traffic Management Microkernel (TMM) to restart, resulting in a Denial-of-Service (DoS).
CVE-2016-7798	Ruby Lang OpenSSL	Hig	0.42	7.5	0.03	Jan 30, 2017	The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.
CVE-2016-6270	Trend Micro Virtual Mobile Infrastructure	Hig	0.58	8.8	0.06	Jan 30, 2017	The handle_certificate function in /vmi/manager/engine/management/commands/apns_worker.py in Trend Micro Virtual Mobile Infrastructure before 5.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the password to…
CVE-2016-6268	Trend Micro Smart Protection Server	Hig	0.51	7.8	0.01	Jan 30, 2017	Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows local webserv users to execute arbitrary code with root privileges via a Trojan horse .war file in the Solr webapps directory.
CVE-2016-6267	Trend Micro Smart Protection Server	Hig	0.65	8.8	0.55	Jan 30, 2017	SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) spare_Community, (2) spare_AllowGroupIP, or (3)…
CVE-2016-6266	Trend Micro Smart Protection Server	Hig	0.58	8.8	0.08	Jan 30, 2017	ccca_ajaxhandler.php in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) host or (2) apikey parameter in a register…
CVE-2016-6167	Putty Putty	Hig	0.51	7.8	0.01	Jan 30, 2017	Multiple untrusted search path vulnerabilities in Putty beta 0.67 allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) UxTheme.dll or (2) ntmarta.dll file in the current working directory.
CVE-2016-2399	Libquicktime Libquicktime	Hig	0.54	7.8	0.07	Jan 30, 2017	Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted hdlr MP4 atom.
CVE-2016-10087	Libpng Libpng	Hig	0.49	7.5	0.06	Jan 30, 2017	The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure,…
CVE-2015-2181	Roundcube Webmail	Hig	0.57	8.8	0.03	Jan 30, 2017	Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
CVE-2015-2180	Roundcube Webmail	Hig	0.58	8.8	0.05	Jan 30, 2017	The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password.
CVE-2016-9939	Cryptopp Crypto\+\+	Hig	0.49	7.5	0.04	Jan 30, 2017	Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough content octets in the ASN.1 object, then the function will fail and the…
CVE-2016-7544	Cryptopp Crypto\+\+	Hig	0.49	7.5	0.03	Jan 30, 2017	Crypto++ 5.6.4 incorrectly uses Microsoft's stack-based _malloca and _freea functions. The library will request a block of memory to align a table in memory. If the table is later reallocated, then the wrong pointer could be freed.
CVE-2015-7979	NTP NTP	Hig	0.50	7.5	0.12	Jan 30, 2017	NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client.
CVE-2015-7978	NTP NTP	Hig	0.50	7.5	0.10	Jan 30, 2017	NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list.
CVE-2017-5628	Artifex Mujs	Hig	0.51	7.8	0.01	Jan 30, 2017	An issue was discovered in Artifex Software, Inc. MuJS before 8f62ea10a0af68e56d5c00720523ebcba13c2e6a. The MakeDay function in jsdate.c does not validate the month, leading to an integer overflow when parsing a specially crafted JS file.
CVE-2017-5627	Artifex Mujs	Hig	0.51	7.8	0.01	Jan 30, 2017	An issue was discovered in Artifex Software, Inc. MuJS before 4006739a28367c708dea19aeb19b8a1a9326ce08. The jsR_setproperty function in jsrun.c lacks a check for a negative array length. This leads to an integer overflow in the js_pushstring function in jsrun.c when parsing a…
CVE-2016-10186	Dlink DWR-932B	Hig	0.49	7.5	0.04	Jan 30, 2017	An issue was discovered on the D-Link DWR-932B router. /var/miniupnpd.conf has no deny rules.
CVE-2016-10185	Dlink DWR-932B	Hig	0.49	7.5	0.04	Jan 30, 2017	An issue was discovered on the D-Link DWR-932B router. A secure_mode=no line exists in /var/miniupnpd.conf.
CVE-2016-10184	Dlink DWR-932B	Hig	0.49	7.5	0.06	Jan 30, 2017	An issue was discovered on the D-Link DWR-932B router. qmiweb allows file reading with ..%2f traversal.
CVE-2016-10183	Dlink DWR-932B	Hig	0.49	7.5	0.06	Jan 30, 2017	An issue was discovered on the D-Link DWR-932B router. qmiweb allows directory listing with ../ traversal.
CVE-2016-10181	Dlink DWR-932B	Hig	0.49	7.5	0.04	Jan 30, 2017	An issue was discovered on the D-Link DWR-932B router. qmiweb provides sensitive information for CfgType=get_homeCfg requests.
CVE-2016-10180	Dlink DWR-932B	Hig	0.49	7.5	0.04	Jan 30, 2017	An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time(0)) seeding.
CVE-2016-10179	Dlink DWR-932B	Hig	0.49	7.5	0.05	Jan 30, 2017	An issue was discovered on the D-Link DWR-932B router. There is a hardcoded WPS PIN of 28296607.
CVE-2017-5609	Serendipity Serendipity	Hig	0.57	8.8	0.02	Jan 28, 2017	SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via the cat parameter.
CVE-2016-9554	Sophos Web Appliance	Hig	0.52	7.2	0.25	Jan 28, 2017	The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. These vulnerabilities occur in MgrDiagnosticTools.php (/controllers/MgrDiagnosticTools.php), in the…
CVE-2016-9553	Sophos Web Appliance	Hig	0.51	7.2	0.19	Jan 28, 2017	The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. These vulnerabilities occur in the MgrReport.php (/controllers/MgrReport.php) component responsible for blocking and unblocking IP…
CVE-2017-5601	Libarchive Libarchive	Hig	0.49	7.5	0.04	Jan 27, 2017	An error in the lha_read_file_header_1() function (archive_read_support_format_lha.c) in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access and subsequently cause a crash via a specially crafted archive.
CVE-2017-5329	Paloaltonetworks Terminal Services Agent	Hig	0.54	7.8	0.01	Jan 27, 2017	Palo Alto Networks Terminal Services Agent before 7.0.7 allows local users to gain privileges via vectors that trigger an out-of-bounds write operation.
CVE-2017-5328	Paloaltonetworks Terminal Services Agent	Hig	0.49	7.5	0.01	Jan 27, 2017	Palo Alto Networks Terminal Services Agent before 7.0.7 allows attackers to spoof arbitrary users via unspecified vectors.
CVE-2017-3443	Oracle Corporation Common Applications	Hig	0.53	8.2	0.02	Jan 27, 2017	Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3442	Oracle Corporation Customer Interaction History	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access…
CVE-2017-3441	Oracle Corporation Customer Interaction History	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access…
CVE-2017-3440	Oracle Corporation Customer Interaction History	Hig	0.53	8.2	0.02	Jan 27, 2017	Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access…
CVE-2017-3439	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3438	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3437	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3436	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3435	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3433	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3431	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3430	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3429	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3428	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3427	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3426	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3425	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3424	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3423	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3422	Oracle Corporation One To One Fulfillment	Hig	0.53	8.2	0.01	Jan 27, 2017	Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…

CVE-2016-9249HigJan 31, 2017
F5, Inc.
Big Ip (ltm, Aam, Afm, Apm, Asm, Link Controller, Pem, Webaccelerator, Websafe)
risk 0.49cvss 7.5epss 0.02
An undisclosed traffic pattern received by a BIG-IP Virtual Server with TCP Fast Open enabled may cause the Traffic Management Microkernel (TMM) to restart, resulting in a Denial-of-Service (DoS).
CVE-2016-7798HigJan 30, 2017
Ruby Lang
OpenSSL
risk 0.42cvss 7.5epss 0.03
The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.
CVE-2016-6270HigJan 30, 2017
Trend Micro
Virtual Mobile Infrastructure
risk 0.58cvss 8.8epss 0.06
The handle_certificate function in /vmi/manager/engine/management/commands/apns_worker.py in Trend Micro Virtual Mobile Infrastructure before 5.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the password to…
CVE-2016-6268HigJan 30, 2017
Trend Micro
Smart Protection Server
risk 0.51cvss 7.8epss 0.01
Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows local webserv users to execute arbitrary code with root privileges via a Trojan horse .war file in the Solr webapps directory.
CVE-2016-6267HigJan 30, 2017
Trend Micro
Smart Protection Server
risk 0.65cvss 8.8epss 0.55
SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) spare_Community, (2) spare_AllowGroupIP, or (3)…
CVE-2016-6266HigJan 30, 2017
Trend Micro
Smart Protection Server
risk 0.58cvss 8.8epss 0.08
ccca_ajaxhandler.php in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) host or (2) apikey parameter in a register…
CVE-2016-6167HigJan 30, 2017
Putty
Putty
risk 0.51cvss 7.8epss 0.01
Multiple untrusted search path vulnerabilities in Putty beta 0.67 allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) UxTheme.dll or (2) ntmarta.dll file in the current working directory.
CVE-2016-2399HigJan 30, 2017
Libquicktime
Libquicktime
risk 0.54cvss 7.8epss 0.07
Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted hdlr MP4 atom.
CVE-2016-10087HigJan 30, 2017
Libpng
Libpng
risk 0.49cvss 7.5epss 0.06
The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure,…
CVE-2015-2181HigJan 30, 2017
Roundcube
Webmail
risk 0.57cvss 8.8epss 0.03
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
CVE-2015-2180HigJan 30, 2017
Roundcube
Webmail
risk 0.58cvss 8.8epss 0.05
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password.
CVE-2016-9939HigJan 30, 2017
Cryptopp
Crypto\+\+
risk 0.49cvss 7.5epss 0.04
Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough content octets in the ASN.1 object, then the function will fail and the…
CVE-2016-7544HigJan 30, 2017
Cryptopp
Crypto\+\+
risk 0.49cvss 7.5epss 0.03
Crypto++ 5.6.4 incorrectly uses Microsoft's stack-based _malloca and _freea functions. The library will request a block of memory to align a table in memory. If the table is later reallocated, then the wrong pointer could be freed.
CVE-2015-7979HigJan 30, 2017
NTP
NTP
risk 0.50cvss 7.5epss 0.12
NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client.
CVE-2015-7978HigJan 30, 2017
NTP
NTP
risk 0.50cvss 7.5epss 0.10
NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list.
CVE-2017-5628HigJan 30, 2017
Artifex
Mujs
risk 0.51cvss 7.8epss 0.01
An issue was discovered in Artifex Software, Inc. MuJS before 8f62ea10a0af68e56d5c00720523ebcba13c2e6a. The MakeDay function in jsdate.c does not validate the month, leading to an integer overflow when parsing a specially crafted JS file.
CVE-2017-5627HigJan 30, 2017
Artifex
Mujs
risk 0.51cvss 7.8epss 0.01
An issue was discovered in Artifex Software, Inc. MuJS before 4006739a28367c708dea19aeb19b8a1a9326ce08. The jsR_setproperty function in jsrun.c lacks a check for a negative array length. This leads to an integer overflow in the js_pushstring function in jsrun.c when parsing a…
CVE-2016-10186HigJan 30, 2017
Dlink
DWR-932B
risk 0.49cvss 7.5epss 0.04
An issue was discovered on the D-Link DWR-932B router. /var/miniupnpd.conf has no deny rules.
CVE-2016-10185HigJan 30, 2017
Dlink
DWR-932B
risk 0.49cvss 7.5epss 0.04
An issue was discovered on the D-Link DWR-932B router. A secure_mode=no line exists in /var/miniupnpd.conf.
CVE-2016-10184HigJan 30, 2017
Dlink
DWR-932B
risk 0.49cvss 7.5epss 0.06
An issue was discovered on the D-Link DWR-932B router. qmiweb allows file reading with ..%2f traversal.
CVE-2016-10183HigJan 30, 2017
Dlink
DWR-932B
risk 0.49cvss 7.5epss 0.06
An issue was discovered on the D-Link DWR-932B router. qmiweb allows directory listing with ../ traversal.
CVE-2016-10181HigJan 30, 2017
Dlink
DWR-932B
risk 0.49cvss 7.5epss 0.04
An issue was discovered on the D-Link DWR-932B router. qmiweb provides sensitive information for CfgType=get_homeCfg requests.
CVE-2016-10180HigJan 30, 2017
Dlink
DWR-932B
risk 0.49cvss 7.5epss 0.04
An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time(0)) seeding.
CVE-2016-10179HigJan 30, 2017
Dlink
DWR-932B
risk 0.49cvss 7.5epss 0.05
An issue was discovered on the D-Link DWR-932B router. There is a hardcoded WPS PIN of 28296607.
CVE-2017-5609HigJan 28, 2017
Serendipity
Serendipity
risk 0.57cvss 8.8epss 0.02
SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via the cat parameter.
CVE-2016-9554HigJan 28, 2017
Sophos
Web Appliance
risk 0.52cvss 7.2epss 0.25
The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. These vulnerabilities occur in MgrDiagnosticTools.php (/controllers/MgrDiagnosticTools.php), in the…
CVE-2016-9553HigJan 28, 2017
Sophos
Web Appliance
risk 0.51cvss 7.2epss 0.19
The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. These vulnerabilities occur in the MgrReport.php (/controllers/MgrReport.php) component responsible for blocking and unblocking IP…
CVE-2017-5601HigJan 27, 2017
Libarchive
Libarchive
risk 0.49cvss 7.5epss 0.04
An error in the lha_read_file_header_1() function (archive_read_support_format_lha.c) in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access and subsequently cause a crash via a specially crafted archive.
CVE-2017-5329HigJan 27, 2017
Paloaltonetworks
Terminal Services Agent
risk 0.54cvss 7.8epss 0.01
Palo Alto Networks Terminal Services Agent before 7.0.7 allows local users to gain privileges via vectors that trigger an out-of-bounds write operation.
CVE-2017-5328HigJan 27, 2017
Paloaltonetworks
Terminal Services Agent
risk 0.49cvss 7.5epss 0.01
Palo Alto Networks Terminal Services Agent before 7.0.7 allows attackers to spoof arbitrary users via unspecified vectors.
CVE-2017-3443HigJan 27, 2017
Oracle Corporation
Common Applications
risk 0.53cvss 8.2epss 0.02
Vulnerability in the Oracle Common Applications component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3442HigJan 27, 2017
Oracle Corporation
Customer Interaction History
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access…
CVE-2017-3441HigJan 27, 2017
Oracle Corporation
Customer Interaction History
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access…
CVE-2017-3440HigJan 27, 2017
Oracle Corporation
Customer Interaction History
risk 0.53cvss 8.2epss 0.02
Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access…
CVE-2017-3439HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3438HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3437HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3436HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3435HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3433HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3431HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3430HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3429HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3428HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3427HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3426HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3425HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3424HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3423HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…
CVE-2017-3422HigJan 27, 2017
Oracle Corporation
One To One Fulfillment
risk 0.53cvss 8.2epss 0.01
Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated…