| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2015-8707 | Cri | 0.64 | 9.8 | 0.01 | Sep 26, 2017 | Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote attackers to obtain user passwords via a crafted external service with access to the referrer field. | ||
| CVE-2015-0238 | Low | 0.21 | 3.3 | 0.00 | Sep 26, 2017 | selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack. | ||
| CVE-2014-8889 | Med | 0.35 | 5.3 | 0.06 | Sep 26, 2017 | Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or via a drive-by download attack. | ||
| CVE-2014-8170 | Hig | 0.57 | 8.8 | 0.04 | Sep 26, 2017 | ovirt_safe_delete_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3 do not properly quote input strings, which allows remote authenticated users and physically proximate attackers to… | ||
| CVE-2014-8156 | Hig | 0.51 | 7.8 | 0.00 | Sep 26, 2017 | The D-Bus security policy files in /etc/dbus-1/system.d/*.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512-4, and fso-usaged 0.12.0-2 as packaged in Debian, the upstream cornucopia.git (fsoaudiod, fsodatad, fsodeviced, fsogsmd, fsonetworkd, fsotdld, fsousaged) git… | ||
| CVE-2014-0997 | Hig | 0.52 | 7.5 | 0.06 | Sep 26, 2017 | WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used in the Samsung SM-T310, Android 4.1.2 as used in the Motorola RAZR HD, and potentially other unspecified Android releases before 5.0.1 and 5.0.2 does not… | ||
| CVE-2017-14735 | Med | 0.40 | 6.1 | 0.02 | Sep 25, 2017 | OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL. | ||
| CVE-2017-14734 | Hig | 0.57 | 8.8 | 0.02 | Sep 25, 2017 | The build_msps function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted BPG file, related to hevc_decode_init1. | ||
| CVE-2017-14733 | Med | 0.42 | 6.5 | 0.02 | Sep 25, 2017 | ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. | ||
| CVE-2017-14731 | Med | 0.42 | 6.5 | 0.01 | Sep 25, 2017 | ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call. | ||
| CVE-2016-5868 | Hig | 0.46 | 7.0 | 0.01 | Sep 25, 2017 | drivers/net/ethernet/msm/rndis_ipa.c in the Qualcomm networking driver in Android allows remote attackers to execute arbitrary code via a crafted application compromising a privileged process. | ||
| CVE-2015-8375 | Med | 0.28 | 5.4 | 0.01 | Sep 25, 2017 | Cross-site scripting (XSS) vulnerability in PHP-Fusion 9. | ||
| CVE-2015-8251 | Med | 0.38 | 5.9 | 0.01 | Sep 25, 2017 | OpenStage 60 and OpenScape Desk Phone IP 55G SIP V3, OpenStage 15, 20E, 20 and 40 and OpenScape Desk Phone IP 35G SIP V3, OpenScape Desk Phone IP 35G Eco SIP V3, OpenStage 60 and OpenScape Desk Phone IP 55G HFA V3, OpenStage 15, 20E, 20, and 40 and OpenScape Desk Phone IP 35G… | ||
| CVE-2015-7846 | Med | 0.30 | 4.6 | 0.00 | Sep 25, 2017 | Huawei S7700, S9700, S9300 before V200R07C00SPC500, and AR200, AR1200, AR2200, AR3200 before V200R005C20SPC200 allows attackers with physical access to the CF card to obtain sensitive information. | ||
| CVE-2015-7785 | Med | 0.38 | 5.9 | 0.01 | Sep 25, 2017 | GANMA! App for iOS does not verify SSL certificates. | ||
| CVE-2015-7544 | Cri | 0.59 | 9.1 | 0.03 | Sep 25, 2017 | redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with the SuperUser role on any Entity to execute arbitrary commands on any host in the RHEV environment. | ||
| CVE-2015-7510 | Cri | 0.57 | 9.8 | 0.04 | Sep 25, 2017 | Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd. | ||
| CVE-2015-7293 | Hig | 0.60 | 8.8 | 0.03 | Sep 25, 2017 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x. | ||
| CVE-2015-6592 | Med | 0.44 | 6.8 | 0.00 | Sep 25, 2017 | Huawei UAP2105 before V300R012C00SPC160(BootRom) does not require authentication to the serial port or the VxWorks shell. | ||
| CVE-2015-5704 | Hig | 0.51 | 7.8 | 0.01 | Sep 25, 2017 | scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands. | ||
| CVE-2015-5666 | Med | 0.38 | 5.9 | 0.01 | Sep 25, 2017 | ANA App for Android 3.1.1 and earlier, and ANA App for iOS 3.3.6 and earlier does not verify SSL certificates. | ||
| CVE-2015-5327 | Med | 0.35 | 6.5 | 0.02 | Sep 25, 2017 | Out-of-bounds memory read in the x509_decode_time function in x509_cert_parser.c in Linux kernels 4.3-rc1 and after. | ||
| CVE-2015-5263 | Hig | 0.46 | 8.1 | 0.01 | Sep 25, 2017 | pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration. | ||
| CVE-2015-5184 | Hig | 0.49 | 7.5 | 0.01 | Sep 25, 2017 | Console: CORS headers set to allow all in Red Hat AMQ. | ||
| CVE-2015-5183 | Hig | 0.49 | 7.5 | 0.02 | Sep 25, 2017 | Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ. | ||
| CVE-2015-5182 | Hig | 0.57 | 8.8 | 0.01 | Sep 25, 2017 | Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ. | ||
| CVE-2015-5181 | Med | 0.35 | 5.4 | 0.01 | Sep 25, 2017 | The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript. | ||
| CVE-2015-5169 | Med | 0.40 | 6.1 | 0.08 | Sep 25, 2017 | Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20. | ||
| CVE-2012-6696 | Cri | 0.57 | 9.8 | 0.02 | Sep 25, 2017 | inspircd in Debian before 2.0.7 does not properly handle unsigned integers. NOTE: This vulnerability exists because of an incomplete fix to CVE-2012-1836. | ||
| CVE-2011-4667 | Med | 0.38 | 5.9 | 0.01 | Sep 25, 2017 | The encryption library in Cisco IOS Software 15.2(1)T, 15.2(1)T1, and 15.2(2)T, Cisco NX-OS in Cisco MDS 9222i Multiservice Modular Switch, Cisco MDS 9000 18/4-Port Multiservice Module, and Cisco MDS 9000 Storage Services Node module before 5.2(6), and Cisco IOS in Cisco VPN… | ||
| CVE-2017-14730 | Hig | 0.51 | 7.8 | 0.00 | Sep 25, 2017 | The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to a $LS_USER account for creation of a hard link. | ||
| CVE-2017-14125 | Cri | 0.64 | 9.8 | 0.03 | Sep 25, 2017 | SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "id" parameter in an add_edit_theme task in the wpdevart_gallery_themes page to wp-admin/admin.php. | ||
| CVE-2017-12905 | Cri | 0.65 | 10.0 | 0.03 | Sep 25, 2017 | Server Side Request Forgery vulnerability in Vebto Pixie Image Editor 1.4 and 1.7 allows remote attackers to disclose information or execute arbitrary code via the url parameter to Launderer.php. | ||
| CVE-2015-7318 | Hig | 0.49 | 7.5 | 0.02 | Sep 25, 2017 | Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses. | ||
| CVE-2015-7317 | Med | 0.44 | 6.8 | 0.02 | Sep 25, 2017 | Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings. | ||
| CVE-2015-7316 | Med | 0.33 | 6.1 | 0.01 | Sep 25, 2017 | Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1. | ||
| CVE-2015-7315 | Med | 0.32 | 5.9 | 0.02 | Sep 25, 2017 | Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator. | ||
| CVE-2015-6748 | Med | 0.33 | 6.1 | 0.02 | Sep 25, 2017 | Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3. | ||
| CVE-2015-5282 | Med | 0.33 | 6.1 | 0.01 | Sep 25, 2017 | Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after. | ||
| CVE-2015-5237 | Hig | 0.58 | 8.8 | 0.05 | Sep 25, 2017 | protobuf allows remote authenticated attackers to cause a heap-based buffer overflow. | ||
| CVE-2015-4669 | Hig | 0.54 | 7.8 | 0.01 | Sep 25, 2017 | The MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to access databases on the system. | ||
| CVE-2015-4668 | Med | 0.43 | 6.1 | 0.07 | Sep 25, 2017 | Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter. | ||
| CVE-2015-4667 | Cri | 0.68 | 9.8 | 0.11 | Sep 25, 2017 | Multiple hardcoded credentials in Xsuite 2.x. | ||
| CVE-2010-3050 | Med | 0.42 | 6.5 | 0.01 | Sep 25, 2017 | Cisco IOS before 12.2(33)SXI allows remote authenticated users to cause a denial of service (device reboot). | ||
| CVE-2010-3049 | Med | 0.36 | 5.5 | 0.00 | Sep 25, 2017 | Cisco IOS before 12.2(33)SXI allows local users to cause a denial of service (device reboot). | ||
| CVE-2017-9551 | Med | 0.40 | 6.1 | 0.01 | Sep 25, 2017 | Mahara 15.04 before 15.04.14 and 16.04 before 16.04.8 and 16.10 before 16.10.5 and 17.04 before 17.04.3 are vulnerable to a user submitting potential dangerous payload, e.g. XSS code, to be saved as their name in the usr_registration table. The values are then emailed to the the… | ||
| CVE-2017-1555 | Med | 0.28 | 4.3 | 0.01 | Sep 25, 2017 | IBM API Connect 5.0.0.0 through 5.0.7.2 could allow an authenticated user to generate an API token when not subscribed to the application plan. IBM X-Force ID: 131545. | ||
| CVE-2017-1551 | Med | 0.40 | 6.1 | 0.01 | Sep 25, 2017 | IBM API Connect 5.0.0.0 through 5.0.7.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch… | ||
| CVE-2017-14729 | Hig | 0.51 | 7.8 | 0.02 | Sep 25, 2017 | The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and… | ||
| CVE-2017-1424 | Med | 0.35 | 5.4 | 0.01 | Sep 25, 2017 | IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… |
- risk 0.64cvss 9.8epss 0.01
Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote attackers to obtain user passwords via a crafted external service with access to the referrer field.
- risk 0.21cvss 3.3epss 0.00
selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack.
- risk 0.35cvss 5.3epss 0.06
Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or via a drive-by download attack.
- risk 0.57cvss 8.8epss 0.04
ovirt_safe_delete_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0-474-gb852fd7 as packaged in Red Hat Enterprise Virtualization 3 do not properly quote input strings, which allows remote authenticated users and physically proximate attackers to…
- risk 0.51cvss 7.8epss 0.00
The D-Bus security policy files in /etc/dbus-1/system.d/*.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512-4, and fso-usaged 0.12.0-2 as packaged in Debian, the upstream cornucopia.git (fsoaudiod, fsodatad, fsodeviced, fsogsmd, fsonetworkd, fsotdld, fsousaged) git…
- risk 0.52cvss 7.5epss 0.06
WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used in the Samsung SM-T310, Android 4.1.2 as used in the Motorola RAZR HD, and potentially other unspecified Android releases before 5.0.1 and 5.0.2 does not…
- risk 0.40cvss 6.1epss 0.02
OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.
- risk 0.57cvss 8.8epss 0.02
The build_msps function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted BPG file, related to hevc_decode_init1.
- risk 0.42cvss 6.5epss 0.02
ReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few colors, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.
- risk 0.42cvss 6.5epss 0.01
ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call.
- risk 0.46cvss 7.0epss 0.01
drivers/net/ethernet/msm/rndis_ipa.c in the Qualcomm networking driver in Android allows remote attackers to execute arbitrary code via a crafted application compromising a privileged process.
- risk 0.28cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in PHP-Fusion 9.
- risk 0.38cvss 5.9epss 0.01
OpenStage 60 and OpenScape Desk Phone IP 55G SIP V3, OpenStage 15, 20E, 20 and 40 and OpenScape Desk Phone IP 35G SIP V3, OpenScape Desk Phone IP 35G Eco SIP V3, OpenStage 60 and OpenScape Desk Phone IP 55G HFA V3, OpenStage 15, 20E, 20, and 40 and OpenScape Desk Phone IP 35G…
- risk 0.30cvss 4.6epss 0.00
Huawei S7700, S9700, S9300 before V200R07C00SPC500, and AR200, AR1200, AR2200, AR3200 before V200R005C20SPC200 allows attackers with physical access to the CF card to obtain sensitive information.
- risk 0.38cvss 5.9epss 0.01
GANMA! App for iOS does not verify SSL certificates.
- risk 0.59cvss 9.1epss 0.03
redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with the SuperUser role on any Entity to execute arbitrary commands on any host in the RHEV environment.
- risk 0.57cvss 9.8epss 0.04
Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
- risk 0.60cvss 8.8epss 0.03
Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.
- risk 0.44cvss 6.8epss 0.00
Huawei UAP2105 before V300R012C00SPC160(BootRom) does not require authentication to the serial port or the VxWorks shell.
- risk 0.51cvss 7.8epss 0.01
scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands.
- risk 0.38cvss 5.9epss 0.01
ANA App for Android 3.1.1 and earlier, and ANA App for iOS 3.3.6 and earlier does not verify SSL certificates.
- risk 0.35cvss 6.5epss 0.02
Out-of-bounds memory read in the x509_decode_time function in x509_cert_parser.c in Linux kernels 4.3-rc1 and after.
- risk 0.46cvss 8.1epss 0.01
pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration.
- risk 0.49cvss 7.5epss 0.01
Console: CORS headers set to allow all in Red Hat AMQ.
- risk 0.49cvss 7.5epss 0.02
Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
- risk 0.57cvss 8.8epss 0.01
Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ.
- risk 0.35cvss 5.4epss 0.01
The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.
- risk 0.40cvss 6.1epss 0.08
Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
- risk 0.57cvss 9.8epss 0.02
inspircd in Debian before 2.0.7 does not properly handle unsigned integers. NOTE: This vulnerability exists because of an incomplete fix to CVE-2012-1836.
- risk 0.38cvss 5.9epss 0.01
The encryption library in Cisco IOS Software 15.2(1)T, 15.2(1)T1, and 15.2(2)T, Cisco NX-OS in Cisco MDS 9222i Multiservice Modular Switch, Cisco MDS 9000 18/4-Port Multiservice Module, and Cisco MDS 9000 Storage Services Node module before 5.2(6), and Cisco IOS in Cisco VPN…
- risk 0.51cvss 7.8epss 0.00
The init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1 has "chown -R" calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to a $LS_USER account for creation of a hard link.
- risk 0.64cvss 9.8epss 0.03
SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "id" parameter in an add_edit_theme task in the wpdevart_gallery_themes page to wp-admin/admin.php.
- risk 0.65cvss 10.0epss 0.03
Server Side Request Forgery vulnerability in Vebto Pixie Image Editor 1.4 and 1.7 allows remote attackers to disclose information or execute arbitrary code via the url parameter to Launderer.php.
- risk 0.49cvss 7.5epss 0.02
Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.
- risk 0.44cvss 6.8epss 0.02
Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings.
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.
- risk 0.32cvss 5.9epss 0.02
Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.
- risk 0.33cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.
- risk 0.58cvss 8.8epss 0.05
protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
- risk 0.54cvss 7.8epss 0.01
The MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to access databases on the system.
- risk 0.43cvss 6.1epss 0.07
Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter.
- risk 0.68cvss 9.8epss 0.11
Multiple hardcoded credentials in Xsuite 2.x.
- risk 0.42cvss 6.5epss 0.01
Cisco IOS before 12.2(33)SXI allows remote authenticated users to cause a denial of service (device reboot).
- risk 0.36cvss 5.5epss 0.00
Cisco IOS before 12.2(33)SXI allows local users to cause a denial of service (device reboot).
- risk 0.40cvss 6.1epss 0.01
Mahara 15.04 before 15.04.14 and 16.04 before 16.04.8 and 16.10 before 16.10.5 and 17.04 before 17.04.3 are vulnerable to a user submitting potential dangerous payload, e.g. XSS code, to be saved as their name in the usr_registration table. The values are then emailed to the the…
- risk 0.28cvss 4.3epss 0.01
IBM API Connect 5.0.0.0 through 5.0.7.2 could allow an authenticated user to generate an API token when not subscribed to the application plan. IBM X-Force ID: 131545.
- risk 0.40cvss 6.1epss 0.01
IBM API Connect 5.0.0.0 through 5.0.7.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch…
- risk 0.51cvss 7.8epss 0.02
The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and…
- risk 0.35cvss 5.4epss 0.01
IBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…