| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-0753 | Hig | 0.51 | 7.8 | 0.01 | Sep 8, 2017 | A remote code execution vulnerability in the Android libraries (libgdx). Product: Android. Versions: 7.1.1, 7.1.2, 8.0. Android ID: A-62218744. | ||
| CVE-2017-0752 | Hig | 0.51 | 7.8 | 0.00 | Sep 8, 2017 | A elevation of privilege vulnerability in the Android framework (windowmanager). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-62196835. | ||
| CVE-2017-12146 | Hig | 0.46 | 7.0 | 0.00 | Sep 8, 2017 | The driver_override implementation in drivers/base/platform.c in the Linux kernel before 4.12.1 allows local users to gain privileges by leveraging a race condition between a read operation and a store operation that involve different overrides. | ||
| CVE-2017-14167 | Hig | 0.57 | 8.8 | 0.01 | Sep 8, 2017 | Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write. | ||
| CVE-2016-5759 | Hig | 0.51 | 7.8 | 0.00 | Sep 8, 2017 | The mkdumprd script called "dracut" in the current working directory "." allows local users to trick the administrator into executing code as root. | ||
| CVE-2011-3177 | Hig | 0.44 | 7.8 | 0.00 | Sep 8, 2017 | The YaST2 network created files with world readable permissions which could have allowed local users to read sensitive material out of network configuration files, like passwords for wireless networks. | ||
| CVE-2017-2550 | Hig | 0.49 | 7.5 | 0.01 | Sep 8, 2017 | Vulnerability in Easy Joomla Backup v3.2.4. The software creates a copy of the backup in the web root with an easily guessable filename. | ||
| CVE-2017-12071 | Med | 0.42 | 6.5 | 0.01 | Sep 8, 2017 | Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter. | ||
| CVE-2017-11162 | Med | 0.42 | 6.5 | 0.02 | Sep 8, 2017 | Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary files via unspecified vectors. | ||
| CVE-2017-11161 | Cri | 0.64 | 9.8 | 0.01 | Sep 8, 2017 | Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php. | ||
| CVE-2017-9095 | Med | 0.39 | 5.5 | 0.04 | Sep 8, 2017 | XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import. | ||
| CVE-2017-11611 | Med | 0.35 | 5.4 | 0.01 | Sep 8, 2017 | Wolf CMS 0.8.3.1 allows Cross-Site Scripting (XSS) attacks. The vulnerability exists due to insufficient sanitization of the file name in a "create-file-popup" action, and the directory name in a "create-directory-popup" action, in the HTTP POST method to the… | ||
| CVE-2017-14219 | Med | 0.43 | 6.1 | 0.01 | Sep 7, 2017 | XSS (persistent) on the Intelbras Wireless N 150Mbps router with firmware WRN 240 allows attackers to steal wireless credentials without being connected to the network, related to userRpm/popupSiteSurveyRpm.htm and userRpm/WlanSecurityRpm.htm. The attack vector is a crafted… | ||
| CVE-2017-6796 | Med | 0.44 | 6.7 | 0.00 | Sep 7, 2017 | A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an authenticated, local attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. The… | ||
| CVE-2017-6795 | Med | 0.29 | 4.4 | 0.00 | Sep 7, 2017 | A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an authenticated, local attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is… | ||
| CVE-2017-6794 | Med | 0.44 | 6.7 | 0.01 | Sep 7, 2017 | A vulnerability in the CLI command-parsing code of Cisco Meeting Server could allow an authenticated, local attacker to perform command injection and escalate their privileges to root. The attacker must first authenticate to the application with valid administrator credentials.… | ||
| CVE-2017-6793 | Med | 0.42 | 6.5 | 0.01 | Sep 7, 2017 | A vulnerability in the Inventory Management feature of Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to view sensitive information on the system. The vulnerability is due to insufficient protection of restricted information. An… | ||
| CVE-2017-6792 | Med | 0.42 | 6.5 | 0.02 | Sep 7, 2017 | A vulnerability in the batch provisioning feature in Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to overwrite system files as root. The vulnerability is due to lack of input validation of the parameters in BatchFileName and… | ||
| CVE-2017-6791 | Hig | 0.49 | 7.5 | 0.02 | Sep 7, 2017 | A vulnerability in the Trust Verification Service (TVS) of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of Transport Layer… | ||
| CVE-2017-6789 | Med | 0.40 | 6.1 | 0.01 | Sep 7, 2017 | A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model (DOM)-based, environment or client-side cross-site scripting (XSS) attack. The… | ||
| CVE-2017-6780 | Hig | 0.49 | 7.5 | 0.02 | Sep 7, 2017 | A vulnerability in the TCP throttling process for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to cause the system to consume additional memory, eventually forcing the device to restart, aka Memory Exhaustion. The vulnerability is… | ||
| CVE-2017-6631 | Hig | 0.49 | 7.5 | 0.02 | Sep 7, 2017 | A vulnerability in the HTTP remote procedure call (RPC) service of set-top box (STB) receivers manufactured by Cisco for Yes could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists because the… | ||
| CVE-2017-6627 | Hig | 0.61 | 7.5 | 0.06 | KEV | Sep 7, 2017 | A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and a denial of service… | |
| CVE-2017-12227 | Med | 0.35 | 5.4 | 0.01 | Sep 7, 2017 | A vulnerability in the SQL database interface for Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL queries that bypass protection… | ||
| CVE-2017-12225 | Med | 0.42 | 6.5 | 0.02 | Sep 7, 2017 | A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication… | ||
| CVE-2017-12224 | Med | 0.42 | 6.5 | 0.02 | Sep 7, 2017 | A vulnerability in the ability for guest users to join meetings via a hyperlink with Cisco Meeting Server could allow an authenticated, remote attacker to enter a meeting with a hyperlink URL, even though access should be denied. The vulnerability is due to the incorrect… | ||
| CVE-2017-12223 | Med | 0.42 | 6.4 | 0.00 | Sep 7, 2017 | A vulnerability in the ROM Monitor (ROMMON) code of Cisco IR800 Integrated Services Router Software could allow an unauthenticated, local attacker to boot an unsigned Hypervisor on an affected device and compromise the integrity of the system. The vulnerability is due to… | ||
| CVE-2017-12221 | Med | 0.35 | 5.4 | 0.01 | Sep 7, 2017 | A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected software. The vulnerability is due to insufficient… | ||
| CVE-2017-12220 | Med | 0.40 | 6.1 | 0.01 | Sep 7, 2017 | A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The… | ||
| CVE-2017-12218 | Med | 0.38 | 5.8 | 0.02 | Sep 7, 2017 | A vulnerability in the malware detection functionality within Advanced Malware Protection (AMP) of Cisco AsyncOS Software for Cisco Email Security Appliances (ESAs) could allow an unauthenticated, remote attacker to cause an email attachment containing malware to be delivered to… | ||
| CVE-2017-12217 | Med | 0.35 | 5.3 | 0.02 | Sep 7, 2017 | A vulnerability in the General Packet Radio Service (GPRS) Tunneling Protocol ingress packet handler of Cisco ASR 5500 System Architecture Evolution (SAE) Gateways could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition on an affected… | ||
| CVE-2017-12216 | Hig | 0.57 | 8.8 | 0.03 | Sep 7, 2017 | A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries… | ||
| CVE-2017-12213 | Med | 0.28 | 4.3 | 0.01 | Sep 7, 2017 | A vulnerability in the dynamic access control list (ACL) feature of Cisco IOS XE Software running on Cisco Catalyst 4000 Series Switches could allow an unauthenticated, adjacent attacker to cause dynamic ACL assignment to fail and the port to fail open. This could allow the… | ||
| CVE-2017-12212 | Med | 0.40 | 6.1 | 0.01 | Sep 7, 2017 | A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input… | ||
| CVE-2017-12211 | Med | 0.35 | 5.3 | 0.02 | Sep 7, 2017 | A vulnerability in the IPv6 Simple Network Management Protocol (SNMP) code of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to cause high CPU usage or a reload of the device. The vulnerability is due to IPv6 sub block corruption. An attacker… | ||
| CVE-2015-8079 | Med | 0.35 | 5.3 | 0.01 | Sep 7, 2017 | qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db. | ||
| CVE-2015-7672 | Med | 0.28 | 5.4 | 0.01 | Sep 7, 2017 | Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27). | ||
| CVE-2015-5060 | Med | 0.40 | 6.1 | 0.01 | Sep 7, 2017 | Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev. | ||
| CVE-2015-5052 | Cri | 0.64 | 9.8 | 0.01 | Sep 7, 2017 | SQL injection vulnerability in Sefrengo before 1.6.5 beta2. | ||
| CVE-2015-4724 | Hig | 0.57 | 8.8 | 0.01 | Sep 7, 2017 | SQL injection vulnerability in Concrete5 5.7.3.1. | ||
| CVE-2015-4721 | Med | 0.40 | 6.1 | 0.01 | Sep 7, 2017 | Multiple cross-site scripting (XSS) vulnerabilities in Concrete5 5.7.3.1. | ||
| CVE-2015-4697 | Hig | 0.50 | 8.8 | 0.01 | Sep 7, 2017 | Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563. | ||
| CVE-2015-4629 | Cri | 0.64 | 9.8 | 0.02 | Sep 7, 2017 | Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication, and perform other unspecified actions. | ||
| CVE-2015-4627 | Cri | 0.64 | 9.8 | 0.01 | Sep 7, 2017 | SQL injection vulnerability in Pragyan CMS 3.0. | ||
| CVE-2015-4619 | Hig | 0.50 | 8.8 | 0.01 | Sep 7, 2017 | Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75. | ||
| CVE-2015-4085 | Hig | 0.42 | 7.5 | 0.02 | Sep 7, 2017 | Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1. | ||
| CVE-2015-3991 | Cri | 0.57 | 9.8 | 0.05 | Sep 7, 2017 | strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code. | ||
| CVE-2015-3314 | Hig | 0.56 | 8.1 | 0.05 | Sep 7, 2017 | SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5. | ||
| CVE-2015-3313 | Cri | 0.67 | 9.8 | 0.08 | Sep 7, 2017 | SQL injection vulnerability in WordPress Community Events plugin before 1.4. | ||
| CVE-2015-3222 | Hig | 0.42 | 7.0 | 0.02 | Sep 7, 2017 | syscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute arbitrary code as root. |
- risk 0.51cvss 7.8epss 0.01
A remote code execution vulnerability in the Android libraries (libgdx). Product: Android. Versions: 7.1.1, 7.1.2, 8.0. Android ID: A-62218744.
- risk 0.51cvss 7.8epss 0.00
A elevation of privilege vulnerability in the Android framework (windowmanager). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-62196835.
- risk 0.46cvss 7.0epss 0.00
The driver_override implementation in drivers/base/platform.c in the Linux kernel before 4.12.1 allows local users to gain privileges by leveraging a race condition between a read operation and a store operation that involve different overrides.
- risk 0.57cvss 8.8epss 0.01
Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write.
- risk 0.51cvss 7.8epss 0.00
The mkdumprd script called "dracut" in the current working directory "." allows local users to trick the administrator into executing code as root.
- risk 0.44cvss 7.8epss 0.00
The YaST2 network created files with world readable permissions which could have allowed local users to read sensitive material out of network configuration files, like passwords for wireless networks.
- risk 0.49cvss 7.5epss 0.01
Vulnerability in Easy Joomla Backup v3.2.4. The software creates a copy of the backup in the web root with an easily guessable filename.
- risk 0.42cvss 6.5epss 0.01
Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter.
- risk 0.42cvss 6.5epss 0.02
Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary files via unspecified vectors.
- risk 0.64cvss 9.8epss 0.01
Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.
- risk 0.39cvss 5.5epss 0.04
XXE in Diving Log 6.0 allows attackers to remotely view local files through a crafted dive.xml file that is mishandled during a Subsurface import.
- risk 0.35cvss 5.4epss 0.01
Wolf CMS 0.8.3.1 allows Cross-Site Scripting (XSS) attacks. The vulnerability exists due to insufficient sanitization of the file name in a "create-file-popup" action, and the directory name in a "create-directory-popup" action, in the HTTP POST method to the…
- risk 0.43cvss 6.1epss 0.01
XSS (persistent) on the Intelbras Wireless N 150Mbps router with firmware WRN 240 allows attackers to steal wireless credentials without being connected to the network, related to userRpm/popupSiteSurveyRpm.htm and userRpm/WlanSecurityRpm.htm. The attack vector is a crafted…
- risk 0.44cvss 6.7epss 0.00
A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an authenticated, local attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. The…
- risk 0.29cvss 4.4epss 0.00
A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an authenticated, local attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is…
- risk 0.44cvss 6.7epss 0.01
A vulnerability in the CLI command-parsing code of Cisco Meeting Server could allow an authenticated, local attacker to perform command injection and escalate their privileges to root. The attacker must first authenticate to the application with valid administrator credentials.…
- risk 0.42cvss 6.5epss 0.01
A vulnerability in the Inventory Management feature of Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to view sensitive information on the system. The vulnerability is due to insufficient protection of restricted information. An…
- risk 0.42cvss 6.5epss 0.02
A vulnerability in the batch provisioning feature in Cisco Prime Collaboration Provisioning Tool could allow an authenticated, remote attacker to overwrite system files as root. The vulnerability is due to lack of input validation of the parameters in BatchFileName and…
- risk 0.49cvss 7.5epss 0.02
A vulnerability in the Trust Verification Service (TVS) of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of Transport Layer…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model (DOM)-based, environment or client-side cross-site scripting (XSS) attack. The…
- risk 0.49cvss 7.5epss 0.02
A vulnerability in the TCP throttling process for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to cause the system to consume additional memory, eventually forcing the device to restart, aka Memory Exhaustion. The vulnerability is…
- risk 0.49cvss 7.5epss 0.02
A vulnerability in the HTTP remote procedure call (RPC) service of set-top box (STB) receivers manufactured by Cisco for Yes could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists because the…
- risk 0.61cvss 7.5epss 0.06
A vulnerability in the UDP processing code of Cisco IOS 15.1, 15.2, and 15.4 and IOS XE 3.14 through 3.18 could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and a denial of service…
- risk 0.35cvss 5.4epss 0.01
A vulnerability in the SQL database interface for Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL queries that bypass protection…
- risk 0.42cvss 6.5epss 0.02
A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication…
- risk 0.42cvss 6.5epss 0.02
A vulnerability in the ability for guest users to join meetings via a hyperlink with Cisco Meeting Server could allow an authenticated, remote attacker to enter a meeting with a hyperlink URL, even though access should be denied. The vulnerability is due to the incorrect…
- risk 0.42cvss 6.4epss 0.00
A vulnerability in the ROM Monitor (ROMMON) code of Cisco IR800 Integrated Services Router Software could allow an unauthenticated, local attacker to boot an unsigned Hypervisor on an affected device and compromise the integrity of the system. The vulnerability is due to…
- risk 0.35cvss 5.4epss 0.01
A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected software. The vulnerability is due to insufficient…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The…
- risk 0.38cvss 5.8epss 0.02
A vulnerability in the malware detection functionality within Advanced Malware Protection (AMP) of Cisco AsyncOS Software for Cisco Email Security Appliances (ESAs) could allow an unauthenticated, remote attacker to cause an email attachment containing malware to be delivered to…
- risk 0.35cvss 5.3epss 0.02
A vulnerability in the General Packet Radio Service (GPRS) Tunneling Protocol ingress packet handler of Cisco ASR 5500 System Architecture Evolution (SAE) Gateways could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition on an affected…
- risk 0.57cvss 8.8epss 0.03
A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries…
- risk 0.28cvss 4.3epss 0.01
A vulnerability in the dynamic access control list (ACL) feature of Cisco IOS XE Software running on Cisco Catalyst 4000 Series Switches could allow an unauthenticated, adjacent attacker to cause dynamic ACL assignment to fail and the port to fail open. This could allow the…
- risk 0.40cvss 6.1epss 0.01
A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input…
- risk 0.35cvss 5.3epss 0.02
A vulnerability in the IPv6 Simple Network Management Protocol (SNMP) code of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to cause high CPU usage or a reload of the device. The vulnerability is due to IPv6 sub block corruption. An attacker…
- risk 0.35cvss 5.3epss 0.01
qt5-qtwebkit before 5.4 records private browsing URLs to its favicon database, WebpageIcons.db.
- risk 0.28cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27).
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev.
- risk 0.64cvss 9.8epss 0.01
SQL injection vulnerability in Sefrengo before 1.6.5 beta2.
- risk 0.57cvss 8.8epss 0.01
SQL injection vulnerability in Concrete5 5.7.3.1.
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Concrete5 5.7.3.1.
- risk 0.50cvss 8.8epss 0.01
Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563.
- risk 0.64cvss 9.8epss 0.02
Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication, and perform other unspecified actions.
- risk 0.64cvss 9.8epss 0.01
SQL injection vulnerability in Pragyan CMS 3.0.
- risk 0.50cvss 8.8epss 0.01
Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.
- risk 0.42cvss 7.5epss 0.02
Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
- risk 0.57cvss 9.8epss 0.05
strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.
- risk 0.56cvss 8.1epss 0.05
SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.
- risk 0.67cvss 9.8epss 0.08
SQL injection vulnerability in WordPress Community Events plugin before 1.4.
- risk 0.42cvss 7.0epss 0.02
syscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute arbitrary code as root.