| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-9732 | Med | 0.35 | 5.4 | 0.01 | Aug 29, 2017 | IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a… | ||
| CVE-2016-2970 | Med | 0.28 | 4.3 | 0.01 | Aug 29, 2017 | IBM Sametime 8.5 and 9.0 meetings server may provide detailed information in an error message that may provide details about the application to possible attackers. IBM X-Force ID: 113851. | ||
| CVE-2015-0234 | Hig | 0.49 | 7.5 | 0.01 | Aug 29, 2017 | Multiple temporary file creation vulnerabilities in pki-core 10.2.0. | ||
| CVE-2014-8872 | Hig | 0.51 | 7.8 | 0.01 | Aug 29, 2017 | Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and other models with firmware 5.50. | ||
| CVE-2014-8393 | Hig | 0.54 | 7.8 | 0.08 | Aug 29, 2017 | DLL Hijacking vulnerability in CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015, and Corel PDF Fusion. | ||
| CVE-2017-13716 | Med | 0.36 | 5.5 | 0.01 | Aug 28, 2017 | The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File… | ||
| CVE-2015-8332 | Hig | 0.57 | 8.8 | 0.01 | Aug 28, 2017 | Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote authenticated users to gain privileges and perform a case operation as another user via a crafted message, aka "Horizontal… | ||
| CVE-2015-8300 | Hig | 0.51 | 7.8 | 0.01 | Aug 28, 2017 | Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\polycom\polycom btoe connector\plcmbtoesrv.exe," which allows local users to gain privileges via a Trojan horse file. | ||
| CVE-2017-9979 | Med | 0.43 | 6.1 | 0.03 | Aug 28, 2017 | On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by… | ||
| CVE-2017-9978 | Med | 0.38 | 5.3 | 0.05 | Aug 28, 2017 | On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, a flaw was found with the error message sent as a response for users that don't exist on the system. An attacker could leverage this information to fine-tune and enumerate valid accounts on the system by searching for… | ||
| CVE-2017-6594 | Hig | 0.49 | 7.5 | 0.02 | Aug 28, 2017 | The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging failure to add the previous hop realm to the transit path of issued tickets. | ||
| CVE-2017-3735 | Med | 0.36 | 5.3 | 0.21 | Aug 28, 2017 | While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and… | ||
| CVE-2017-13712 | Hig | 0.49 | 7.5 | 0.02 | Aug 28, 2017 | NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggering a NULL first argument. | ||
| CVE-2017-12954 | Med | 0.46 | 6.5 | 0.04 | Aug 28, 2017 | The gig::Region::GetSampleFromWavePool function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted gig file. | ||
| CVE-2017-12953 | Med | 0.46 | 6.5 | 0.04 | Aug 28, 2017 | The gig::Instrument::UpdateRegionKeyTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid memory write and application crash) via a crafted gig file. | ||
| CVE-2017-12952 | Med | 0.46 | 6.5 | 0.04 | Aug 28, 2017 | The LoadString function in helper.h in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted gig file. | ||
| CVE-2017-12951 | Med | 0.45 | 6.5 | 0.03 | Aug 28, 2017 | The gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted gig file. | ||
| CVE-2017-12950 | Med | 0.46 | 6.5 | 0.05 | Aug 28, 2017 | The gig::Region::Region function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted gig file. | ||
| CVE-2017-12925 | Med | 0.42 | 6.5 | 0.01 | Aug 28, 2017 | Double free vulnerability in DfFromLB in docfile.cxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service via a crafted fpx image. | ||
| CVE-2017-12924 | Med | 0.42 | 6.5 | 0.01 | Aug 28, 2017 | CDirVector::GetTable in dirfunc.hxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted fpx image. | ||
| CVE-2017-12923 | Med | 0.42 | 6.5 | 0.01 | Aug 28, 2017 | OLEStream::WriteVT_LPSTR in olestrm.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image. | ||
| CVE-2017-12922 | Med | 0.42 | 6.5 | 0.01 | Aug 28, 2017 | wchar.c in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image. | ||
| CVE-2017-12921 | Med | 0.42 | 6.5 | 0.01 | Aug 28, 2017 | PFileFlashPixView::GetGlobalInfoProperty in f_fpxvw.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image. | ||
| CVE-2017-12920 | Med | 0.42 | 6.5 | 0.01 | Aug 28, 2017 | CDirectory::GetDirEntry in dir.cxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image. | ||
| CVE-2017-12919 | Med | 0.42 | 6.5 | 0.01 | Aug 28, 2017 | Heap-based buffer overflow in OLEStream::WriteVT_LPSTR in olestrm.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service via a crafted fpx image. | ||
| CVE-2017-12877 | Med | 0.42 | 6.5 | 0.02 | Aug 28, 2017 | Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file. | ||
| CVE-2017-12876 | Med | 0.42 | 6.5 | 0.03 | Aug 28, 2017 | Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file. | ||
| CVE-2017-12840 | Hig | 0.51 | 7.8 | 0.00 | Aug 28, 2017 | A kernel driver, namely DLMFENC.sys, bundled with the DESLock+ client application 4.8.16 and earlier contains a locally exploitable heap based buffer overflow in the handling of an IOCTL message of type 0x0FA4204. The vulnerability is present due to the kernel driver failing to… | ||
| CVE-2017-12077 | Med | 0.32 | 4.9 | 0.01 | Aug 28, 2017 | Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology Router Manager (SRM) before 1.1.4-6509 allows remote authenticated attacker to exhaust the memory resources of the machine, causing a denial of service attack. | ||
| CVE-2017-12076 | Med | 0.32 | 4.9 | 0.01 | Aug 28, 2017 | Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM) before 6.1.1-15088 allows remote authenticated attacker to exhaust the memory resources of the machine, causing a denial of service attack. | ||
| CVE-2015-1600 | Hig | 0.49 | 7.5 | 0.03 | Aug 28, 2017 | Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier. | ||
| CVE-2015-1554 | Hig | 0.49 | 7.5 | 0.02 | Aug 28, 2017 | kgb-bot 1.33-2 allows remote attackers to cause a denial of service (crash). | ||
| CVE-2015-0233 | Med | 0.27 | 4.2 | 0.00 | Aug 28, 2017 | Multiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38. | ||
| CVE-2014-8163 | Med | 0.42 | 6.5 | 0.02 | Aug 28, 2017 | Directory traversal vulnerability in the XMLRPC interface in Red Hat Satellite 5. | ||
| CVE-2013-7430 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2017 | Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the xmlns parameter. | ||
| CVE-2017-8380 | Cri | 0.64 | 9.8 | 0.04 | Aug 28, 2017 | Buffer overflow in the "megasas_mmio_write" function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors. | ||
| CVE-2016-7030 | Hig | 0.49 | 7.5 | 0.05 | Aug 28, 2017 | FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of service by locking out the account in which system services run on. | ||
| CVE-2016-0634 | Hig | 0.49 | 7.5 | 0.06 | Aug 28, 2017 | The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine. | ||
| CVE-2015-3976 | Med | 0.35 | 5.4 | 0.01 | Aug 28, 2017 | Cross-site scripting (XSS) vulnerability in GE Multilink ML810/3000/3100 series switch 5.2.0 and earlier, and GE Multilink ML800/1200/1600/2400 4.2.1 and earlier. | ||
| CVE-2015-2046 | Med | 0.40 | 6.1 | 0.02 | Aug 28, 2017 | Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20. | ||
| CVE-2015-1876 | Hig | 0.49 | 7.5 | 0.03 | Aug 28, 2017 | Directory traversal vulnerability in ES File Explorer 3.2.4.1. | ||
| CVE-2015-1445 | — | Hig | 0.47 | 7.2 | 0.02 | Aug 28, 2017 | HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30. | |
| CVE-2015-1443 | — | Hig | 0.57 | 8.8 | 0.03 | Aug 28, 2017 | The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code. | |
| CVE-2015-1430 | Cri | 0.64 | 9.8 | 0.01 | Aug 28, 2017 | Buffer overflow in xymon 4.3.17-1. | ||
| CVE-2015-1401 | Cri | 0.64 | 9.8 | 0.03 | Aug 28, 2017 | Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3. | ||
| CVE-2015-1386 | Hig | 0.49 | 7.5 | 0.03 | Aug 28, 2017 | Directory traversal vulnerability in unshield 1.0-1. | ||
| CVE-2015-1199 | Hig | 0.49 | 7.5 | 0.02 | Aug 28, 2017 | Directory traversal vulnerability in ppmd 10.1-5. | ||
| CVE-2015-1198 | Hig | 0.49 | 7.5 | 0.03 | Aug 28, 2017 | Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5. | ||
| CVE-2015-1177 | Med | 0.40 | 6.1 | 0.01 | Aug 28, 2017 | Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2. | ||
| CVE-2015-0974 | Hig | 0.51 | 7.8 | 0.01 | Aug 28, 2017 | Untrusted search path vulnerability in ZTE Datacard MF19 0V1.0.0B04 allows local users to gain privilege by modifying the 'Ucell Internet' directory to reference a malicious mms_dll_r.dll or mediaplayerdll.dll. |
- risk 0.35cvss 5.4epss 0.01
IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
- risk 0.28cvss 4.3epss 0.01
IBM Sametime 8.5 and 9.0 meetings server may provide detailed information in an error message that may provide details about the application to possible attackers. IBM X-Force ID: 113851.
- risk 0.49cvss 7.5epss 0.01
Multiple temporary file creation vulnerabilities in pki-core 10.2.0.
- risk 0.51cvss 7.8epss 0.01
Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and other models with firmware 5.50.
- risk 0.54cvss 7.8epss 0.08
DLL Hijacking vulnerability in CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015, and Corel PDF Fusion.
- risk 0.36cvss 5.5epss 0.01
The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File…
- risk 0.57cvss 8.8epss 0.01
Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote authenticated users to gain privileges and perform a case operation as another user via a crafted message, aka "Horizontal…
- risk 0.51cvss 7.8epss 0.01
Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\polycom\polycom btoe connector\plcmbtoesrv.exe," which allows local users to gain privileges via a Trojan horse file.
- risk 0.43cvss 6.1epss 0.03
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by…
- risk 0.38cvss 5.3epss 0.05
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, a flaw was found with the error message sent as a response for users that don't exist on the system. An attacker could leverage this information to fine-tune and enumerate valid accounts on the system by searching for…
- risk 0.49cvss 7.5epss 0.02
The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging failure to add the previous hop realm to the transit path of issued tickets.
- risk 0.36cvss 5.3epss 0.21
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and…
- risk 0.49cvss 7.5epss 0.02
NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggering a NULL first argument.
- risk 0.46cvss 6.5epss 0.04
The gig::Region::GetSampleFromWavePool function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted gig file.
- risk 0.46cvss 6.5epss 0.04
The gig::Instrument::UpdateRegionKeyTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid memory write and application crash) via a crafted gig file.
- risk 0.46cvss 6.5epss 0.04
The LoadString function in helper.h in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted gig file.
- risk 0.45cvss 6.5epss 0.03
The gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted gig file.
- risk 0.46cvss 6.5epss 0.05
The gig::Region::Region function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted gig file.
- risk 0.42cvss 6.5epss 0.01
Double free vulnerability in DfFromLB in docfile.cxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service via a crafted fpx image.
- risk 0.42cvss 6.5epss 0.01
CDirVector::GetTable in dirfunc.hxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted fpx image.
- risk 0.42cvss 6.5epss 0.01
OLEStream::WriteVT_LPSTR in olestrm.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image.
- risk 0.42cvss 6.5epss 0.01
wchar.c in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image.
- risk 0.42cvss 6.5epss 0.01
PFileFlashPixView::GetGlobalInfoProperty in f_fpxvw.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image.
- risk 0.42cvss 6.5epss 0.01
CDirectory::GetDirEntry in dir.cxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image.
- risk 0.42cvss 6.5epss 0.01
Heap-based buffer overflow in OLEStream::WriteVT_LPSTR in olestrm.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service via a crafted fpx image.
- risk 0.42cvss 6.5epss 0.02
Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.
- risk 0.42cvss 6.5epss 0.03
Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.
- risk 0.51cvss 7.8epss 0.00
A kernel driver, namely DLMFENC.sys, bundled with the DESLock+ client application 4.8.16 and earlier contains a locally exploitable heap based buffer overflow in the handling of an IOCTL message of type 0x0FA4204. The vulnerability is present due to the kernel driver failing to…
- risk 0.32cvss 4.9epss 0.01
Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology Router Manager (SRM) before 1.1.4-6509 allows remote authenticated attacker to exhaust the memory resources of the machine, causing a denial of service attack.
- risk 0.32cvss 4.9epss 0.01
Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM) before 6.1.1-15088 allows remote authenticated attacker to exhaust the memory resources of the machine, causing a denial of service attack.
- risk 0.49cvss 7.5epss 0.03
Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier.
- risk 0.49cvss 7.5epss 0.02
kgb-bot 1.33-2 allows remote attackers to cause a denial of service (crash).
- risk 0.27cvss 4.2epss 0.00
Multiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38.
- risk 0.42cvss 6.5epss 0.02
Directory traversal vulnerability in the XMLRPC interface in Red Hat Satellite 5.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the xmlns parameter.
- risk 0.64cvss 9.8epss 0.04
Buffer overflow in the "megasas_mmio_write" function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors.
- risk 0.49cvss 7.5epss 0.05
FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of service by locking out the account in which system services run on.
- risk 0.49cvss 7.5epss 0.06
The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in GE Multilink ML810/3000/3100 series switch 5.2.0 and earlier, and GE Multilink ML800/1200/1600/2400 4.2.1 and earlier.
- risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20.
- risk 0.49cvss 7.5epss 0.03
Directory traversal vulnerability in ES File Explorer 3.2.4.1.
- risk 0.47cvss 7.2epss 0.02
HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30.
- risk 0.57cvss 8.8epss 0.03
The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code.
- risk 0.64cvss 9.8epss 0.01
Buffer overflow in xymon 4.3.17-1.
- risk 0.64cvss 9.8epss 0.03
Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3.
- risk 0.49cvss 7.5epss 0.03
Directory traversal vulnerability in unshield 1.0-1.
- risk 0.49cvss 7.5epss 0.02
Directory traversal vulnerability in ppmd 10.1-5.
- risk 0.49cvss 7.5epss 0.03
Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5.
- risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2.
- risk 0.51cvss 7.8epss 0.01
Untrusted search path vulnerability in ZTE Datacard MF19 0V1.0.0B04 allows local users to gain privilege by modifying the 'Ucell Internet' directory to reference a malicious mms_dll_r.dll or mediaplayerdll.dll.