| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-3077 | Med | 0.42 | 6.5 | 0.01 | Jun 6, 2017 | The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service (process crash) for all VMs. | ||
| CVE-2016-3066 | Med | 0.42 | 6.5 | 0.01 | Jun 6, 2017 | The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard. | ||
| CVE-2016-2192 | Med | 0.42 | 6.5 | 0.01 | Jun 6, 2017 | PostgreSQL PL/Java before 1.5.0 allows remote authenticated users to alter type mappings for types they do not own. | ||
| CVE-2016-0768 | Hig | 0.49 | 7.5 | 0.01 | Jun 6, 2017 | PostgreSQL PL/Java after 9.0 does not honor access controls on large objects. | ||
| CVE-2016-0767 | Med | 0.42 | 6.5 | 0.01 | Jun 6, 2017 | PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath. | ||
| CVE-2016-0726 | Cri | 0.64 | 9.8 | 0.02 | Jun 6, 2017 | The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials. | ||
| CVE-2015-3830 | Med | 0.42 | 6.5 | 0.01 | Jun 6, 2017 | The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to trick a victim by displaying a malicious page for legitimate domain names. | ||
| CVE-2015-1207 | Med | 0.42 | 6.5 | 0.01 | Jun 6, 2017 | Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted .m4a file. | ||
| CVE-2014-8180 | Med | 0.36 | 5.5 | 0.00 | Jun 6, 2017 | MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial of Service. | ||
| CVE-2017-9452 | Med | 0.31 | 4.8 | 0.01 | Jun 6, 2017 | Cross-site scripting (XSS) vulnerability in admin.php in Piwigo 2.9.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter. | ||
| CVE-2017-9451 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2017 | Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in an acp.php URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs. | ||
| CVE-2017-8920 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2017 | irc.cgi in CGI:IRC before 0.5.12 reflects user-supplied input from the R parameter without proper output encoding, aka XSS. | ||
| CVE-2017-5243 | Hig | 0.55 | 8.5 | 0.01 | Jun 6, 2017 | The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and… | ||
| CVE-2017-9449 | Hig | 0.57 | 8.8 | 0.01 | Jun 6, 2017 | SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker creates a crafted table name at admin/developer/modules/views/create/ and the… | ||
| CVE-2017-9448 | Med | 0.35 | 5.4 | 0.01 | Jun 6, 2017 | Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the description parameter. This issue exists in core\admin\ajax\pages\save-revision.php and core\admin\modules\pages\revisions.php.… | ||
| CVE-2017-9332 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2017 | The smarty_self function in modules/module_smarty.php in PivotX 2.3.11 mishandles the URI, allowing XSS via vectors involving quotes in the self Smarty tag. | ||
| CVE-2017-8083 | Med | 0.44 | 6.7 | 0.00 | Jun 6, 2017 | CompuLab Intense PC and MintBox 2 devices with BIOS before 2017-05-21 do not use the CloseMnf protection mechanism for write protection of flash memory regions, which allows local users to install a firmware rootkit by leveraging administrative privileges. | ||
| CVE-2017-7515 | Med | 0.36 | 5.5 | 0.01 | Jun 6, 2017 | poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-of-service. | ||
| CVE-2017-5664 | Hig | 0.43 | 7.5 | 0.17 | Jun 6, 2017 | The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error… | ||
| CVE-2016-10297 | Hig | 0.46 | 7.0 | 0.00 | Jun 6, 2017 | In TrustZone in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerability could potentially exist. | ||
| CVE-2015-9007 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In TrustZone in all Android releases from CAF using the Linux kernel, a Double Free vulnerability could potentially exist. | ||
| CVE-2015-9006 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could potentially exist. | ||
| CVE-2015-9005 | Hig | 0.51 | 7.8 | 0.01 | Jun 6, 2017 | In TrustZone in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could potentially exist. | ||
| CVE-2014-9952 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In the Secure File System in all Android releases from CAF using the Linux kernel, a capture-replay vulnerability could potentially exist. | ||
| CVE-2014-9951 | Med | 0.36 | 5.5 | 0.00 | Jun 6, 2017 | In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure Through Timing Discrepancy vulnerability could potentially exist. | ||
| CVE-2014-9950 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In Core Kernel in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist. | ||
| CVE-2014-9949 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In TrustZone in all Android releases from CAF using the Linux kernel, an Untrusted Pointer Dereference vulnerability could potentially exist. | ||
| CVE-2014-9948 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In TrustZone in all Android releases from CAF using the Linux kernel, an Improper Validation of Array Index vulnerability could potentially exist. | ||
| CVE-2014-9947 | Med | 0.36 | 5.5 | 0.00 | Jun 6, 2017 | In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure vulnerability could potentially exist. | ||
| CVE-2014-9946 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In Core Kernel in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist. | ||
| CVE-2014-9945 | Hig | 0.51 | 7.8 | 0.01 | Jun 6, 2017 | In TrustZone in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist. | ||
| CVE-2014-9944 | Hig | 0.51 | 7.8 | 0.01 | Jun 6, 2017 | In the Secure File System in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could potentially exist. | ||
| CVE-2014-9943 | Hig | 0.51 | 7.8 | 0.01 | Jun 6, 2017 | In Core Kernel in all Android releases from CAF using the Linux kernel, a Null Pointer Dereference vulnerability could potentially exist. | ||
| CVE-2014-9942 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In Boot in all Android releases from CAF using the Linux kernel, a Use of Uninitialized Variable vulnerability could potentially exist. | ||
| CVE-2014-9941 | Hig | 0.46 | 7.0 | 0.00 | Jun 6, 2017 | In the Embedded File System in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerability could potentially exist. | ||
| CVE-2014-9930 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In WCDMA in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist. | ||
| CVE-2014-9929 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In WCDMA in all Android releases from CAF using the Linux kernel, a Use of Out-of-range Pointer Offset vulnerability could potentially exist. | ||
| CVE-2014-9928 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In GERAN in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist. | ||
| CVE-2014-9927 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In UIM in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist. | ||
| CVE-2014-9926 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In GNSS in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist. | ||
| CVE-2014-9925 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In HDR in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist. | ||
| CVE-2014-9924 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In 1x in all Android releases from CAF using the Linux kernel, a Signed to Unsigned Conversion Error could potentially occur. | ||
| CVE-2014-9923 | Hig | 0.51 | 7.8 | 0.00 | Jun 6, 2017 | In NAS in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist. | ||
| CVE-2017-9444 | Hig | 0.57 | 8.8 | 0.00 | Jun 5, 2017 | BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI (remove packages), the index.php/admin/developer/upgrade/ignore/?versions= URI, and the… | ||
| CVE-2017-9443 | Hig | 0.57 | 8.8 | 0.01 | Jun 5, 2017 | BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and… | ||
| CVE-2017-9442 | Hig | 0.57 | 8.8 | 0.02 | Jun 5, 2017 | BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php. This issue exists in… | ||
| CVE-2017-9441 | Low | 0.18 | 2.7 | 0.01 | Jun 5, 2017 | Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted package, triggering mishandling of the (1) title or (2) version or (3) author_name parameter in… | ||
| CVE-2017-9420 | Med | 0.40 | 6.1 | 0.01 | Jun 5, 2017 | Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter. | ||
| CVE-2017-9440 | Med | 0.42 | 6.5 | 0.02 | Jun 5, 2017 | In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPSDChannel in coders/psd.c, which allows attackers to cause a denial of service via a crafted file. | ||
| CVE-2017-9439 | Med | 0.42 | 6.5 | 0.02 | Jun 5, 2017 | In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of service via a crafted file. |
- risk 0.42cvss 6.5epss 0.01
The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service (process crash) for all VMs.
- risk 0.42cvss 6.5epss 0.01
The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard.
- risk 0.42cvss 6.5epss 0.01
PostgreSQL PL/Java before 1.5.0 allows remote authenticated users to alter type mappings for types they do not own.
- risk 0.49cvss 7.5epss 0.01
PostgreSQL PL/Java after 9.0 does not honor access controls on large objects.
- risk 0.42cvss 6.5epss 0.01
PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath.
- risk 0.64cvss 9.8epss 0.02
The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials.
- risk 0.42cvss 6.5epss 0.01
The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to trick a victim by displaying a malicious page for legitimate domain names.
- risk 0.42cvss 6.5epss 0.01
Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted .m4a file.
- risk 0.36cvss 5.5epss 0.00
MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial of Service.
- risk 0.31cvss 4.8epss 0.01
Cross-site scripting (XSS) vulnerability in admin.php in Piwigo 2.9.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter.
- risk 0.40cvss 6.1epss 0.01
Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in an acp.php URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
- risk 0.40cvss 6.1epss 0.01
irc.cgi in CGI:IRC before 0.5.12 reflects user-supplied input from the R parameter without proper output encoding, aka XSS.
- risk 0.55cvss 8.5epss 0.01
The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and…
- risk 0.57cvss 8.8epss 0.01
SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker creates a crafted table name at admin/developer/modules/views/create/ and the…
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the description parameter. This issue exists in core\admin\ajax\pages\save-revision.php and core\admin\modules\pages\revisions.php.…
- risk 0.40cvss 6.1epss 0.01
The smarty_self function in modules/module_smarty.php in PivotX 2.3.11 mishandles the URI, allowing XSS via vectors involving quotes in the self Smarty tag.
- risk 0.44cvss 6.7epss 0.00
CompuLab Intense PC and MintBox 2 devices with BIOS before 2017-05-21 do not use the CloseMnf protection mechanism for write protection of flash memory regions, which allows local users to install a firmware rootkit by leveraging administrative privileges.
- risk 0.36cvss 5.5epss 0.01
poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-of-service.
- risk 0.43cvss 7.5epss 0.17
The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error…
- risk 0.46cvss 7.0epss 0.00
In TrustZone in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.00
In TrustZone in all Android releases from CAF using the Linux kernel, a Double Free vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.00
In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.01
In TrustZone in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.00
In the Secure File System in all Android releases from CAF using the Linux kernel, a capture-replay vulnerability could potentially exist.
- risk 0.36cvss 5.5epss 0.00
In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure Through Timing Discrepancy vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.00
In Core Kernel in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.00
In TrustZone in all Android releases from CAF using the Linux kernel, an Untrusted Pointer Dereference vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.00
In TrustZone in all Android releases from CAF using the Linux kernel, an Improper Validation of Array Index vulnerability could potentially exist.
- risk 0.36cvss 5.5epss 0.00
In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.00
In Core Kernel in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.01
In TrustZone in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.01
In the Secure File System in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.01
In Core Kernel in all Android releases from CAF using the Linux kernel, a Null Pointer Dereference vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.00
In Boot in all Android releases from CAF using the Linux kernel, a Use of Uninitialized Variable vulnerability could potentially exist.
- risk 0.46cvss 7.0epss 0.00
In the Embedded File System in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.00
In WCDMA in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.00
In WCDMA in all Android releases from CAF using the Linux kernel, a Use of Out-of-range Pointer Offset vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.00
In GERAN in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.00
In UIM in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.00
In GNSS in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.00
In HDR in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.
- risk 0.51cvss 7.8epss 0.00
In 1x in all Android releases from CAF using the Linux kernel, a Signed to Unsigned Conversion Error could potentially occur.
- risk 0.51cvss 7.8epss 0.00
In NAS in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.
- risk 0.57cvss 8.8epss 0.00
BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI (remove packages), the index.php/admin/developer/upgrade/ignore/?versions= URI, and the…
- risk 0.57cvss 8.8epss 0.01
BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and…
- risk 0.57cvss 8.8epss 0.02
BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php. This issue exists in…
- risk 0.18cvss 2.7epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted package, triggering mishandling of the (1) title or (2) version or (3) author_name parameter in…
- risk 0.40cvss 6.1epss 0.01
Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter.
- risk 0.42cvss 6.5epss 0.02
In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPSDChannel in coders/psd.c, which allows attackers to cause a denial of service via a crafted file.
- risk 0.42cvss 6.5epss 0.02
In ImageMagick 7.0.5-5, a memory leak was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of service via a crafted file.