|
|
|||||||
| Home | Forums | Gallery | Register | Video Directory | FAQ | Members List | Calendar | Games | Today's Posts | Search | Chat Room |
  |
|
|
Thread Tools | Display Modes |
|
#1
06-14-2017, 08:39 AM
|
||||
|
||||
SB17-163: Vulnerability Summary for the Week of June 5, 2017
SB17-163: Vulnerability Summary for the Week of June 5, 2017
06-12-2017 05:46 AM Original release date: June 12, 2017 The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information. The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:
* High Vulnerabilities Primary Vendor -- ProductDescriptionPublishedCVSS ScoreSource & Patch Infoapache -- hadoopIn Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.2017-06-048.5CVE-2017-7669 BID MLISTbigtreecms -- bigtree_cmsUnrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code.2017-06-027.5CVE-2017-9364 CONFIRM CONFIRMdolibarr -- dolibarrDolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search_supervisor and search_statut parameters).2017-06-057.5CVE-2017-9435 CONFIRM CONFIRMgoogle -- androidIn NAS in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.2017-06-069.3CVE-2014-9923 BID CONFIRMgoogle -- androidIn 1x in all Android releases from CAF using the Linux kernel, a Signed to Unsigned Conversion Error could potentially occur.2017-06-069.3CVE-2014-9924 BID CONFIRMgoogle -- androidIn HDR in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.2017-06-069.3CVE-2014-9925 BID CONFIRMgoogle -- androidIn GNSS in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist.2017-06-069.3CVE-2014-9926 BID CONFIRMgoogle -- androidIn UIM in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.2017-06-069.3CVE-2014-9927 CONFIRMgoogle -- androidIn GERAN in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist.2017-06-069.3CVE-2014-9928 BID CONFIRMgoogle -- androidIn WCDMA in all Android releases from CAF using the Linux kernel, a Use of Out-of-range Pointer Offset vulnerability could potentially exist.2017-06-069.3CVE-2014-9929 BID CONFIRMgoogle -- androidIn WCDMA in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist.2017-06-069.3CVE-2014-9930 BID CONFIRMgoogle -- androidIn the Embedded File System in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerability could potentially exist.2017-06-067.6CVE-2014-9941 BID CONFIRMgoogle -- androidIn Boot in all Android releases from CAF using the Linux kernel, a Use of Uninitialized Variable vulnerability could potentially exist.2017-06-069.3CVE-2014-9942 BID CONFIRMgoogle -- androidIn Core Kernel in all Android releases from CAF using the Linux kernel, a Null Pointer Dereference vulnerability could potentially exist.2017-06-069.3CVE-2014-9943 BID CONFIRMgoogle -- androidIn the Secure File System in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could potentially exist.2017-06-069.3CVE-2014-9944 BID CONFIRMgoogle -- androidIn TrustZone in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist.2017-06-069.3CVE-2014-9945 BID CONFIRMgoogle -- androidIn Core Kernel in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist.2017-06-069.3CVE-2014-9946 BID CONFIRMgoogle -- androidIn TrustZone in all Android releases from CAF using the Linux kernel, an Improper Validation of Array Index vulnerability could potentially exist.2017-06-069.3CVE-2014-9948 BID CONFIRMgoogle -- androidIn TrustZone in all Android releases from CAF using the Linux kernel, an Untrusted Pointer Dereference vulnerability could potentially exist.2017-06-069.3CVE-2014-9949 BID CONFIRMgoogle -- androidIn Core Kernel in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist.2017-06-069.3CVE-2014-9950 BID CONFIRMgoogle -- androidIn the Secure File System in all Android releases from CAF using the Linux kernel, a capture-replay vulnerability could potentially exist.2017-06-069.3CVE-2014-9952 BID CONFIRMgoogle -- androidIn TrustZone in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could potentially exist.2017-06-069.3CVE-2015-9005 BID CONFIRMgoogle -- androidIn Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could potentially exist.2017-06-069.3CVE-2015-9006 BID CONFIRMgoogle -- androidIn TrustZone in all Android releases from CAF using the Linux kernel, a Double Free vulnerability could potentially exist.2017-06-069.3CVE-2015-9007 BID CONFIRMgoogle -- androidIn TrustZone in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerability could potentially exist.2017-06-069.3CVE-2016-10297 BID CONFIRMlenovo -- lenovo_service_bridgeIn Lenovo Service Bridge before version 4, a user with local privileges on a system could execute code with administrative privileges.2017-06-047.2CVE-2016-8228 CONFIRMmercurial -- mercurialIn Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.2017-06-069.0CVE-2017-9462 CONFIRM CONFIRM CONFIRMsoffid -- iamUntrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to achieve arbitrary remote code execution via a crafted authentication request.2017-06-027.5CVE-2017-9363 CONFIRMtodd_miller -- sudoTodd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution.2017-06-057.2CVE-2017-1000368 BID CONFIRMwebsitebaker -- websitebakerWebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php.2017-06-027.5CVE-2017-9360 MISCwireshark -- wiresharkIn Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DNS dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-dns.c by trying to detect self-referencing pointers.2017-06-027.8CVE-2017-9345 BID MISC MISC MISC MISCwireshark -- wiresharkIn Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the SoulSeek dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-slsk.c by making loop bounds more explicit.2017-06-027.8CVE-2017-9346 BID MISC MISC MISC MISCwireshark -- wiresharkIn Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DICOM dissector has an infinite loop. This was addressed in epan/dissectors/packet-dcm.c by validating a length value.2017-06-027.8CVE-2017-9349 BID MISC MISC MISC MISCwireshark -- wiresharkIn Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-opensafety.c by checking for a negative length.2017-06-027.8CVE-2017-9350 BID MISC MISC MISC MISCwireshark -- wiresharkIn Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bazaar dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-bzr.c by ensuring that backwards parsing cannot occur.2017-06-027.8CVE-2017-9352 BID MISC MISC MISCBack to top * Medium Vulnerabilities Primary Vendor -- ProductDescriptionPublishedCVSS ScoreSource & Patch Infoasterisk -- certified_asteriskA memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, which can be triggered by sending specially crafted SCCP packets causing a infinite loop and leading to memory exhaustion (by message logging in that loop).2017-06-025.0CVE-2017-9358 CONFIRM BID CONFIRMbigtreecms -- bigtree_cmsCSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?force=false. A page with id=1 can be unlocked.2017-06-026.8CVE-2017-9365 CONFIRM CONFIRMbigtreecms -- bigtree_cmsBigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks (such as data backups) to complete before a user is deleted.2017-06-024.0CVE-2017-9378 MISC MISCbigtreecms -- bigtree_cmsMultiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or to parameter to core\admin\modules\dashboard\vitals-statistics\404\create-301.php.2017-06-026.8CVE-2017-9379 MISCbigtreecms -- bigtree_cmsSQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core\admin\modules\developer\modules\designer\form-create.php. The attacker creates a crafted table name at admin/developer/modules/designer/ and the injection is visible at admin/dashboard/vitals-statistics/integrity/check/?external=true.2017-06-046.5CVE-2017-9427 MISCbigtreecms -- bigtree_cmsA directory traversal vulnerability exists in core\admin\ajax\developer\extensions\file-browser.php in BigTree CMS through 4.2.18 on Windows, allowing attackers to read arbitrary files via ..\ sequences in the directory parameter.2017-06-045.0CVE-2017-9428 MISCbigtreecms -- bigtree_cms** DISPUTED ** BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php. This issue exists in core\admin\modules\developer\extensions\install\un pack.php and core\admin\modules\developer\packages\install\unpa ck.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files."2017-06-056.5CVE-2017-9442 MISCbigtreecms -- bigtree_cms** DISPUTED ** BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\pr ocess.php and core\admin\modules\developer\packages\install\proc ess.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files."2017-06-056.5CVE-2017-9443 MISCcryptopp -- crypto++Crypto++ (aka cryptopp) through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter.2017-06-055.0CVE-2017-9434 CONFIRM CONFIRM CONFIRMfreedesktop -- popplerIn Poppler 0.54.0, a memory leak vulnerability was found in the function gmalloc in gmem.cc, which allows attackers to cause a denial of service via a crafted file.2017-06-024.3CVE-2017-9406 CONFIRMfreedesktop -- popplerIn Poppler 0.54.0, a memory leak vulnerability was found in the function Object::initArray in Object.cc, which allows attackers to cause a denial of service via a crafted file.2017-06-024.3CVE-2017-9408 CONFIRMgoogle -- androidIn TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure vulnerability could potentially exist.2017-06-064.3CVE-2014-9947 BID CONFIRMgoogle -- androidIn TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure Through Timing Discrepancy vulnerability could potentially exist.2017-06-064.3CVE-2014-9951 BID CONFIRMgoogle -- androidThe stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to trick a victim by displaying a malicious page for legitimate domain names.2017-06-064.3CVE-2015-3830 MISC MISCimagemagick -- imagemagickIn ImageMagick 7.0.5-5, the ReadICONImage function in icon.c:452 allows attackers to cause a denial of service (memory leak) via a crafted file.2017-06-024.3CVE-2017-9405 CONFIRMimagemagick -- imagemagickIn ImageMagick 7.0.5-5, the ReadPALMImage function in palm.c allows attackers to cause a denial of service (memory leak) via a crafted file.2017-06-024.3CVE-2017-9407 CONFIRMimagemagick -- imagemagickIn ImageMagick 7.0.5-5, the ReadMPCImage function in mpc.c allows attackers to cause a denial of service (memory leak) via a crafted file.2017-06-024.3CVE-2017-9409 CONFIRMimagemagick -- imagemagickIn ImageMagick 7.0.5-5, a memory leak was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of service via a crafted file.2017-06-054.3CVE-2017-9439 BID CONFIRMimagemagick -- imagemagickIn ImageMagick 7.0.5-5, a memory leak was found in the function ReadPSDChannel in coders/psd.c, which allows attackers to cause a denial of service via a crafted file.2017-06-054.3CVE-2017-9440 BID CONFIRMjamroom -- jamroomCross Site Scripting (XSS) exists in Jamroom before 4.2.7 via the Status Update field.2017-06-044.3CVE-2012-6705 MISC BIDlenovo -- lenovo_service_bridgeA cross-site request forgery vulnerability in Lenovo Service Bridge before version 4 could be exploited by an attacker with access to the DHCP server used by the system where LSB is installed.2017-06-046.8CVE-2016-8229 CONFIRMlenovo -- lenovo_service_bridgeIn Lenovo Service Bridge before version 4, an insecure HTTP connection is used by LSB to send system serial number, machine type and model and product name to Lenovo's servers.2017-06-045.0CVE-2016-8230 CONFIRMlenovo -- lenovo_service_bridgeIn Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploited by an attacker to insert a forged code signing certificate.2017-06-045.0CVE-2016-8231 CONFIRMlibtiff -- libtiffIn LibTIFF 4.0.7, a memory leak vulnerability was found in the function TIFFReadDirEntryLong8Array in tif_dirread.c, which allows attackers to cause a denial of service via a crafted file.2017-06-024.3CVE-2017-9403 CONFIRMlibtiff -- libtiffIn LibTIFF 4.0.7, a memory leak vulnerability was found in the function OJPEGReadHeaderInfoSecTablesQTable in tif_ojpeg.c, which allows attackers to cause a denial of service via a crafted file.2017-06-024.3CVE-2017-9404 CONFIRModoo -- odooDirectory traversal vulnerability in tools.file_open in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the Odoo service.2017-06-044.0CVE-2017-9416 CONFIRMopen-emr -- openemrOpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application.2017-06-026.5CVE-2017-9380 MISCtodd_miller -- sudoTodd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.2017-06-056.9CVE-2017-1000367 SUSE SUSE SUSE MISC FULLDISC DEBIAN MLIST BID SECTRACK UBUNTU REDHAT FEDORA GENTOO CONFIRMvirustotal -- yaralibyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex strings) that is mishandled in the _yr_re_emit function, a different vulnerability than CVE-2017-9304.2017-06-055.0CVE-2017-9438 CONFIRM CONFIRMwebsitebaker -- websitebakerWebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php.2017-06-024.3CVE-2017-9361 MISCwireshark -- wiresharkIn Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the MSNIP dissector misuses a NULL pointer. This was addressed in epan/dissectors/packet-msnip.c by validating an IPv4 address.2017-06-025.0CVE-2017-9343 BID MISC MISC MISC MISCwireshark -- wiresharkIn Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bluetooth L2CAP dissector could divide by zero. This was addressed in epan/dissectors/packet-btl2cap.c by validating an interval value.2017-06-025.0CVE-2017-9344 BID MISC MISC MISC MISCwireshark -- wiresharkIn Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/asn1/ros/packet-ros-template.c by validating an OID.2017-06-025.0CVE-2017-9347 BID MISC MISC MISC MISCwireshark -- wiresharkIn Wireshark 2.2.0 to 2.2.6, the DOF dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-dof.c by validating a size value.2017-06-025.0CVE-2017-9348 BID MISC MISC MISC MISCwireshark -- wiresharkIn Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. This was addressed in epan/dissectors/packet-bootp.c by extracting the Vendor Class Identifier more carefully.2017-06-025.0CVE-2017-9351 BID MISC MISC MISC MISC MISC MISCwireshark -- wiresharkIn Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed in epan/dissectors/packet-ipv6.c by validating an IPv6 address.2017-06-025.0CVE-2017-9353 BID MISC MISC MISC MISCwireshark -- wiresharkIn Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the RGMP dissector could crash. This was addressed in epan/dissectors/packet-rgmp.c by validating an IPv4 address.2017-06-025.0CVE-2017-9354 BID MISC MISC MISC MISCytnef_project -- ytnefIn ytnef 1.9.2, the MAPIPrint function in lib/ytnef.c allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.2017-06-074.3CVE-2017-9470 MISCytnef_project -- ytnefIn ytnef 1.9.2, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.2017-06-074.3CVE-2017-9471 MISCytnef_project -- ytnefIn ytnef 1.9.2, the SwapDWord function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.2017-06-074.3CVE-2017-9472 MISCytnef_project -- ytnefIn ytnef 1.9.2, the TNEFFillMapi function in lib/ytnef.c allows remote attackers to cause a denial of service (memory consumption) via a crafted file.2017-06-074.3CVE-2017-9473 MISCytnef_project -- ytnefIn ytnef 1.9.2, the DecompressRTF function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.2017-06-074.3CVE-2017-9474 MISCBack to top * Low Vulnerabilities Primary Vendor -- ProductDescriptionPublishedCVSS ScoreSource & Patch Infopiwigo -- piwigoCross-site scripting (XSS) vulnerability in admin.php in Piwigo 2.9.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter.2017-06-063.5CVE-2017-9452 MISCtelaxus -- epesiTelaxus EPESI 1.8.2 and earlier has a Stored Cross-site Scripting (XSS) vulnerability in modules/Base/Dashboard/Dashboard_0.php, which allows remote attackers to inject arbitrary web script or HTML via a crafted tab_name parameter.2017-06-023.5CVE-2017-9366 CONFIRM CONFIRMBack to top * Severity Not Yet Assigned Primary Vendor -- ProductDescriptionPublishedCVSS ScoreSource & Patch Infoacquisition_technology_&_logistics_agency --* installer_of_electronic_tendering_and_bid_opening_ system *Untrusted search path vulnerability in Installer of electronic tendering and bid opening system available prior to May 25, 2017 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2178 JVN CONFIRMadblock -- adblock *AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters.2017-06-08not yet calculatedCVE-2015-2692 CONFIRM MISCamd -- fglrx-driverAMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015-7723.2017-06-07not yet calculatedCVE-2015-7724 MISC FULLDISC BUGTRAQ BID MISCamd -- fglrx-driverAMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack.2017-06-07not yet calculatedCVE-2015-7723 MISC FULLDISC BUGTRAQ BID MISCapache -- archiva The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.2017-06-06not yet calculatedCVE-2016-5004 MLIST BID SECTRACK MISC MISCapache -- cxf_fedizApplication plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.2017-06-07not yet calculatedCVE-2015-5175 MLIST BID CONFIRM CONFIRM MLISTapache -- java_servlet_specification *The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.2017-06-06not yet calculatedCVE-2017-5664 BID MLISTappcheck -- appcheck *Untrusted search path vulnerability in AppCheck and AppCheck Pro prior to version 2.0.1.15 allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2214 JVNapple -- mac_sleipnir_4 *Sleipnir 4 Black Edition for Mac 4.5.3 and earlier and Sleipnir 4 for Mac 4.5.3 and earlier (Mac App Store) may allow a remote attacker to spoof the URL display via a specially crafted webpage.2017-06-09not yet calculatedCVE-2016-7831 JVNarm -- arm_trusted_firmware *In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT_EXECUTE_NEVER protection mechanism. This issue occurs because of inconsistency in the number of execute-never bits (one bit versus two bits).2017-06-07not yet calculatedCVE-2017-7563 CONFIRMarm -- arm_trusted_firmware *In ARM Trusted Firmware through 1.3, the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of service (secure world panic) via vectors involving debug exceptions and debug registers.2017-06-07not yet calculatedCVE-2017-7564 CONFIRMarubanetworks -- clearpass_policy_manager SQL injection vulnerability in ClearPass Policy Manager 6.5.x through 6.5.6 and 6.6.0.2017-06-08not yet calculatedCVE-2016-2034 CONFIRMasterisk -- asterisk *PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.2017-06-02not yet calculatedCVE-2017-9372 CONFIRM BID CONFIRMasterisk -- asterisk *The multi-part body parser in PJSIP, as used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, Certified Asterisk 13.13 before 13.13-cert4, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.2017-06-02not yet calculatedCVE-2017-9359 CONFIRM BID CONFIRM CONFIRMatmail -- atmail *atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV.2017-06-08not yet calculatedCVE-2017-9517 CONFIRMatmail -- atmail *atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account.2017-06-08not yet calculatedCVE-2017-9519 CONFIRMatmail -- atmail *atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails.2017-06-08not yet calculatedCVE-2017-9518 CONFIRMbigtree -- bigtree_cms *BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI (remove packages), the index.php/admin/developer/upgrade/ignore/?versions= URI, and the index.php/admin/developer/upgrade/set-ftp-directory/ URI.2017-06-05not yet calculatedCVE-2017-9444 MISCbigtree -- bigtree_cms *** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted package, triggering mishandling of the (1) title or (2) version or (3) author_name parameter in manifest.json. This issue exists in core\admin\modules\developer\extensions\install\un pack.php and core\admin\modules\developer\packages\install\unpa ck.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files."2017-06-05not yet calculatedCVE-2017-9441 MISCbigtree -- bigtree_cms *SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker creates a crafted table name at admin/developer/modules/views/create/ and the injection is visible at admin/ajax/auto-modules/views/searchable-page/ or admin/modules_name.2017-06-06not yet calculatedCVE-2017-9449 MISCbigtree -- bigtree_cms *Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML via the description parameter. This issue exists in core\admin\ajax\pages\save-revision.php and core\admin\modules\pages\revisions.php. Low-privileged (administrator) users can attack high-privileged (Developer) users.2017-06-06not yet calculatedCVE-2017-9448 MISCblue_coat -- advanced_secure_gateway *Blue Coat Advanced Secure Gateway 6.6, CacheFlow 3.4, ProxySG 6.5 and 6.6 allows remote attackers to bypass blocked requests, user authentication, and payload scanning.2017-06-08not yet calculatedCVE-2016-6594 CONFIRMbluez -- bluez *Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities.2017-06-09not yet calculatedCVE-2016-7837 CONFIRM JVNbroadcom -- wi-fi_chip *Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn" issue.2017-06-04not yet calculatedCVE-2017-9417 MISCbuffalo_inc -- wnc01wh_firmware *Buffalo NC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to bypass access restriction to enable the debug option via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7824 CONFIRM JVNbuffalo_inc -- wnc01wh_firmware *Directory traversal vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to read arbitrary files via specially crafted commands.2017-06-09not yet calculatedCVE-2016-7825 CONFIRM JVNbuffalo_inc -- wnc01wh_firmware *Cross-site request forgery (CSRF) vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows remote attackers to hijack the authentication of a logged in user to perform unintended operations via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7822 CONFIRM JVNbuffalo_inc -- wnc01wh_firmware *Directory traversal vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to read arbitrary files via specially crafted POST requests.2017-06-09not yet calculatedCVE-2016-7826 CONFIRM JVNbuffalo_inc -- wnc01wh_firmware *Cross-site scripting vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7823 CONFIRM JVNbuffalo_inc -- wnc01wh_firmware *Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allow remote attackers to cause a denial of service against the management screen via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7821 CONFIRM JVNcgi:irc -- irc.cgi *irc.cgi in CGI:IRC before 0.5.12 reflects user-supplied input from the R parameter without proper output encoding, aka XSS.2017-06-06not yet calculatedCVE-2017-8920 CONFIRM CONFIRMcisco -- anyconnect_secure_mobility_client_for_windows *A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and run an executable file with privileges equivalent to the Microsoft Windows SYSTEM account. The vulnerability is due to incomplete input validation of path and file names of a DLL file before it is loaded. An attacker could exploit this vulnerability by creating a malicious DLL file and installing it in a specific system directory. A successful exploit could allow the attacker to execute commands on the underlying Microsoft Windows host with privileges equivalent to the SYSTEM account. The attacker would need valid user credentials to exploit this vulnerability. This vulnerability affects all Cisco AnyConnect Secure Mobility Client for Windows software versions prior to 4.4.02034. Cisco Bug IDs: CSCvc97928.2017-06-08not yet calculatedCVE-2017-6638 BID CONFIRMcisco -- prime_data_center_network_manager *A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an unauthenticated, remote attacker to log in to the administrative console of a DCNM server by using an account that has a default, static password. The account could be granted root- or system-level privileges. The vulnerability exists because the affected software has a default user account that has a default, static password. The user account is created automatically when the software is installed. An attacker could exploit this vulnerability by connecting remotely to an affected system and logging in to the affected software by using the credentials for this default user account. A successful exploit could allow the attacker to use this default user account to log in to the affected software and gain access to the administrative console of a DCNM server. This vulnerability affects Cisco Prime Data Center Network Manager (DCNM) Software releases prior to Release 10.2(1) for Microsoft Windows, Linux, and Virtual Appliance platforms. Cisco Bug IDs: CSCvd95346.2017-06-08not yet calculatedCVE-2017-6640 BID CONFIRMcisco -- prime_data_center_network_manager *A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to access sensitive information or execute arbitrary code with root privileges on an affected system. The vulnerability is due to the lack of authentication and authorization mechanisms for a debugging tool that was inadvertently enabled in the affected software. An attacker could exploit this vulnerability by remotely connecting to the debugging tool via TCP. A successful exploit could allow the attacker to access sensitive information about the affected software or execute arbitrary code with root privileges on the affected system. This vulnerability affects Cisco Prime Data Center Network Manager (DCNM) Software Releases 10.1(1) and 10.1(2) for Microsoft Windows, Linux, and Virtual Appliance platforms. Cisco Bug IDs: CSCvd09961.2017-06-08not yet calculatedCVE-2017-6639 BID CONFIRMcisco -- telepresence_codec_and_collaboration_endpoint_soft ware *A vulnerability in the Session Initiation Protocol (SIP) of the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software could allow an unauthenticated, remote attacker to cause a TelePresence endpoint to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of flow-control mechanisms within the software. An attacker could exploit this vulnerability by sending a flood of SIP INVITE packets to the affected device. An exploit could allow the attacker to impact the availability of services and data of the device, including a complete DoS condition. This vulnerability affects the following Cisco TC and CE platforms when running software versions prior to TC 7.3.8 and CE 8.3.0. Cisco Bug IDs: CSCux94002.2017-06-08not yet calculatedCVE-2017-6648 BID CONFIRMcompulab -- intense_pc_and_mintbox_2_firmwareCompuLab Intense PC and MintBox 2 devices with BIOS before 2017-05-21 do not use the CloseMnf protection mechanism for write protection of flash memory regions, which allows local users to install a firmware rootkit by leveraging administrative privileges.2017-06-06not yet calculatedCVE-2017-8083 MISC MISCcorega -- cg-wlbargmh_firmware *Cross-site scripting vulnerability in Corega CG-WLBARGMH and CG-WLBARGNL allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7808 CONFIRM JVNcorega -- cg-wlr300nx_firmware *Cross-site scripting vulnerability in Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7810 CONFIRM JVNcorega -- cg-wlr300nx_firmware *Cross-site request forgery (CSRF) vulnerability in Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows remote attackers to hijack the authentication of logged in user to conduct unintended operations via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7809 CONFIRM JVNcorega -- cg-wlr300nx_firmware *Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows an attacker on the same network segment to bypass access restriction to perform arbitrary operations via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7811 CONFIRM JVNcraft_cms -- craft_cms *Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.2017-06-08not yet calculatedCVE-2017-9516 MISC MISC MISCcybozu -- dezie *Cybozu Dezie 8.0.0 to 8.1.1 allows remote attackers to bypass access restrictions to obtain an arbitrary DBM (Cybozu Dezie proprietary format) file via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7832 JVN CONFIRMcybozu -- dezie *Cybozu Dezie 8.0.0 to 8.1.1 allows remote attackers to bypass access restrictions to delete an arbitrary DBM (Cybozu Dezie proprietary format) file via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7833 JVN CONFIRMcybozu -- garoonCybozu Garoon 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors.2017-06-09not yet calculatedCVE-2016-4907 JVN CONFIRMcybozu -- garoon Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to inject arbitrary web script or HTML via "Messages" function of Cybozu Garoon Keitai.2017-06-09not yet calculatedCVE-2016-4906 JVN CONFIRMcybozu -- garoon *Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors.2017-06-09not yet calculatedCVE-2016-4908 JVN CONFIRMcybozu -- garoon *SQL injection vulnerability in the Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to execute arbitrary SQL commands via "MultiReport" function.2017-06-09not yet calculatedCVE-2016-7803 JVN CONFIRMcybozu -- garoon *Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to bypass access restrictions to delete other users' To-Dos via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7801 JVN CONFIRMcybozu -- garoon *Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to delete other operational administrators' MultiReport filters via unspecified vectors.2017-06-09not yet calculatedCVE-2016-4910 JVN CONFIRMcybozu -- garoon *Directory traversal vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to read arbitrary files via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7802 JVN CONFIRMcybozu -- garoon *Cross-site request forgery (CSRF) vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to hijack the authentication of a logged in user to force a logout via unspecified vectors.2017-06-09not yet calculatedCVE-2016-4909 JVN CONFIRMcybozu -- kintone *The Cybozu kintone mobile for Android 1.0.6 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.2017-06-09not yet calculatedCVE-2016-7816 JVN CONFIRMderaemon-cms -- deraemon-cms *Cross-site scripting vulnerability in DERAEMON-CMS version 0.8.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the parameters hostname, database and username.2017-06-09not yet calculatedCVE-2016-7813 CONFIRM JVNdocument_liberation_project -- libmwaw *Document Liberation Project libmwaw before 2017-04-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the MsWrd1Parser::readFootnoteCorrespondance function in lib/MsWrd1Parser.cxx.2017-06-04not yet calculatedCVE-2017-9433 MISC MISCdocument_liberation_project -- libstaroffice *Document Liberation Project libstaroffice before 2017-04-07 has an out-of-bounds write caused by a stack-based buffer overflow related to the DatabaseName::read function in lib/StarWriterStruct.cxx.2017-06-04not yet calculatedCVE-2017-9432 MISC MISCelastic -- kibana *Starting in version 5.3.0, Kibana had a cross-site scripting (XSS) vulnerability in the Discover page that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.2017-06-05not yet calculatedCVE-2017-8440 CONFIRM CONFIRM CONFIRMelastic -- kibana *Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.2017-06-05not yet calculatedCVE-2017-8439 CONFIRM CONFIRM CONFIRMelastic -- x-pack *Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias.2017-06-05not yet calculatedCVE-2017-8441 CONFIRM CONFIRM CONFIRMelastic -- x-pack *Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitioning into the specified user specified in a run_as request. If a role has been created using a template that contains the _user properties, the behavior of run_as will be incorrect. Additionally if the run_as user specified does not exist, the transition will not happen.2017-06-05not yet calculatedCVE-2017-8438 CONFIRM CONFIRM CONFIRMemc -- multiple_products *EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2 (all patch levels); RSA Via Lifecycle and Governance version 7.0 (all patch levels); and RSA Identity Management and Governance (IMG) version 6.9.1 (all patch levels) have Stored Cross Site Scripting vulnerabilities that could potentially be exploited by malicious users to compromise an affected system.2017-06-09not yet calculatedCVE-2017-5004 CONFIRMemc -- multiple_products *EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2 (all patch levels); RSA Via Lifecycle and Governance version 7.0 (all patch levels); and RSA Identity Management and Governance (IMG) version 6.9.1 (all patch levels) have Reflected Cross Site Scripting vulnerabilities that could potentially be exploited by malicious users to compromise an affected system.2017-06-09not yet calculatedCVE-2017-5003 CONFIRMf5 -- big-ip_enterprise_manager *Buffer overflow in the mcpq daemon in F5 BIG-IP systems 10.x before 10.2.4 HF12, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x before 11.4.1 HF9, 11.5.x before 11.5.2 HF1, and 11.6.0 before HF4, and Enterprise Manager 2.1.0 through 2.3.0 and 3.x before 3.1.1 HF5 allows remote authenticated administrators to cause a denial of service via unspecified vectors.2017-06-08not yet calculatedCVE-2014-6031 CONFIRMf5 -- multiple_productsA stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WOM and WebSafe version 12.0.0 - 12.1.2, 11.4.0 - 11.6.1, and 11.2.1 allows an authenticated user to inject arbitrary web script or HTML. Exploitation requires Resource Administrator or Administrator privileges, and it could cause the Configuration utility client to become unstable.2017-06-09not yet calculatedCVE-2016-7469 CONFIRMflatcore -- flatcore *Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in an acp.php URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.2017-06-06not yet calculatedCVE-2017-9451 MISCgame-music-emu -- game-music-emu *game-music-emu before 0.6.1 mishandles unspecified integer values.2017-06-06not yet calculatedCVE-2016-9961 SUSE SUSE MLIST BID CONFIRM CONFIRM FEDORA FEDORA FEDORA FEDORA MISCgame-music-emu -- game-music-emu *game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash).2017-06-06not yet calculatedCVE-2016-9960 SUSE SUSE MLIST BID CONFIRM CONFIRM FEDORA FEDORA FEDORA FEDORA MISCgoogle -- android *b/libs/gui/ISurfaceComposer.cpp in Android allows attackers to trigger a denial of service (null pointer dereference and process crash).2017-06-08not yet calculatedCVE-2014-7919 CONFIRM CONFIRM CONFIRMgoogle -- android *Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack via a crafted SSL certificate.2017-06-08not yet calculatedCVE-2016-5648 MISC FULLDISC BUGTRAQ CERT-VNgoogle -- android *The mobiGate App for Android version 2.2.1.2 and earlier and mobiGate App for iOS version 2.2.4.1 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.2017-06-09not yet calculatedCVE-2016-7805 JVNgoogle -- chrome *Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted .m4a file.2017-06-06not yet calculatedCVE-2015-1207 CONFIRM CONFIRMgoogle -- grpc *Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer overflow related to core/lib/iomgr/error.c.2017-06-04not yet calculatedCVE-2017-9431 MISC MISCgroup_sessions -- group_sessionsGroupSession versions 4.6.4 and earlier allows remote authenticated attackers to bypass access restrictions to obtain sensitive information such as emails via unspecified vectors.2017-06-09not yet calculatedCVE-2017-2165 JVNh2o_project -- h2o Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and possibly other information.2017-06-09not yet calculatedCVE-2016-7835 CONFIRM JVNhoukokusyo -- sakusei_shien_tool *Untrusted search path vulnerability in the installer of Houkokusyo Sakusei Shien Tool ver3.0.2 (For the first installation) (The version which was available on the website from 2017 April 4 to 2017 May 18) and ver2.0 and later (For the first installation) (The versions which were available on the website prior to 2017 April 4) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2209 CONFIRM CONFIRM MISC JVNhuawei -- ar1220_firmware *Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board reset) via vectors involving a large amount of traffic from the GE port to the FE port.2017-06-08not yet calculatedCVE-2015-2255 CONFIRMhuawei -- campus_firmware *The user authentication module in Huawei Campus switches S5700, S5300, S6300, and S6700 with software before V200R001SPH012 and S7700, S9300, and S9700 with software before V200R001SPH015 allows remote attackers to cause a denial of service (device restart) via vectors involving authentication, which trigger an array access violation.2017-06-08not yet calculatedCVE-2015-2800 CONFIRM BIDhuawei -- campus_firmware *The IP stack in multiple Huawei Campus series switch models allows remote attackers to cause a denial of service (reboot) via a crafted ICMP request message.2017-06-08not yet calculatedCVE-2015-3913 CONFIRMhuawei -- oceanstor_firmware *The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensitive information via a crafted XML document.2017-06-08not yet calculatedCVE-2015-2253 CONFIRMhuawei -- oceanstor_firmware *Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell scripts.2017-06-08not yet calculatedCVE-2015-2252 CONFIRMhuawei -- oceanstor_firmware *The DeviceManager in Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to obtain sensitive information via a crafted UDS patch with JavaScript.2017-06-08not yet calculatedCVE-2015-2251 CONFIRMibm -- bigfix_compliance_analytics *IBM BigFix Compliance Analytics 1.9.79 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 123431.2017-06-08not yet calculatedCVE-2017-1179 CONFIRM BID MISCibm -- bigfix_compliance_analytics *IBM BigFix Compliance (TEMA SUAv1 SCA SCM) 1.9.70 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 123671.2017-06-07not yet calculatedCVE-2017-1196 CONFIRM BID MISCibm -- business_process_manager *IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.2017-06-08not yet calculatedCVE-2017-1140 CONFIRM BID MISCibm -- cognos_analytics *IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents of a file. IBM X-Force ID: 121340.2017-06-07not yet calculatedCVE-2017-1125 CONFIRM BID MISCibm -- cognos_business_intelligence *IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote authenticated attacker could exploit this vulnerability to consume all available CPU resources and cause a denial of service. IBM X-Force ID: 110563.2017-06-07not yet calculatedCVE-2016-0254 CONFIRM MISCibm -- curam_social_program_management *Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL.2017-06-08not yet calculatedCVE-2014-4843 CONFIRM BIDibm -- domino *IBM Domino 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data using Domino TLS Key Exchange validation. IBM X-Force ID: 117918.2017-06-07not yet calculatedCVE-2016-6087 CONFIRM BID MISCibm -- doors_next_generation *IBM DOORS Next Generation (DNG/RRC) 6.0.2 and 6.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125459.2017-06-07not yet calculatedCVE-2017-1305 CONFIRM BID MISCibm -- endpoint_manager_for_security_and_compliance *IBM Endpoint Manager for Security and Compliance 1.9.70 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123430.2017-06-07not yet calculatedCVE-2017-1178 CONFIRM BID MISCibm -- maximo_asset_management *IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 120253.2017-06-07not yet calculatedCVE-2016-9977 CONFIRM BID MISCibm -- maximo_asset_management *IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they should not have access to view.2017-06-08not yet calculatedCVE-2016-8987 CONFIRM BID MISCibm -- predictive_solutions_foundation *IBM Predictive Solutions Foundation (formerly PMQ) could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a file from the local system, which could allow the attacker to obtain sensitive information. IBM X-Force ID: 119618.2017-06-07not yet calculatedCVE-2016-9710 CONFIRM MISCibm -- rhapsody_dm *IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1999960.2017-06-08not yet calculatedCVE-2016-9698 CONFIRM CONFIRM BID MISCibm -- security_access_manager_9.0 *IBM Security Access Manager for Web 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 114462.2017-06-07not yet calculatedCVE-2016-3019 CONFIRM BID MISCibm -- security_access_manager_9.0 *IBM Security Access Manager for Web 9.0.0 could allow an authenticated user to access some privileged functionality of the server. IBM X-Force ID: 114714.2017-06-07not yet calculatedCVE-2016-3051 CONFIRM BID MISCibm -- security_privileged_identity_manager *IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 116136.2017-06-07not yet calculatedCVE-2016-5959 CONFIRM BID MISCibm -- security_privileged_identity_manager *IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 116171.2017-06-07not yet calculatedCVE-2016-5960 CONFIRM BID MISCibm -- sterling_order_management *IBM Sterling Order Management 9.2 through 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 121314.2017-06-08not yet calculatedCVE-2016-9991 CONFIRM BID MISCibm -- tivoli key lifecycle manager *IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.2017-06-08not yet calculatedCVE-2016-6098 CONFIRM BID MISCibm -- tivoli key lifecycle manager *IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.2017-06-08not yet calculatedCVE-2016-6093 CONFIRM BID MISCibm -- tivoli_federated_identity_manager *IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted session (SSL) cookie. IBM X-Force ID: 125731.2017-06-08not yet calculatedCVE-2017-1319 CONFIRM MISCibm -- tivoli_storage_manager *IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) clients/agents store password information in the Windows Registry in a manner which can be compromised. IBM X-Force ID: 118790.2017-06-07not yet calculatedCVE-2016-8939 CONFIRM BID MISCibm -- websphere_application_server *IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information.2017-06-08not yet calculatedCVE-2016-9736 CONFIRM CONFIRM BID MISCibm -- websphere_mq *IBM WebSphere MQ 9.0.0.1 and 9.0.2 could allow a local user to write to a file or delete files in a directory they should not have access to due to improper access controls. IBM X-Force ID: 117926.2017-06-07not yet calculatedCVE-2016-6089 CONFIRM BID MISCimagemagick -- imagemagick *In ImageMagick 7.0.5-8 Q16, an assertion failure was found in the function ResetImageProfileIterator, which allows attackers to cause a denial of service via a crafted file.2017-06-07not yet calculatedCVE-2017-9500 BID CONFIRMimagemagick -- imagemagick *In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function LockSemaphoreInfo, which allows attackers to cause a denial of service via a crafted file.2017-06-07not yet calculatedCVE-2017-9501 BID CONFIRM CONFIRMimagemagick -- imagemagick *In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function SetPixelChannelAttributes, which allows attackers to cause a denial of service via a crafted file.2017-06-07not yet calculatedCVE-2017-9499 BID CONFIRM CONFIRMintel -- omni_path_architectureRace conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197.2017-06-07not yet calculatedCVE-2015-5232 MLIST CONFIRM CONFIRM CONFIRM CONFIRMintellect_design_arena -- intellect_coreCross-site scripting (XSS) vulnerability in Intellect Design Arena Intellect Core banking software.2017-06-07not yet calculatedCVE-2015-6540 MISC BUGTRAQiodata -- ts-wrlp_firmware *I-O DATA DEVICE TS-WRLP firmware version 1.00.01 and earlier and TS-WRLA firmware version 1.00.01 and earlier allow remote attackers to obtain authentication credentials via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7814 CONFIRM JVNiodata -- ts-wrlp_firmware *Buffer overflow in I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an attacker with administrator rights to cause a denial-of-service (DoS) or execute arbitrary code via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7820 CONFIRM JVNiodata -- ts-wrlp_firmware *I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7819 CONFIRM JVNiodata -- wfs-sr01_firmware *I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7806 CONFIRM JVNiodata -- wfs-sr01_firmware *I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to bypass access restriction to access data on storage devices inserted into the product via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7807 CONFIRM JVNipa -- appgoat *Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allows remote code execution via unspecified vectors, a different vulnerability than CVE-2017-2181 and CVE-2017-2182.2017-06-09not yet calculatedCVE-2017-2179 JVNipa -- appgoat *Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors, a different vulnerability than CVE-2017-2179 and CVE-2017-2182.2017-06-09not yet calculatedCVE-2017-2181 JVNipa -- appgoat *Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors, a different vulnerability than CVE-2017-2179 and CVE-2017-2181.2017-06-09not yet calculatedCVE-2017-2182 JVNipa -- appgoat *Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors.2017-06-09not yet calculatedCVE-2017-2180 JVNirssi -- irssi *In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash.2017-06-06not yet calculatedCVE-2017-9469 CONFIRM CONFIRMirssi -- irssi *In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash.2017-06-06not yet calculatedCVE-2017-9468 CONFIRM CONFIRMlemons_php -- simple_keitai_chat_2.0 *Cross-site scripting vulnerability in Simple keitai chat 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7817 JVNlenovo -- active_protection_system *In Lenovo Active Protection System before 1.82.0.14, an attacker with local privileges could send commands to the system's embedded controller, which could cause a denial of service attack on the system or the ability to alter hardware functionality.2017-06-04not yet calculatedCVE-2017-3740 CONFIRMlenovo -- power_management_driverIn the Lenovo Power Management driver before 1.67.12.24, a local user may alter the trackpoint's firmware and stop the trackpoint from functioning correctly. This issue only affects ThinkPad X1 Carbon 5th generation.2017-06-04not yet calculatedCVE-2017-3741 CONFIRMlibdwarf -- libdwarf dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).2017-06-07not yet calculatedCVE-2015-8538 MLIST CONFIRMlibgcrypt -- libgcrypt *In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point operations are used in the MPI library.2017-06-10not yet calculatedCVE-2017-9526 CONFIRM CONFIRM CONFIRMlinux-- qemu_emulator *QEMU (aka Quick Emulator), when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value.2017-06-08not yet calculatedCVE-2017-9330 CONFIRM MLIST BID CONFIRMlynis -- lynis *Unspecified tests in Lynis before 2.5.0 allow local users to write to arbitrary files or possibly gain privileges via a symlink attack on a temporary file.2017-06-08not yet calculatedCVE-2017-8108 CONFIRM CONFIRM FEDORA FEDORAmarkdown-it -- markdown-it *markdown-it before 4.1.0 does not block data: URLs.2017-06-07not yet calculatedCVE-2015-3295 MLIST BID CONFIRMmavetju -- mavetju *Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a command line with a long name argument that is mishandled in a strcpy call for argv[0]. An example threat model is a web application that launches dnstracer with an untrusted name string.2017-06-05not yet calculatedCVE-2017-9430 MISC MISC EXPLOIT-DBmicrosoft -- windows_7 *Untrusted search path vulnerability in RW-5100 driver installer for Windows 7 version 1.0.0.9 and RW-5100 driver installer for Windows 8.1 version 1.0.1.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2191 JVNmicrosoft -- windows_7 *Untrusted search path vulnerability in RW-4040 tool to verify execution environment for Windows 7 version 1.2.0.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2190 JVNmicrosoft -- windows_7 *Untrusted search path vulnerability in RW-4040 driver installer for Windows 7 version 2.27 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2189 JVNmicrosoft -- windows_7 *Untrusted search path vulnerability in RW-5100 tool to verify execution environment for Windows 7 version 1.1.0.0 and RW-5100 tool to verify execution environment for Windows 8.1 version 1.2.0.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2192 JVNmicrosoft*-- windows_vista *Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3.0.1 and earlier, The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)" Ver3.0.1 and earlier and The Public Certification Service for Individuals "The JPKI user's software" Ver2.6 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2016-4902 JVNmilton -- milton_webdavXML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.2017-06-07not yet calculatedCVE-2015-7326 MISC BUGTRAQ BID CONFIRM CONFIRM CONFIRMmulti_feed_reader -- multi_feed_reader *SQL injection vulnerability in the Multi Feed Reader prior to version 2.2.4 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors.2017-06-09not yet calculatedCVE-2017-2195 JVN CONFIRMnagios -- fedora_nagios *The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials.2017-06-06not yet calculatedCVE-2016-0726 CONFIRMnet_monitor -- net_monitor_for_employeesNet Monitor for Employees Pro through 5.3.4 has an unquoted service path, which allows a Security Feature Bypass of its documented "Block applications" design goal. The local attacker must have privileges to write to program.exe in a protected directory, such as the %SYSTEMDRIVE% directory, and thus the issue is not interpreted as a direct privilege escalation. However, the local attacker might have the goal of executing program.exe even though program.exe is a blocked application.2017-06-08not yet calculatedCVE-2017-7180 EXPLOIT-DBopen-xchange -- open-xchange_appsuite *Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-rev38, and 7.6.1-rev21.2017-06-08not yet calculatedCVE-2015-1588 MISC BUGTRAQ BID SECTRACKopenbravo -- openbravo_business_suite *Openbravo Business Suite 3.0 is affected by SQL injection. This vulnerability could allow remote authenticated attackers to inject arbitrary SQL code.2017-06-05not yet calculatedCVE-2017-9437 MISCopenstack -- ironicOpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information.2017-06-07not yet calculatedCVE-2015-7514 MLIST CONFIRM CONFIRM CONFIRMpatchjgd -- patchjgd *Untrusted search path vulnerability in PatchJGD (Hyoko) (PatchJGDh101.EXE) ver. 1.0.1 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2211 JVN CONFIRMpatchjgd -- patchjgd *Untrusted search path vulnerability in PatchJGD (PatchJGD101.EXE) ver. 1.0.1 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2210 JVN CONFIRMpeplink -- balance_router *Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmware_process.cgi via the upfile.path parameter.2017-06-05not yet calculatedCVE-2017-8841 MISC MISCpeplink -- balance_router *SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. An attack vector is the bauth cookie to cgi-bin/MANGA/admin.cgi. One impact is enumeration of user accounts by observing whether a session ID can be retrieved from the sessions database.2017-06-05not yet calculatedCVE-2017-8835 MISC MISCpeplink -- balance_router *Debug information disclosure exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. A direct request to cgi-bin/HASync/hasync.cgi?debug=1 shows Master LAN Address, Serial Number, HA Group ID, Virtual IP, and Submitted syncid.2017-06-05not yet calculatedCVE-2017-8840 MISC MISCpeplink -- balance_router *Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The files in question are /etc/waipass and /etc/roapass. In case one of these devices is compromised, the attacker can gain access to passwords and abuse them to compromise further systems.2017-06-05not yet calculatedCVE-2017-8837 MISC MISCpeplink -- balance_router *CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The CGI scripts in the administrative interface are affected. This allows an attacker to execute commands, if a logged in user visits a malicious website. This can for example be used to change the credentials of the administrative webinterface.2017-06-05not yet calculatedCVE-2017-8836 MISC MISCpeplink -- balance_router *XSS via orig_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The affected script is guest/preview.cgi.2017-06-05not yet calculatedCVE-2017-8839 MISC MISCpeplink -- balance_router *XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The affected script is cgi-bin/HASync/hasync.cgi.2017-06-05not yet calculatedCVE-2017-8838 MISC MISCperl -- perlThe IPTables-Parse module before 1.6 for Perl allows local users to write to arbitrary files owned by the current user.2017-06-07not yet calculatedCVE-2015-8326 MLIST CONFIRM CONFIRM CONFIRMpersonify360 -- personify360_e-business *An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read existing vendor account data (including usernames and passwords).2017-06-07not yet calculatedCVE-2017-7312 MISCpersonify360 -- personify360_e-business *An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required.2017-06-07not yet calculatedCVE-2017-7313 MISCpersonify360 -- personify360_e-business *An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available.2017-06-07not yet calculatedCVE-2017-7314 MISCphoenix -- broadband_poweragent_sc3_bmsA Use of Hard-Coded Password issue was discovered in Phoenix Broadband PowerAgent SC3 BMS, all versions prior to v6.87. Use of a hard-coded password may allow unauthorized access to the device.2017-06-02not yet calculatedCVE-2017-6039 BID MISCpivotx -- pivotx *The smarty_self function in modules/module_smarty.php in PivotX 2.3.11 mishandles the URI, allowing XSS via vectors involving quotes in the self Smarty tag.2017-06-06not yet calculatedCVE-2017-9332 MISCpoppler -- poppler *poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-of-service.2017-06-06not yet calculatedCVE-2017-7515 CONFIRMpostgresql -- postgresql PostgreSQL PL/Java after 9.0 does not honor access controls on large objects.2017-06-06not yet calculatedCVE-2016-0768 CONFIRMpostgresql -- postgresql PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath.2017-06-06not yet calculatedCVE-2016-0767 CONFIRMpostgresql -- postgresql *PostgreSQL PL/Java before 1.5.0 allows remote authenticated users to alter type mappings for types they do not own.2017-06-06not yet calculatedCVE-2016-2192 CONFIRMqemu -- qemu_emulator *QEMU (aka Quick Emulator), when built with the e1000e NIC emulation support, allows local guest OS privileged users to cause a denial of service (infinite loop) via vectors related to setting the initial receive / transmit descriptor head (TDH/RDH) outside the allocated descriptor buffer.2017-06-08not yet calculatedCVE-2017-9310 CONFIRM MLIST BID CONFIRMradare -- radare2 *The r_config_set function in libr/config/config.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted DEX file.2017-06-08not yet calculatedCVE-2017-9520 CONFIRM CONFIRMrapid7 -- nexpose *The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and makes the installations vulnerable to a range of MITM, downgrade, and decryption attacks.2017-06-06not yet calculatedCVE-2017-5243 CONFIRMred5 -- media_server *The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.2017-06-08not yet calculatedCVE-2017-5878 MLIST MISCred_hat -- ansibleThe chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.2017-06-07not yet calculatedCVE-2015-6240 MLIST CONFIRM CONFIRM CONFIRMred_hat -- ansible *The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.2017-06-08not yet calculatedCVE-2014-3498 CONFIRM CONFIRMred_hat -- satellite_6 *MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial of Service.2017-06-06not yet calculatedCVE-2014-8180 CONFIRM CONFIRMred_hat -- satellite_6 *Red Hat Satellite 6 allows remote authenticated users with privileged access on a content host to authenticate to the capsule broker or server broker.2017-06-07not yet calculatedCVE-2015-5202 CONFIRMredhat -- 389_directory_server *389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to infer the existence of RDN component objects.2017-06-08not yet calculatedCVE-2016-4992 REDHAT REDHAT CONFIRMredhat -- 389_directory_server *389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to obtain user passwords.2017-06-08not yet calculatedCVE-2016-5405 REDHAT REDHAT BID CONFIRMredhat -- 389_directory_server *389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.2017-06-08not yet calculatedCVE-2016-5416 REDHAT REDHAT CONFIRMredhat -- cloud_foundry_diego *Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service.2017-06-08not yet calculatedCVE-2016-3091 MLISTredhat -- cloudforms *ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code.2017-06-08not yet calculatedCVE-2016-4471 CONFIRM CONFIRMredhat -- cloudforms *CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.2017-06-08not yet calculatedCVE-2016-4457 CONFIRMredhat -- gnu_compiler_collection *Binaries compiled against targets that use the libssp library in GCC for stack smashing protection (SSP) might allow local users to perform buffer overflow attacks by leveraging lack of the Object Size Checking feature.2017-06-07not yet calculatedCVE-2016-4973 MLIST BID CONFIRMredhat -- jboss_eap *The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload.2017-06-08not yet calculatedCVE-2016-3690 CONFIRM MISC CONFIRMredhat -- mod_ns *mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.2017-06-08not yet calculatedCVE-2016-3099 FEDORA FEDORA FEDORA REDHAT CONFIRMredhat -- ovirt *The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service (process crash) for all VMs.2017-06-06not yet calculatedCVE-2016-3077 CONFIRMredhat -- php */ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.2017-06-08not yet calculatedCVE-2016-4473 SUSE REDHAT CONFIRMredhat -- pulpserver/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.2017-06-08not yet calculatedCVE-2016-3095 FEDORA MLIST MLIST CONFIRM CONFIRMredhat -- pulp *The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink attack.2017-06-08not yet calculatedCVE-2016-3108 MLIST CONFIRM CONFIRM CONFIRM CONFIRMredhat -- pulp *pulp.spec in Pulp 2.8.3 allows local users to read generated RSA keys.2017-06-08not yet calculatedCVE-2016-3111 MISC MISC MLIST CONFIRM CONFIRM CONFIRM CONFIRM CONFIRMredhat -- pulp *The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data.2017-06-08not yet calculatedCVE-2016-3107 MLIST CONFIRM CONFIRM CONFIRMredhat -- pulp *client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable.2017-06-08not yet calculatedCVE-2016-3112 MLIST CONFIRM CONFIRM CONFIRMredhat -- resteasy *SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to execute arbitrary code.2017-06-08not yet calculatedCVE-2016-7050 REDHAT CONFIRMredhat -- spice-gtk *The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard.2017-06-06not yet calculatedCVE-2016-3066 CONFIRMsaat -- netizen *Untrusted search path vulnerability in the installer of SaAT Netizen ver.1.2.10.510 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2206 JVN CONFIRMsaat -- personal *Untrusted search path vulnerability in the installer of SaAT Personal ver.1.0.10.272 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2207 JVN CONFIRMsamba -- samba *smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.2017-06-06not yet calculatedCVE-2017-9461 CONFIRM CONFIRM CONFIRMsamsung -- samsung_mobile Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overwrite or create arbitrary files as the system-level user via a .. (dot dot) in the name of a file, compressed into a zipped file named cred.zip, and downloaded to /sdcard/Download.2017-06-07not yet calculatedCVE-2015-7888 MISC BID MISCschneider_electric – somachine_hvac *A DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute arbitrary code on the targeted system. The vulnerability exists due to the improper loading of a DLL.2017-06-07not yet calculatedCVE-2017-7966 CONFIRM BIDschneider_electric – somachine_hvac *A buffer overflow vulnerability exists in Programming Software executable AlTracePrint.exe, in Schneider Electric's SoMachine HVAC v2.1.0 for Modicon M171/M172 Controller.2017-06-07not yet calculatedCVE-2017-7965 CONFIRM BIDscreensaver_installers -- N/A screensaver_installers *Untrusted search path vulnerability in screensaver installers (jasdf_01.exe, jasdf_02.exe, jasdf_03.exe, jasdf_04.exe, jasdf_05.exe, scramble_setup.exe, clock_01_setup.exe, clock_02_setup.exe) available prior to May 25, 2017 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2176 JVN CONFIRMseagate -- business_nas *Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a static encryption key to create session tokens.2017-06-08not yet calculatedCVE-2014-8687 MISC MISC BID MISC EXPLOIT-DB EXPLOIT-DBsemidynaexe -- semidynaexe *Untrusted search path vulnerability in SemiDynaEXE (SemiDynaEXE2008.EXE) ver. 1.0.2 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2213 JVN CONFIRMshogyo_touki_denshi_ninsho -- shogyo_touki_denshi_ninsho *Untrusted search path vulnerability in Installer of Shogyo Touki Denshi Ninsho Software Ver 1.7 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2177 JVN CONFIRMsimeji -- simeji *Untrusted search path vulnerability in the [Simeji for Windows] installer (simeji.exe) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2219 JVNskysea -- skysea *SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.2017-06-09not yet calculatedCVE-2016-7836 CONFIRM JVN CONFIRMsocat -- socat *The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash).2017-06-08not yet calculatedCVE-2015-1379 CONFIRM MLIST MLIST BID CONFIRMsony -- video_conference_firmware *Sony PCS-XG100, PCS-XG100S, PCS-XG100C, PCS-XG77, PCS-XG77S, PCS-XG77C devices with firmware versions prior to Ver.1.51 and PCS-XC1 devices with firmware version prior to Ver.1.22 allow an attacker on the same network segment to bypass authentication to perform administrative operations via unspecified vectors.2017-06-09not yet calculatedCVE-2016-7830 JVN CONFIRMsophos -- cyberoam_firmware *An XSS vulnerability allows remote attackers to execute arbitrary client side script on vulnerable installations of Sophos Cyberoam firewall devices with firmware through 10.6.4. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of a request to the "LiveConnectionDetail.jsp" application. GET parameters "applicationname" and "username" are improperly sanitized allowing an attacker to inject arbitrary JavaScript into the page. This can be abused by an attacker to perform a cross-site scripting attack on the user. A vulnerable URI is /corporate/webpages/trafficdiscovery/LiveConnectionDetail.jsp.2017-06-07not yet calculatedCVE-2016-9834 MISCsophos -- sophos_web_appliance *The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342.2017-06-08not yet calculatedCVE-2017-9523 CONFIRMspiffy -- spiffyDirectory traversal vulnerability in Spiffy before 5.4.2017-06-07not yet calculatedCVE-2015-8235 CONFIRM MLIST BID MLISTstrongswan -- strongswan *The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers to cause a denial of service (infinite loop) via a crafted certificate.2017-06-08not yet calculatedCVE-2017-9023 DEBIAN BID UBUNTU CONFIRMstrongswan -- strongswan *The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers to cause a denial of service (floating point exception and process crash) via a crafted certificate.2017-06-08not yet calculatedCVE-2017-9022 DEBIAN BID UBUNTU CONFIRMsubsonic -- subsonic *XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted XSPF playlist file.2017-06-07not yet calculatedCVE-2017-9355 MISC MISCsymantec -- rar *Directory Traversal exists in RAR 4.x and 5.x because an unpack operation follows any symlinks, including symlinks contained in the archive. This allows remote attackers to write to arbitrary files via a crafted archive.2017-06-04not yet calculatedCVE-2014-9983 CONFIRMteampass -- teampass *TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php.2017-06-05not yet calculatedCVE-2017-9436 CONFIRMtera_term -- tera_termUntrusted search path vulnerability in the installer of Tera Term 4.94 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2193 JVN CONFIRMtky2jgd -- tky2jgd Untrusted search path vulnerability in TKY2JGD (TKY2JGD1379.EXE) ver. 1.3.79 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2017-2212 JVN CONFIRMtodokesho -- todokesho *Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 and earlier, Device data encryption program Ver. 1.00 and earlier, and TODOKESHO creation program Ver. 15.00 and earlier available prior to October 17, 2016 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.2017-06-09not yet calculatedCVE-2016-7818 CONFIRM CONFIRM CONFIRM CONFIRM JVNtorproject -- tor The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.2017-06-09not yet calculatedCVE-2017-0376 CONFIRM CONFIRM CONFIRMtorproject -- tor The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed BEGIN cell.2017-06-09not yet calculatedCVE-2017-0375 CONFIRM CONFIRM CONFIRMubuntu -- debian *In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.2017-06-09not yet calculatedCVE-2017-9525 MISC MISCvindula -- vindula *Cross-site scripting (XSS) vulnerability in Vindula 1.9.2017-06-07not yet calculatedCVE-2015-6959 MISCvmware -- esxi *VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have an uninitialized stack memory usage in SVGA. This issue may allow a guest to execute code on the host.2017-06-07not yet calculatedCVE-2017-4903 BID CONFIRMvmware -- esxi *The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 has uninitialized memory usage. This issue may allow a guest to execute code on the host. The issue is reduced to a Denial of Service of the guest on ESXi 5.5.2017-06-07not yet calculatedCVE-2017-4904 BID CONFIRMvmware -- esxi *VMware ESXi 6.5 without patch ESXi650-201703410-SG and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have a Heap Buffer Overflow in SVGA. This issue may allow a guest to execute code on the host.2017-06-07not yet calculatedCVE-2017-4902 BID CONFIRMvmware -- esxi *VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have uninitialized memory usage. This issue may lead to an information leak.2017-06-07not yet calculatedCVE-2017-4905 BID CONFIRMvmware -- horizon_view_clientVMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service startup script. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on the Mac OSX system where the client is installed.2017-06-08not yet calculatedCVE-2017-4918 CONFIRMvmware -- unified_access_gateway *VMware Unified Access Gateway (2.5.x, 2.7.x, 2.8.x prior to 2.8.1) and Horizon View (7.x prior to 7.1.0, 6.x prior to 6.2.4) contain a heap buffer-overflow vulnerability which may allow a remote attacker to execute code on the security gateway.2017-06-08not yet calculatedCVE-2017-4907 BID CONFIRMvmware -- vsphere_data_protection *VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.2017-06-07not yet calculatedCVE-2017-4914 BID CONFIRMvmware -- vsphere_data_protection *VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This issue may allow plaintext credentials to be obtained.2017-06-07not yet calculatedCVE-2017-4917 BID CONFIRMvmware -- workstation *VMware Workstation Pro/Player 12.x before 12.5.3 contains a NULL pointer dereference vulnerability that exists in the SVGA driver. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs.2017-06-07not yet calculatedCVE-2017-4900 BID CONFIRMvmware -- workstation *VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds read vulnerabilities in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.2017-06-08not yet calculatedCVE-2017-4910 BID CONFIRMvmware -- workstation *The drag-and-drop (DnD) function in VMware Workstation 12.x before version 12.5.4 and Fusion 8.x before version 8.5.5 has an out-of-bounds memory access vulnerability. This may allow a guest to execute code on the operating system that runs Workstation or Fusion.2017-06-08not yet calculatedCVE-2017-4901 BID CONFIRMvmware -- workstation *VMware Workstation Pro/Player 12.x before 12.5.3 contains a DLL loading vulnerability that occurs due to the "vmware-vmx" process loading DLLs from a path defined in the local environment-variable. Successful exploitation of this issue may allow normal users to escalate privileges to System in the host machine where VMware Workstation is installed.2017-06-07not yet calculatedCVE-2017-4898 BID CONFIRMvmware -- workstation *VMware Workstation Pro/Player 12.x before 12.5.3 contains a security vulnerability that exists in the SVGA driver. An attacker may exploit this issue to crash the VM or trigger an out-of-bound read. Note: This issue can be triggered only when the host has no graphics card or no graphics drivers are installed.2017-06-07not yet calculatedCVE-2017-4899 BID CONFIRMvmware -- workstation *VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds read vulnerabilities in TrueType Font (TTF) parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.2017-06-08not yet calculatedCVE-2017-4912 BID CONFIRMvmware -- workstation *VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple heap buffer-overflow vulnerabilities in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.2017-06-08not yet calculatedCVE-2017-4908 BID CONFIRMvmware -- workstation *VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds write vulnerabilities in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.2017-06-08not yet calculatedCVE-2017-4911 BID CONFIRMvmware -- workstation *VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain a heap buffer-overflow vulnerability in TrueType Font (TTF) parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.2017-06-08not yet calculatedCVE-2017-4909 BID CONFIRMvmware -- workstation *VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain an integer-overflow vulnerability in the True Type Font parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View.2017-06-08not yet calculatedCVE-2017-4913 BID CONFIRMwinsparkle -- winsparkle *Untrusted search path vulnerability in WinSparkle versions prior to 0.5.3 allows remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory.2017-06-09not yet calculatedCVE-2016-7838 CONFIRM JVN JVN CONFIRMwordpress -- live_chat_support *Cross-site scripting vulnerability in WP Live Chat Support prior to version 7.0.07 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.2017-06-09not yet calculatedCVE-2017-2187 JVN CONFIRMwordpress -- slideshowThe SlideshowPluginSlideshowStylesheet::loadStylesheet ByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to read arbitrary Wordpress option values.2017-06-08not yet calculatedCVE-2015-3634 MLIST BID CONFIRM CONFIRMwordpress -- spiffy_calendar *Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter.2017-06-05not yet calculatedCVE-2017-9420 MISC MISC BIDwordpress -- wordpress_backup_to_dropbox *Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress.2017-06-07not yet calculatedCVE-2014-9310 BID MISC CONFIRMyara -- yara *The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain sensitive information from process memory via a crafted file that is mishandled in the yr_re_fast_exec function in libyara/re.c and the _yr_scan_match_callback function in libyara/scan.c.2017-06-06not yet calculatedCVE-2017-9465 CONFIRM CONFIRMzencherry -- zcms SQL injection vulnerability in ZCMS 1.1.2017-06-07not yet calculatedCVE-2015-7346 MISC MISC EXPLOIT-DBzend -- zend_framework *Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers.2017-06-08not yet calculatedCVE-2015-1786 CONFIRM CONFIRMzulip -- zulip_server Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this.2017-06-02not yet calculatedCVE-2017-0896 MISC MLIST MISCBack to top This product is provided subject to this Notification and this Privacy & Use policy. More... 
|
| Sponsored Links |
     |
Linear Mode
