Search
Total
46623 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2016-5304 | 1 Symantec | 1 Endpoint Protection Manager | 2017-09-03 | 4.9 MEDIUM | 6.8 MEDIUM |
| Open redirect vulnerability in a report-routing component in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | |||||
| CVE-2016-3689 | 3 Canonical, Linux, Novell | 9 Ubuntu Linux, Linux Kernel, Suse Linux Enterprise Desktop and 6 more | 2017-09-03 | 4.9 MEDIUM | 4.6 MEDIUM |
| The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (system crash) via a USB device without both a master and a slave interface. | |||||
| CVE-2016-8025 | 1 Mcafee | 1 Virusscan Enterprise | 2017-09-03 | 6.0 MEDIUM | 6.2 MEDIUM |
| SQL injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to obtain product information via a crafted HTTP request parameter. | |||||
| CVE-2016-8018 | 1 Mcafee | 1 Virusscan Enterprise | 2017-09-03 | 6.0 MEDIUM | 4.3 MEDIUM |
| Cross-site request forgery (CSRF) vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to execute unauthorized commands via a crafted user input. | |||||
| CVE-2016-3619 | 1 Libtiff | 1 Libtiff | 2017-09-03 | 4.3 MEDIUM | 6.5 MEDIUM |
| The DumpModeEncode function in tif_dumpmode.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c none" option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image. | |||||
| CVE-2016-6897 | 1 Wordpress | 1 Wordpress | 2017-09-03 | 4.3 MEDIUM | 6.5 MEDIUM |
| Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896. | |||||
| CVE-2016-6503 | 1 Wireshark | 1 Wireshark | 2017-09-03 | 4.3 MEDIUM | 5.9 MEDIUM |
| The CORBA IDL dissectors in Wireshark 2.x before 2.0.5 on 64-bit Windows platforms do not properly interact with Visual C++ compiler options, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. | |||||
| CVE-2016-6504 | 1 Wireshark | 1 Wireshark | 2017-09-03 | 4.3 MEDIUM | 5.9 MEDIUM |
| epan/dissectors/packet-ncp2222.inc in the NDS dissector in Wireshark 1.12.x before 1.12.13 does not properly maintain a ptvc data structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet. | |||||
| CVE-2016-6505 | 1 Wireshark | 1 Wireshark | 2017-09-03 | 4.3 MEDIUM | 5.9 MEDIUM |
| epan/dissectors/packet-packetbb.c in the PacketBB dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted packet. | |||||
| CVE-2016-6512 | 1 Wireshark | 1 Wireshark | 2017-09-03 | 4.3 MEDIUM | 5.9 MEDIUM |
| epan/dissectors/packet-wap.c in Wireshark 2.x before 2.0.5 omits an overflow check in the tvb_get_guintvar function, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet, related to the MMSE, WAP, WBXML, and WSP dissectors. | |||||
| CVE-2016-0243 | 1 Ibm | 1 Websphere Portal | 2017-09-03 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-0244. | |||||
| CVE-2016-3652 | 1 Symantec | 1 Endpoint Protection Manager | 2017-09-03 | 3.5 LOW | 5.4 MEDIUM |
| Multiple cross-site scripting (XSS) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. | |||||
| CVE-2016-7851 | 1 Adobe | 1 Connect | 2017-09-03 | 4.3 MEDIUM | 6.1 MEDIUM |
| Adobe Connect version 9.5.6 and earlier does not adequately validate input in the events registration module. This vulnerability could be exploited in cross-site scripting attacks. | |||||
| CVE-2016-2976 | 1 Ibm | 1 Sametime | 2017-09-03 | 4.0 MEDIUM | 4.3 MEDIUM |
| IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting invitee to obtain previously cleared sensitive information by viewing the meeting report history. IBM X-Force ID: 113936. | |||||
| CVE-2016-2975 | 1 Ibm | 1 Sametime | 2017-09-03 | 3.5 LOW | 5.4 MEDIUM |
| IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113935. | |||||
| CVE-2016-2967 | 1 Ibm | 1 Sametime | 2017-09-03 | 3.5 LOW | 5.4 MEDIUM |
| IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Sametime away message altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 113848. | |||||
| CVE-2016-2966 | 1 Ibm | 1 Sametime | 2017-09-03 | 4.0 MEDIUM | 4.3 MEDIUM |
| IBM Sametime 8.5.1 and 9.0 could allow an authenticated user to enumerate meeting rooms by guessing the meeting room id. IBM X-Force ID: 113847. | |||||
| CVE-2016-2964 | 1 Ibm | 1 Sametime | 2017-09-03 | 5.0 MEDIUM | 5.3 MEDIUM |
| IBM Sametime 8.5.2 and 9.0 under certain conditions provides an error message to a user that is too detailed and may reveal details about the application. IBM X-Force ID: 113813. | |||||
| CVE-2016-8017 | 1 Mcafee | 1 Virusscan Enterprise | 2017-09-03 | 4.0 MEDIUM | 4.1 MEDIUM |
| Special element injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to read files on the webserver via a crafted user input. | |||||
| CVE-2016-1415 | 1 Cisco | 1 Webex Wrf Player T29 | 2017-09-03 | 4.3 MEDIUM | 5.5 MEDIUM |
| Cisco WebEx Meetings Player T29.10, when WRF file support is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted file, aka Bug ID CSCuz80455. | |||||
| CVE-2016-2980 | 1 Ibm | 1 Sametime | 2017-09-02 | 6.8 MEDIUM | 6.3 MEDIUM |
| The Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a vulnerability in the way that the WebPlayer works. IBM X-Force ID: 113993. | |||||
| CVE-2017-1443 | 1 Ibm | 1 Emptoris Services Procurement | 2017-09-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128109. | |||||
| CVE-2017-12856 | 1 C.p.sub Project | 1 C.p.sub | 2017-09-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in C.P.Sub 5.2 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter to index.php. | |||||
| CVE-2016-10503 | 1 Ibm | 1 Sametime | 2017-09-02 | 4.0 MEDIUM | 4.3 MEDIUM |
| IBM Sametime Meeting Server 8.5.2 and 9.0 could allow an authenticated and invited user of Sametime meeting to lower any or all hands in an e-meeting, thus spoofing results of votes in the meeting. IBM X-Force ID: 113803. | |||||
| CVE-2016-1370 | 1 Cisco | 2 Network Analysis Module, Network Analysis Module Software | 2017-09-02 | 5.0 MEDIUM | 5.3 MEDIUM |
| Cisco Prime Network Analysis Module (NAM) before 6.2(1-b) miscalculates IPv6 payload lengths, which allows remote attackers to cause a denial of service (mond process crash and monitoring outage) via crafted IPv6 packets, aka Bug ID CSCuy37324. | |||||
| CVE-2015-6942 | 1 Coremail | 1 Coremail Xt | 2017-09-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment. | |||||
| CVE-2015-6588 | 1 Modx | 1 Modx Revolution | 2017-09-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING. | |||||
| CVE-2016-9732 | 1 Ibm | 1 Curam Social Program Management | 2017-09-02 | 3.5 LOW | 5.4 MEDIUM |
| IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119761. | |||||
| CVE-2017-1110 | 1 Ibm | 1 Curam Social Program Management | 2017-09-02 | 4.0 MEDIUM | 6.5 MEDIUM |
| IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 contains an unspecified vulnerability that could allow an authenticated user to view the incidents of a higher privileged user. IBM X-Force ID: 120915. | |||||
| CVE-2017-1195 | 1 Ibm | 1 Curam Social Program Management | 2017-09-02 | 5.8 MEDIUM | 6.1 MEDIUM |
| IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 123670. | |||||
| CVE-2017-7693 | 1 Riverbed | 1 Opnet App Response Xpert | 2017-09-02 | 6.8 MEDIUM | 6.5 MEDIUM |
| Directory traversal vulnerability in viewer_script.jsp in Riverbed OPNET App Response Xpert (ARX) version 9.6.1 allows remote authenticated users to inject arbitrary commands to read OS files. | |||||
| CVE-2017-14037 | 1 Crushftp | 1 Crushftp | 2017-09-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability. | |||||
| CVE-2017-10791 | 1 Gnu | 1 Pspp | 2017-09-02 | 4.3 MEDIUM | 6.5 MEDIUM |
| There is an Integer overflow in the hash_int function of the libpspp library in GNU PSPP before 0.11.0. For example, a crash was observed within the library code when attempting to convert invalid SPSS data into CSV format. A crafted input will lead to a remote denial of service attack. | |||||
| CVE-2017-10792 | 1 Gnu | 1 Pspp | 2017-09-02 | 4.3 MEDIUM | 6.5 MEDIUM |
| There is a NULL Pointer Dereference in the function ll_insert() of the libpspp library in GNU PSPP before 0.11.0. For example, a crash was observed within the library code when attempting to convert invalid SPSS data into CSV format. A crafted input will lead to a remote denial of service attack. | |||||
| CVE-2017-12919 | 1 Libfpx Project | 1 Libfpx | 2017-09-01 | 4.3 MEDIUM | 6.5 MEDIUM |
| Heap-based buffer overflow in OLEStream::WriteVT_LPSTR in olestrm.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service via a crafted fpx image. | |||||
| CVE-2017-12920 | 1 Libfpx Project | 1 Libfpx | 2017-09-01 | 4.3 MEDIUM | 6.5 MEDIUM |
| CDirectory::GetDirEntry in dir.cxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image. | |||||
| CVE-2017-12921 | 1 Libfpx Project | 1 Libfpx | 2017-09-01 | 4.3 MEDIUM | 6.5 MEDIUM |
| PFileFlashPixView::GetGlobalInfoProperty in f_fpxvw.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image. | |||||
| CVE-2017-12922 | 1 Libfpx Project | 1 Libfpx | 2017-09-01 | 4.3 MEDIUM | 6.5 MEDIUM |
| wchar.c in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image. | |||||
| CVE-2017-12924 | 1 Libfpx Project | 1 Libfpx | 2017-09-01 | 4.3 MEDIUM | 6.5 MEDIUM |
| CDirVector::GetTable in dirfunc.hxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted fpx image. | |||||
| CVE-2017-12923 | 1 Libfpx Project | 1 Libfpx | 2017-09-01 | 4.3 MEDIUM | 6.5 MEDIUM |
| OLEStream::WriteVT_LPSTR in olestrm.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image. | |||||
| CVE-2017-13762 | 1 Onosproject | 1 Onos | 2017-09-01 | 4.3 MEDIUM | 6.1 MEDIUM |
| ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS. | |||||
| CVE-2017-3150 | 1 Apache | 1 Atlas | 2017-09-01 | 4.3 MEDIUM | 6.1 MEDIUM |
| Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script. | |||||
| CVE-2017-14036 | 1 Crushftp | 1 Crushftp | 2017-09-01 | 4.3 MEDIUM | 6.1 MEDIUM |
| CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS. | |||||
| CVE-2017-14038 | 1 Crushftp | 1 Crushftp | 2017-09-01 | 5.8 MEDIUM | 6.1 MEDIUM |
| CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability. | |||||
| CVE-2013-7431 | 1 Mapsplugin | 1 Googlemaps | 2017-09-01 | 5.0 MEDIUM | 5.3 MEDIUM |
| Full path disclosure in the Googlemaps plugin before 3.1 for Joomla!. | |||||
| CVE-2013-7433 | 1 Mapsplugin | 1 Googlemaps | 2017-09-01 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in the Googlemaps plugin before 3.1 for Joomla!. | |||||
| CVE-2017-10838 | 1 Seopanel | 1 Seo Panel | 2017-09-01 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting vulnerability in SEO Panel prior to version 3.11.0 allows an attacker to inject arbitrary web script or HTML via unspecified vectors. | |||||
| CVE-2017-1485 | 1 Ibm | 1 Cognos Analytics | 2017-09-01 | 3.5 LOW | 5.4 MEDIUM |
| IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128623. | |||||
| CVE-2015-2046 | 1 Mantisbt | 1 Mantisbt | 2017-09-01 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20. | |||||
| CVE-2014-9469 | 1 Vbulletin | 1 Vbulletin | 2017-09-01 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3. | |||||