Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-17508 | 1 Hdfgroup | 1 Hdf5 | 2017-12-19 | 4.3 MEDIUM | 6.5 MEDIUM |
| In HDF5 1.10.1, there is a divide-by-zero vulnerability in the function H5T_set_loc in the H5T.c file in libhdf5.a. For example, h5dump would crash when someone opens a crafted hdf5 file. | |||||
| CVE-2017-17509 | 1 Hdfgroup | 1 Hdf5 | 2017-12-19 | 6.8 MEDIUM | 8.8 HIGH |
| In HDF5 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in libhdf5.a. For example, h5dump would crash or possibly have unspecified other impact someone opens a crafted hdf5 file. | |||||
| CVE-2017-10861 | 1 Qualitysoft | 1 Qnd Advance\/standard | 2017-12-19 | 6.4 MEDIUM | 9.1 CRITICAL |
| Directory traversal vulnerability in QND Advance/Standard allows an attacker to read arbitrary files via a specially crafted command. | |||||
| CVE-2017-16893 | 1 Piwigo | 1 Piwigo | 2017-12-19 | 4.0 MEDIUM | 6.5 MEDIUM |
| The application Piwigo is affected by an SQL injection vulnerability in version 2.9.2 and possibly prior. This vulnerability allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. tags.php is affected: values of the edit_list parameters are not sanitized; these are used to construct an SQL query and retrieve a list of registered users into the application. | |||||
| CVE-2017-17059 | 1 Amtythumb Project | 1 Amtythumb | 2017-12-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to amtyThumbPostsAdminPg.php. | |||||
| CVE-2017-14516 | 1 Sap | 1 Businessobjects Financial Consolidation | 2017-12-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-Site Scripting (XSS) exists in SAP Business Objects Financial Consolidation before 2017-06-13, aka SAP Security Note 2422292. | |||||
| CVE-2017-1000214 | 1 Gitphp Project | 1 Gitphp | 2017-12-19 | 10.0 HIGH | 9.8 CRITICAL |
| GitPHP by xiphux is vulnerable to OS Command Injections | |||||
| CVE-2017-0879 | 1 Google | 1 Android | 2017-12-19 | 8.5 HIGH | 9.1 CRITICAL |
| An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65025028. | |||||
| CVE-2017-14377 | 1 Rsa | 1 Authentication Agent For Web | 2017-12-19 | 7.5 HIGH | 9.8 CRITICAL |
| EMC RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618 have a security vulnerability that could potentially lead to authentication bypass. | |||||
| CVE-2017-1482 | 1 Ibm | 1 Sterling B2b Integrator | 2017-12-19 | 3.5 LOW | 5.4 MEDIUM |
| IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128620. | |||||
| CVE-2017-1481 | 1 Ibm | 1 Sterling B2b Integrator | 2017-12-19 | 4.0 MEDIUM | 4.3 MEDIUM |
| IBM Sterling B2B Integrator Standard Edition 5.2 allows a user to view sensitive information that belongs to another user. IBM X-Force ID: 128619. | |||||
| CVE-2017-1465 | 1 Ibm | 1 Tririga Application Platform | 2017-12-19 | 3.5 LOW | 5.4 MEDIUM |
| IBM TRIRIGA 3.2, 3.3, 3.4, and 3.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 128464. | |||||
| CVE-2017-1498 | 1 Ibm | 1 Connections | 2017-12-19 | 3.5 LOW | 5.4 MEDIUM |
| IBM Connections 5.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 129020. | |||||
| CVE-2017-0876 | 1 Google | 1 Android | 2017-12-19 | 9.3 HIGH | 8.8 HIGH |
| A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-64964675. | |||||
| CVE-2017-0877 | 1 Google | 1 Android | 2017-12-19 | 9.3 HIGH | 8.8 HIGH |
| A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-66372937. | |||||
| CVE-2017-0878 | 1 Google | 1 Android | 2017-12-19 | 9.3 HIGH | 8.8 HIGH |
| A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 8.0. Android ID A-65186291. | |||||
| CVE-2017-0872 | 1 Google | 1 Android | 2017-12-19 | 9.3 HIGH | 8.8 HIGH |
| A remote code execution vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65290323. | |||||
| CVE-2017-0873 | 1 Google | 1 Android | 2017-12-19 | 7.1 HIGH | 6.5 MEDIUM |
| A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63316255. | |||||
| CVE-2017-0874 | 1 Google | 1 Android | 2017-12-19 | 7.1 HIGH | 6.5 MEDIUM |
| A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63315932. | |||||
| CVE-2017-1271 | 1 Ibm | 1 Security Guardium | 2017-12-19 | 5.0 MEDIUM | 7.5 HIGH |
| IBM Security Guardium 9.0, 9.1, and 9.5 supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. IBM X-Force ID: 124746. | |||||
| CVE-2017-1342 | 1 Ibm | 1 Insights Foundation For Energy | 2017-12-19 | 4.0 MEDIUM | 4.3 MEDIUM |
| IBM Insights Foundation for Energy 2.0 could reveal sensitive information in error messages to authenticated users that could e used to conduct further attacks. IBM X-Force ID: 126457. | |||||
| CVE-2017-1353 | 1 Ibm | 1 Atlas Ediscovery Process Management | 2017-12-19 | 3.5 LOW | 3.5 LOW |
| IBM Atlas eDiscovery Process Management 6.0.3 could allow an authenticated attacker to obtain sensitive information when an unsuspecting user clicks on unsafe third-party links. IBM X-Force ID: 126680. | |||||
| CVE-2017-1354 | 1 Ibm | 1 Atlas Ediscovery Process Management | 2017-12-19 | 3.5 LOW | 5.4 MEDIUM |
| IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126681. | |||||
| CVE-2017-1355 | 1 Ibm | 1 Atlas Ediscovery Process Management | 2017-12-19 | 4.3 MEDIUM | 3.7 LOW |
| IBM Atlas eDiscovery Process Management 6.0.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 126682. | |||||
| CVE-2017-1356 | 1 Ibm | 1 Atlas Ediscovery Process Management | 2017-12-19 | 6.5 MEDIUM | 8.8 HIGH |
| IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 126683. | |||||
| CVE-2017-13149 | 1 Google | 1 Android | 2017-12-19 | 8.5 HIGH | 9.1 CRITICAL |
| An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65719872. | |||||
| CVE-2017-13175 | 1 Google | 1 Android | 2017-12-19 | 5.0 MEDIUM | 7.5 HIGH |
| An information disclosure vulnerability in the NVIDIA libwilhelm. Product: Android. Versions: Android kernel. Android ID A-64339309. References: N-CVE-2017-13175. | |||||
| CVE-2017-13169 | 1 Google | 1 Android | 2017-12-19 | 5.0 MEDIUM | 7.5 HIGH |
| An information disclosure vulnerability in the kernel camera server. Product: Android. Versions: Android kernel. Android ID A-37512375. | |||||
| CVE-2017-13150 | 1 Google | 1 Android | 2017-12-19 | 8.5 HIGH | 9.1 CRITICAL |
| An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-38328132. | |||||
| CVE-2017-16856 | 1 Atlassian | 1 Confluence | 2017-12-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in various rss properties which were used as links without restriction on their scheme. | |||||
| CVE-2017-13164 | 1 Google | 1 Android | 2017-12-19 | 5.0 MEDIUM | 7.5 HIGH |
| An information disclosure vulnerability in the kernel binder driver. Product: Android. Versions: Android kernel. Android ID A-36007193. | |||||
| CVE-1999-0757 | 1 Allaire | 1 Coldfusion Server | 2017-12-19 | 2.1 LOW | N/A |
| The ColdFusion CFCRYPT program for encrypting CFML templates has weak encryption, allowing attackers to decrypt the templates. | |||||
| CVE-1999-0805 | 1 Novell | 1 Netware | 2017-12-19 | 5.0 MEDIUM | N/A |
| Novell NetWare Transaction Tracking System (TTS) in Novell 4.11 and earlier allows remote attackers to cause a denial of service via a large number of requests. | |||||
| CVE-1999-0919 | 1 Motorola | 1 Motorola Cablerouter | 2017-12-19 | 10.0 HIGH | N/A |
| A memory leak in a Motorola CableRouter allows remote attackers to conduct a denial of service via a large number of telnet connections. | |||||
| CVE-1999-0970 | 1 Omnicron | 1 Omnihttpd | 2017-12-19 | 5.0 MEDIUM | N/A |
| The OmniHTTPD visadmin.exe program allows a remote attacker to conduct a denial of service via a malformed URL which causes a large number of temporary files to be created. | |||||
| CVE-1999-1020 | 1 Novell | 1 Netware | 2017-12-19 | 7.5 HIGH | N/A |
| The installation of Novell Netware NDS 5.99 provides an unauthenticated client with Read access for the tree, which allows remote attackers to access sensitive information such as users, groups, and readable objects via CX.EXE and NLIST.EXE. | |||||
| CVE-1999-1022 | 1 Sgi | 1 Irix | 2017-12-19 | 6.2 MEDIUM | N/A |
| serial_ports administrative program in IRIX 4.x and 5.x trusts the user's PATH environmental variable to find and execute the ls program, which allows local users to gain root privileges via a Trojan horse ls program. | |||||
| CVE-1999-1029 | 1 Ssh | 1 Ssh2 | 2017-12-19 | 7.5 HIGH | N/A |
| SSH server (sshd2) before 2.0.12 does not properly record login attempts if the connection is closed before the maximum number of tries, allowing a remote attacker to guess the password without showing up in the audit logs. | |||||
| CVE-1999-1046 | 1 Ipswitch | 1 Imail | 2017-12-19 | 10.0 HIGH | N/A |
| Buffer overflow in IMonitor in IMail 5.0 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long string to port 8181. | |||||
| CVE-1999-1050 | 1 Matt Wright | 1 Formhandler.cgi | 2017-12-19 | 5.0 MEDIUM | N/A |
| Directory traversal vulnerability in Matt Wright FormHandler.cgi script allows remote attackers to read arbitrary files via (1) a .. (dot dot) in the reply_message_attach attachment parameter, or (2) by specifying the filename as a template. | |||||
| CVE-1999-1058 | 1 Arcane Software | 1 Vermillion Ftp Daemon | 2017-12-19 | 7.5 HIGH | N/A |
| Buffer overflow in Vermillion FTP Daemon VFTPD 1.23 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via several long CWD commands. | |||||
| CVE-1999-1061 | 1 Hp | 1 Jetdirect | 2017-12-19 | 7.5 HIGH | N/A |
| HP Laserjet printers with JetDirect cards, when configured with TCP/IP, can be configured without a password, which allows remote attackers to connect to the printer and change its IP address or disable logging. | |||||
| CVE-1999-1062 | 1 Hp | 1 Jetdirect | 2017-12-19 | 7.5 HIGH | N/A |
| HP Laserjet printers with JetDirect cards, when configured with TCP/IP, allow remote attackers to bypass print filters by directly sending PostScript documents to TCP ports 9099 and 9100. | |||||
| CVE-1999-1063 | 1 Cdomain | 1 Cdomainfree | 2017-12-19 | 10.0 HIGH | N/A |
| CDomain whois_raw.cgi whois CGI script allows remote attackers to execute arbitrary commands via shell metacharacters in the fqdn parameter. | |||||
| CVE-1999-1069 | 1 Icat | 1 Electronic Commerce Suite | 2017-12-19 | 5.0 MEDIUM | N/A |
| Directory traversal vulnerability in carbo.dll in iCat Carbo Server 3.0.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the icatcommand parameter. | |||||
| CVE-1999-1071 | 1 Excite | 1 Ews | 2017-12-19 | 7.2 HIGH | N/A |
| Excite for Web Servers (EWS) 1.1 installs the Architext.conf authentication file with world-writeable permissions, which allows local users to gain access to Excite accounts by modifying the file. | |||||
| CVE-1999-1081 | 1 Novell | 1 Web Server | 2017-12-19 | 5.0 MEDIUM | N/A |
| Vulnerability in files.pl script in Novell WebServer Examples Toolkit 2 allows remote attackers to read arbitrary files. | |||||
| CVE-1999-1091 | 2 Rtin, Tin | 2 Rtin, Tin | 2017-12-19 | 5.0 MEDIUM | N/A |
| UNIX news readers tin and rtin create the /tmp/.tin_log file with insecure permissions and follow symlinks, which allows attackers to modify the permissions of files writable by the user via a symlink attack. | |||||
| CVE-1999-1096 | 1 Kde | 1 Kde | 2017-12-19 | 7.2 HIGH | N/A |
| Buffer overflow in kscreensaver in KDE klock allows local users to gain root privileges via a long HOME environmental variable. | |||||
| CVE-2001-0642 | 1 Incredimail | 1 Incredimail | 2017-12-19 | 2.1 LOW | N/A |
| Directory traversal vulnerability in IncrediMail version 1400185 and earlier allows local users to overwrite files on the local hard drive by appending .. (dot dot) sequences to filenames listed in the content.ini file. | |||||