Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2016-8007 | 1 Mcafee | 1 Host Intrusion Prevention Services | 2017-03-23 | 3.0 LOW | 6.3 MEDIUM |
| Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services (HIPS) 8.0 Patch 7 and earlier allows authenticated users to manipulate the product's registry keys via specific conditions. | |||||
| CVE-2015-8987 | 1 Mcafee | 1 Agent | 2017-03-23 | 3.5 LOW | 5.3 MEDIUM |
| Man-in-the-middle (MitM) attack vulnerability in non-Mac OS agents in McAfee (now Intel Security) Agent (MA) 4.8.0 patch 2 and earlier allows attackers to make a McAfee Agent talk with another, possibly rogue, ePO server via McAfee Agent migration to another ePO server. | |||||
| CVE-2015-8986 | 1 Mcafee | 1 Advanced Threat Defense | 2017-03-23 | 4.3 MEDIUM | 5.5 MEDIUM |
| Sandbox detection evasion vulnerability in hardware appliances in McAfee (now Intel Security) Advanced Threat Defense (MATD) 3.4.2.32 and earlier allows attackers to detect the sandbox environment, then bypass proper malware detection resulting in failure to detect a malware file (false-negative) via specially crafted malware. | |||||
| CVE-2017-6550 | 1 Kinsey | 1 Infor-lawson | 2017-03-23 | 7.5 HIGH | 9.8 CRITICAL |
| Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitrary SQL commands via the (1) TABLE parameter to esbus/servlet/GetSQLData or (2) QUERY parameter to KK_LS9ReportingPortal/GetData. | |||||
| CVE-2017-6805 | 1 Mobatek | 1 Mobaxterm | 2017-03-23 | 5.0 MEDIUM | 5.3 MEDIUM |
| Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read arbitrary files via a .. (dot dot) in a GET command. | |||||
| CVE-2017-7222 | 1 Mantisbt | 1 Mantisbt | 2017-03-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by modifying 'window_title' in the application configuration. This requires privileged access to MantisBT configuration management pages (i.e., administrator access rights) or altering the system configuration file (config_inc.php). | |||||
| CVE-2016-8973 | 1 Ibm | 1 Rational Rhapsody Design Manager | 2017-03-23 | 4.0 MEDIUM | 4.3 MEDIUM |
| IBM Rhapsody DM 4.0, 5.0 and 6.0 contains an undisclosed vulnerability that may allow an authenticated user to upload infected malicious files to the server. IBM Reference #: 1999960. | |||||
| CVE-2016-9694 | 1 Ibm | 1 Rational Rhapsody Design Manager | 2017-03-23 | 3.5 LOW | 5.4 MEDIUM |
| IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999960. | |||||
| CVE-2016-9696 | 1 Ibm | 1 Rational Rhapsody Design Manager | 2017-03-23 | 3.5 LOW | 5.4 MEDIUM |
| IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM Reference #: 1999960. | |||||
| CVE-2016-9697 | 1 Ibm | 1 Rational Rhapsody Design Manager | 2017-03-23 | 2.1 LOW | 3.1 LOW |
| An unspecified vulnerability in IBM Rhapsody DM 4.0, 5.0, and 6.0 could allow an attacker to perform a JSON Hijacking Attack. A JSON Hijacking Attack may expose to an attacker information passed between the server and the browser. IBM Reference #: 1999960. | |||||
| CVE-2017-1146 | 1 Ibm | 1 Content Navigator | 2017-03-23 | 3.5 LOW | 5.4 MEDIUM |
| IBM Content Navigator 2.0.3 and 3.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999736. | |||||
| CVE-2016-2981 | 1 Ibm | 1 Rational Collaborative Lifecycle Management | 2017-03-23 | 2.1 LOW | 6.8 MEDIUM |
| An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. IBM Reference #: 1999965. | |||||
| CVE-2016-2406 | 1 Huawei | 1 Document Security Management | 2017-03-23 | 4.0 MEDIUM | 4.3 MEDIUM |
| The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users to obtain sensitive information from encrypted documents by leveraging incorrect control of permissions on the PrintScreen button. | |||||
| CVE-2015-1610 | 1 Opendaylight | 1 L2switch | 2017-03-23 | 5.0 MEDIUM | 5.3 MEDIUM |
| hosttracker in OpenDaylight l2switch allows remote attackers to change the host location information by spoofing the MAC address, aka "topology spoofing." | |||||
| CVE-2016-4931 | 1 Juniper | 1 Junos Space | 2017-03-22 | 4.0 MEDIUM | 6.5 MEDIUM |
| XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service. | |||||
| CVE-2016-4930 | 1 Juniper | 1 Junos Space | 2017-03-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in Junos Space before 15.2R2 allows remote attackers to steal sensitive information or perform certain administrative actions. | |||||
| CVE-2016-4928 | 1 Juniper | 1 Junos Space | 2017-03-22 | 6.8 MEDIUM | 8.8 HIGH |
| Cross site request forgery vulnerability in Junos Space before 15.2R2 allows remote attackers to perform certain administrative actions on Junos Space. | |||||
| CVE-2016-4927 | 1 Juniper | 1 Junos Space | 2017-03-22 | 6.8 MEDIUM | 8.1 HIGH |
| Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle (MITM) type of attacks while a Space device is communicating with managed devices. | |||||
| CVE-2016-4926 | 1 Juniper | 1 Junos Space | 2017-03-22 | 7.5 HIGH | 9.8 CRITICAL |
| Insufficient authentication vulnerability in Junos Space before 15.2R2 allows remote network based users with access to Junos Space web interface to perform certain administrative tasks without authentication. | |||||
| CVE-2014-9939 | 1 Gnu | 1 Binutils | 2017-03-22 | 7.5 HIGH | 9.8 CRITICAL |
| ihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects. | |||||
| CVE-2015-8983 | 1 Gnu | 1 Glibc | 2017-03-22 | 6.8 MEDIUM | 8.1 HIGH |
| Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow. | |||||
| CVE-2015-8984 | 1 Gnu | 1 Glibc | 2017-03-22 | 4.3 MEDIUM | 5.9 MEDIUM |
| The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern, which triggers an out-of-bounds read. | |||||
| CVE-2016-4929 | 1 Juniper | 1 Junos Space | 2017-03-22 | 9.0 HIGH | 8.8 HIGH |
| Command injection vulnerability in Junos Space before 15.2R2 allows attackers to execute arbitrary code as a root user. | |||||
| CVE-2017-6908 | 1 Concrete5 | 1 Concrete5 | 2017-03-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (fID) passed to the "concrete5-legacy-master/web/concrete/tools/files/selector_data.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. | |||||
| CVE-2015-8989 | 1 Mcafee | 1 Vulnerability Manager | 2017-03-22 | 4.0 MEDIUM | 8.8 HIGH |
| Unsalted password vulnerability in the Enterprise Manager (web portal) component in Intel Security McAfee Vulnerability Manager (MVM) 7.5.8 and earlier allows attackers to more easily decrypt user passwords via brute force attacks against the database. | |||||
| CVE-2016-9985 | 1 Ibm | 1 Cognos Business Intelligence | 2017-03-22 | 2.1 LOW | 5.5 MEDIUM |
| IBM Cognos Server 10.1.1 and 10.2 stores highly sensitive information in log files that could be read by a local user. IBM Reference #: 1999671. | |||||
| CVE-2015-8981 | 1 Podofo Project | 1 Podofo | 2017-03-21 | 7.5 HIGH | 9.8 CRITICAL |
| Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size. | |||||
| CVE-2017-5537 | 1 Weblate | 1 Weblate | 2017-03-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests. | |||||
| CVE-2017-3871 | 1 Cisco | 1 Prime Optical | 2017-03-21 | 4.0 MEDIUM | 4.3 MEDIUM |
| A RADIUS Secret Disclosure vulnerability in the web network management interface of Cisco Prime Optical for Service Providers could allow an authenticated, remote attacker to disclose sensitive information in the configuration generated for a device. The attacker must have valid credentials for the device. More Information: CSCvc65257. Known Affected Releases: 10.6(0.1). | |||||
| CVE-2017-6880 | 1 Cerberus | 1 Cerberus Ftp Server | 2017-03-21 | 7.5 HIGH | 9.8 CRITICAL |
| Buffer overflow in Cerberus FTP Server 8.0.10.3 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long MLST command. | |||||
| CVE-2017-5358 | 1 Easycom-aura | 1 Easycom For Php | 2017-03-21 | 7.5 HIGH | 9.8 CRITICAL |
| Stack-based buffer overflows in php_Easycom5_3_0.dll in EasyCom for PHP 4.0.0.29 allows remote attackers to execute arbitrary code via the server argument to the (1) i5_connect, (2) i5_pconnect, or (3) i5_private_connect API function. | |||||
| CVE-2016-8855 | 1 Sitecore | 1 Experience Platform | 2017-03-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience Platform 8.1 rev. 160519 (8.1 Update-3) allows remote attacks via the Name or Description parameter. This is fixed in 8.2 Update-2. | |||||
| CVE-2016-5803 | 1 Ca Technologies | 1 Unified Infrastructure Management | 2017-03-21 | 7.5 HIGH | 8.6 HIGH |
| An issue was discovered in CA Unified Infrastructure Management Version 8.47 and earlier. The Unified Infrastructure Management software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. | |||||
| CVE-2017-5228 | 1 Rapid7 | 1 Metasploit | 2017-03-21 | 5.1 MEDIUM | 7.1 HIGH |
| All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance. | |||||
| CVE-2017-5229 | 1 Rapid7 | 1 Metasploit | 2017-03-21 | 5.1 MEDIUM | 7.1 HIGH |
| All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi Clipboard.parse_dump() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance. | |||||
| CVE-2017-5231 | 1 Rapid7 | 1 Metasploit | 2017-03-21 | 5.1 MEDIUM | 7.1 HIGH |
| All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cmd_download() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance. | |||||
| CVE-2017-5232 | 1 Rapid7 | 1 Nexpose | 2017-03-21 | 6.8 MEDIUM | 7.8 HIGH |
| All editions of Rapid7 Nexpose installers prior to version 6.4.24 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer. | |||||
| CVE-2017-6510 | 1 Efssoft | 1 Easy File Sharing Ftp Server | 2017-03-21 | 5.0 MEDIUM | 7.5 HIGH |
| Easy File Sharing FTP Server version 3.6 is vulnerable to a directory traversal vulnerability which allows an attacker to list and download any file from any folder outside the FTP root Directory. | |||||
| CVE-2017-6591 | 1 Django-epiceditor Project | 1 Django-epiceditor | 2017-03-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field. | |||||
| CVE-2015-7313 | 1 Libtiff | 1 Libtiff | 2017-03-20 | 4.3 MEDIUM | 5.5 MEDIUM |
| LibTIFF allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted tiff file. | |||||
| CVE-2014-8701 | 1 Wondercms | 1 Wondercms | 2017-03-20 | 5.0 MEDIUM | 7.5 HIGH |
| Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password. | |||||
| CVE-2017-6962 | 1 Apng2gif Project | 1 Apng2gif | 2017-03-20 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in apng2gif 1.7. There is an integer overflow resulting in a heap-based buffer overflow. This is related to the read_chunk function making an unchecked addition of 12. | |||||
| CVE-2015-3882 | 1 Qdpm | 1 Qdpm | 2017-03-20 | 5.0 MEDIUM | 5.3 MEDIUM |
| qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in an error message. | |||||
| CVE-2016-10187 | 1 Calibre-ebook | 1 Calibre | 2017-03-20 | 4.3 MEDIUM | 5.5 MEDIUM |
| The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript. | |||||
| CVE-2014-8703 | 1 Wondercms | 1 Wondercms | 2017-03-20 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in Wonder CMS 2014 allows remote attackers to inject arbitrary web script or HTML. | |||||
| CVE-2014-8704 | 1 Wondercms | 1 Wondercms | 2017-03-20 | 7.5 HIGH | 9.8 CRITICAL |
| Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme. | |||||
| CVE-2017-6961 | 1 Apng2gif Project | 1 Apng2gif | 2017-03-20 | 4.3 MEDIUM | 5.5 MEDIUM |
| An issue was discovered in apng2gif 1.7. There is improper sanitization of user input causing huge memory allocations, resulting in a crash. This is related to the read_chunk function using the pChunk->size value (within the PNG file) to determine the amount of memory to allocate. | |||||
| CVE-2014-8705 | 1 Wondercms | 1 Wondercms | 2017-03-20 | 7.5 HIGH | 9.8 CRITICAL |
| PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter. | |||||
| CVE-2014-8708 | 1 Pluck-cms | 1 Pluck | 2017-03-20 | 7.5 HIGH | 9.8 CRITICAL |
| Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature. | |||||
| CVE-2015-3881 | 1 Qdpm | 1 Qdpm | 2017-03-20 | 5.0 MEDIUM | 7.5 HIGH |
| Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) core/log/qdPM_prod.log, or (3) core/apps/qdPM/config/settings.yml. | |||||