CVEs published in April 2017
1,561 vulnerabilities, 194 critical, 7 exploited.
- apache tomcatExposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat7.5 High
- mantisbtMantisBT allows arbitrary password reset8.8 High
- mediawiki, debian linux +1 moreSpam blacklist ineffective on encoded URLs inside file inclusion syntax's link parameter5.3 Medium
- mediawiki, debian linux +1 moreSysops can undelete pages, although the page is protected against it6.5 Medium
- mediawiki, debian linux +1 moreMake rawHTML mode not apply to system messages5.3 Medium
- mediawiki, debian linux +1 moreSVG filter evasion using default attribute values in DTD declaration5.4 Medium
- mediawiki, debian linux +1 moreXSS in SearchHighlighter::highlightText() [requires non-default config]4.7 Medium
- mediawiki, debian linux +1 moreSpecial:Search allows redirects to any interwiki link6.1 Medium
- mediawiki, debian linux +1 moreSpecial:UserLogin?returnto=interwiki:foo will redirect to external sites6.1 Medium
- mediawiki, debian linux +1 more"Mark all pages visited" on the watchlist does not require a CSRF token8.8 High
- mediawiki, debian linux +1 moreapi.log contains passwords in plaintext7.8 High
- debian linux, linux kernel, canonical ubuntu linux +2 moreThe mm subsystem in the Linux kernel through 3.2 does not properly enforce the...7.8 High
- artifex jbig2decArtifex jbig2dec 0.13 has a heap-based buffer over-read leading to denial of service (application...7.1 High
- unshield project unshieldDirectory traversal vulnerability in unshield 1.0-1.7.5 High
- libreofficeLibreOffice before 2017-03-14 has an out-of-bounds write related to the HWPFile::TagsRead...9.8 Critical
- bigtreecms bigtree cmsBigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote...8.8 High
- flatcore flatcore-cmsSQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content...7.5 High
- flatcore flatcore-cmsSQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read and write to the...9.8 Critical
- flatcore flatcore-cmsCSRF vulnerability in flatCore version 1.4.6 allows remote attackers to modify CMS configurations.8.8 High
- feh project fehIn wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager...9.8 Critical
- tdm project tdmtrollepierre/tdm before 2017-04-13 is vulnerable to a reflected XSS in tdm-master/webhook.php ...6.1 Medium
- sap netweaver application server javaSQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP...8.8 High
- sap sso authentication librarySAP AS JAVA SSO Authentication Library 2.0 through 3.0 allow remote attackers to cause a denial...7.5 High
- proxifierProxifier for Mac before 2.19.2, when first run, allows local users to gain privileges by...7.8 High
- atlassian hipchat serverHipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level...9.1 Critical
- zurmo crmZurmo 3.1.1 Stable allows a Cross-Site Scripting (XSS) attack with a base64-encoded SCRIPT...5.4 Medium
- quest privilege managerpmmasterd in Quest Privilege Manager before 6.0.0.061, when configured as a policy server, allows...7.2 High
- redhat quickstart cloud installerThe web interface in Red Hat QuickStart Cloud Installer (QCI) 1.0 does not mask passwords fields,...4.6 Medium
- fasterxml jackson-dataformat-xmljackson-dataformat-xml vulnerable to server side request forgery (SSRF)8.6 High
- fedoraproject fedora, mock project scm plugin +1 moreThe scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism...7.8 High
- symantec messaging gatewayDirectory traversal vulnerability in the charting component in Symantec Messaging Gateway before...6.5 Medium
- symantec advanced threat protection, csapi, email security.cloud +12 more +14 moreThe RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat...5.5 Medium
- symantec advanced threat protection, csapi, email security.cloud +12 more +14 moreThe RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat...5.5 Medium
- zohocorp servicedesk plusZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies,...5.3 Medium
- zohocorp servicedesk plusZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have...8.8 High
- zohocorp servicedesk plusCross-site scripting (XSS) vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows...5.4 Medium
- assist project pluginMultiple cross-site scripting (XSS) vulnerabilities in the IVYWE (1) Assist plugin before 1.1.2...6.1 Medium
- redhat subscription-manager, enterprise linux desktop, enterprise linux hpc node +2 more +4 moreThe Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses...3.3 Low
- mongodbmongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a...7.5 High
- vtiger crmUnrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in...7.3 High
- ibm spectrum lsfIBM Platform LSF 10.1 contains an unspecified vulnerability that could allow a local user to...8.8 High
- ibm financial transaction managerIBM Financial Transaction Manager 3.0.1 and 3.0.2 does not properly update the SESSIONID with...4.3 Medium
- ibm tivoli application dependency discovery managerIBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site...5.4 Medium
- ibm tivoli application dependency discovery managerIBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker...4.3 Medium
- ibm tivoli application dependency discovery managerIBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker...6.5 Medium
- wolfcms wolf cmsWolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin...8.8 High
- wolfcms wolf cmsWolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin...8.8 High
- proxifierProxifier for Mac before 2.19 allows local users to gain privileges via the first parameter to...7.8 High
- moxa mx-aopc serverXML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file...5.0 Medium
- moxa mxviewMoxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk...7.5 High
- Show moreLoading…