CVEs published in April 2017
1,561 vulnerabilities, 194 critical, 7 exploited.
- information-technology promotion agency, japan (ipa) hands-on vulnerability learning tool "appgoat" for web application, ipa appgoat +1 moreHands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.1 and earlier allows...6.3 Medium
- information-technology promotion agency, japan (ipa) hands-on vulnerability learning tool "appgoat" for web application, ipa appgoat +1 moreHands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows...6.3 Medium
- cubecartDirectory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated...6.5 Medium
- oracle corporation knowledgeCross-site request forgery (CSRF) vulnerability in Knowledge versions prior to v1.7.0 allows...8.8 High
- ruby programming shounendan smalruby-editorsmalruby and smalruby-editor vulnerable to OS Command Injection9.8 Critical
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreCybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction...4.3 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreCybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction...4.3 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreCybozu Garoon 3.0.0 to 4.2.3 allow remote attackers to obtain tokens used for CSRF protection via...4.3 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreCross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated...5.4 Medium
- cybozu garoon, cybozu, inc. cybozu garoon +1 moreCybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction...4.3 Medium
- cubecart, cybozu, inc. cybozu garoon +1 moreDirectory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated...6.5 Medium
- hibara software attachecase for java, attachecase lite, attachecase pro +2 moreDirectory traversal vulnerability in AttacheCase for Java 0.60 and earlier, AttacheCase Lite 1.4...5.5 Medium
- hibara attachecaseDirectory traversal vulnerability in AttacheCase 2.8.2.8 and earlier and 3.2.0.4 and earlier...5.5 Medium
- olive design diary dxCross-site scripting vulnerability in Olive Diary DX allows remote attackers to inject arbitrary...6.1 Medium
- olive design web schedule, blog +1 moreCross-site scripting vulnerability in WEB SCHEDULE allows remote attackers to inject arbitrary...6.1 Medium
- olive design blogCross-site scripting vulnerability in Olive Blog allows remote attackers to inject arbitrary web...6.1 Medium
- cybozu remote service managerRemote Service Manager 3.0.0 to 3.1.4 fails to verify client certificates, which may allow remote...4.2 Medium
- debian linux, linux kernel +1 moreThe NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain...9.8 Critical
- linux kernelThe KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of...5.5 Medium
- 13thmonkey udfclientThe UDFclient (before 0.8.8) custom strlcpy implementation has a buffer overflow. UDFclient's...9.8 Critical
- avast antivirusIn Avast Antivirus before v17, an unprivileged user (and thus malware or a virus) can mark an...7.5 High
- avast antivirusIn Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows...9.8 Critical
- blueriver muracmsMura CMS 7.0.6967 allows admin/?muraAction= XSS attacks, related to admin/core/views/carch/list...5.4 Medium
- openbsd libresslLibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSL_get_verify_result is relied...5.3 Medium
- cnvs canvasCanvs Canvas Cross-site Scripting (XSS) via title and content fields5.4 Medium
- simple-file-manager project simple-file-managerA path traversal vulnerability exists in simple-file-manager before 2017-04-26, affecting index...9.8 Critical
- ked password manager project password managerkedpm 0.5 and 1.0 creates a history file in ~/.kedpm/history that is written in cleartext. All of...7.5 High
- technicolor dpc3928sl firmwareCertain Technicolor devices have an SNMP access-control bypass, possibly involving an ISP...9.1 Critical
- virustotal yaralibyara/re.c in the regex component in YARA 3.5.0 allows remote attackers to cause a denial of...7.5 High
- netiq edirectory, imanager +1 moreNovell iManager 2.7 before SP7 Patch 9, NetIQ iManager 3.x before 3.0.2.1, Novell eDirectory 8.8...7.5 High
- adobe coldfusionAdobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10...9.8 Critical
- adobe coldfusionAdobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10...6.1 Medium
- atlassian confluence serverAtlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read...7.5 High
- riot project riotStack-based buffer overflow in the ipv6_addr_from_str function in sys/net/network_layer/ipv6/addr...9.8 Critical
- gnome gnome-shellgnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to...8.1 High
- we-con levi studio hmi editorA Heap-Based Buffer Overflow issue was discovered in Wecon Technologies LEVI Studio HMI Editor...8.8 High
- we-con levi studio hmi editorA Stack-Based Buffer Overflow issue was discovered in Wecon Technologies LEVI Studio HMI Editor...8.8 High
- redhat openstack, [unknown] openstack-keystone +1 moreOpenStack Identity service (keystone) Incorrect Authorization6.8 Medium
- apache hadoopImproper Input Validation in Apache Hadoop7.3 High
- apache hadoopImproper Neutralization of Input During Web Page Generation in Apache Hadoop6.1 Medium
- ibm websphere commerce enterprise, websphere commerce +1 moreIBM WebSphere Commerce Enterprise, Professional, Express, and Developer 8.0 could allow a local...5.3 Medium
- hcl software bigfix inventoryIBM BigFix Inventory 9.2 does not require that users should have strong passwords by default,...5.9 Medium
- ibm maximo asset managementIBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's...5.6 Medium
- tcpdump, opensuse leap +1 moreprint-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service ...7.5 High
- qemu** DISPUTED ** The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG...7.0 High
- privatetunnelBuffer overflow in PrivateTunnel 2.7 and 2.8 allows local attackers to cause a denial of service ...7.8 High
- hyundai blue linkA Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9...7.5 High
- hyundai blue linkA Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4....3.7 Low
- debian dpkgdpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not...9.8 Critical
- dolby audio x2, audio x3 +1 moreThe Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that...7.8 High
- Show moreLoading…