CVEs published in September 2017
1,249 vulnerabilities, 250 critical, 14 exploited.
- ossecsyscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute...7.0 High
- askbotCross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch.6.1 Medium
- ibm en6131 firmware, ib6131 firmware +1 moreCross-site request forgery (CSRF) vulnerability in IBM Flex System EN6131 40Gb Ethernet and...8.8 High
- finecms project finecmsThe call_msg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to...6.1 Medium
- finecms project finecmsThe out function in controllers/member/Login.php in dayrui FineCms 5.0.11 has XSS related to the...6.1 Medium
- finecms project finecmsThe oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the...6.1 Medium
- finecms project finecmsThe checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to...6.1 Medium
- ibm content navigatorIBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vulnerable to cross-site scripting. This...5.4 Medium
- aacplusenc project aacplusencDeleteBitBuffer in libbitbuf/bitbuffer.c in mp4tools aacplusenc 0.17.5 allows remote attackers to...7.8 High
- ibm websphere portalIBM WebSphere Portal and Web Content Manager 6.1, 7.0, and 8.0 is vulnerable to cross-site...6.1 Medium
- ibm emptoris supplier lifecycle managementIBM Emptoris Supplier Lifecycle Management 10.1.0.x is vulnerable to cross-site scripting. This...5.4 Medium
- mapsplugin googlemapsThe Googlemaps plugin before 3.1 for Joomla! allows remote attackers to cause a denial of service...7.5 High
- calendarscripts watuproSQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote...9.8 Critical
- ocamlOCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue...7.8 High
- fiberhome adsl an1020-25 firmwareAn issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could...9.8 Critical
- mp3gainThe "mpglibDBL/layer3.c" file in MP3Gain 1.5.2.r2 has a vulnerability which results in a read...5.5 Medium
- mp3gainThe "apetag.c" file in MP3Gain 1.5.2.r2 has a vulnerability which results in a stack memory...5.5 Medium
- kamailioThe kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp...7.8 High
- paloaltonetworks pan-osXML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway...9.8 Critical
- lexmark scan to networkLexmark Scan To Network (SNF) 3.2.9 and earlier stores network configuration credentials in...9.8 Critical
- wibu codemeterCross-site scripting (XSS) vulnerability in the "advanced settings - time server" module in Wibu...5.4 Medium
- twsz wifi repeater firmwareT&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell...8.8 High
- nexusphp project nexusphpMultiple cross-site scripting (XSS) vulnerabilities in NexusPHP allow remote attackers to inject...6.1 Medium
- nexusphp project nexusphpCross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows remote attackers to hijack...8.8 High
- djangoproject djangoDjango vulnerable to XSS on 500 pages6.1 Medium
- paloaltonetworks pan-osCross-site scripting (XSS) vulnerability in the GlobalProtect internal and external gateway...6.1 Medium
- gnu glibcUse-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C...5.9 Medium
- cesanta mongoose embedded web server libraryCross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote...8.8 High
- d-link dir-600l firmwareSession fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17...9.8 Critical
- cloudfoundry uaa-release, pivotal elastic runtime, cloudfoundry cf-release +1 more +3 moreThe identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and...8.8 High
- soreco xpert.lineSoreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by...9.8 Critical
- apache directory ldap apiExposure of Sensitive Information to an Unauthorized Actor in Apache Directory LDAP API7.5 High
- ffmpegIn libavformat/nsvdec.c in FFmpeg 2.4 and 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of...6.5 Medium
- ffmpegIn libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, a DoS in mxf_read_index_entry_array() due to lack...6.5 Medium
- ffmpeg, debian linux +1 moreIn the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3 -> 2.4, an integer...8.8 High
icedoveDebianicedove - regression updateNo score- imagemagick, canonical ubuntu linux, debian linux +2 moreIn coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() due to lack of an EOF (End of...6.5 Medium
- imagemagick, canonical ubuntu linux, debian linux +2 moreIn coders/psd.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSDLayersInternal() due to lack of an...6.5 Medium
- imagemagick, canonical ubuntu linux, debian linux +2 moreIn the function ReadTXTImage() in coders/txt.c in ImageMagick 7.0.6-10, an integer overflow might...6.5 Medium
- imagemagick, canonical ubuntu linux, debian linux +2 moreIn coders/ps.c in ImageMagick 7.0.7-0 Q16, a DoS in ReadPSImage() due to lack of an EOF (End of...6.5 Medium
- ldapauth-fork project ldapauth-forkLDAP Injection in ldapauth7.5 High
- sap netweaverXML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.9.8 Critical
- tinfoilsecurity devise-two-factorTinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)5.3 Medium
- simple-php-captcha project simple-php-captchasimple-php-captcha before commit 9d65a945029c7be7bb6bc893759e74c5636be694 allows remote attackers...5.3 Medium
- froxlorFroxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to...9.8 Critical
- salesagility suitecrmRace condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. NOTE:...8.1 High
- salesagility suitecrmSuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.8.1 High
- devscripts devel team devscripts, fedoraproject fedora +1 moreArgument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to...7.5 High
- vulcanjs vulcanTelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might...7.5 High
- aspl libaxlHeap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory...8.8 High
- Show moreLoading…