CVEs published in September 2017
1,249 vulnerabilities, 250 critical, 14 exploited.
- schneider-electric u.motion builderA vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior...5.5 Medium
- schneider electric se u.motion, schneider-electric u.motion builder +1 moreAn improper access control vulnerability exists in Schneider Electric's U.motion Builder software...7.8 High
- schneider electric se u.motion, schneider-electric u.motion builder +1 moreA vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior...9.8 Critical
- schneider electric se u.motion, schneider-electric u.motion builder +1 moreAn authentication bypass vulnerability exists in Schneider Electric's U.motion Builder software...7.3 High
- schneider electric se u.motion, schneider-electric u.motion builder +1 moreA path traversal information disclosure vulnerability exists in Schneider Electric's U.motion...9.8 Critical
- schneider electric se u.motion, schneider-electric u.motion builder +1 moreA SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1...9.8 Critical
- schneider electric se citect anywhere, powerscada anywhere +1 moreA vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with...5.5 Medium
- schneider electric se citect anywhere, powerscada anywhere +1 moreA vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with...6.5 Medium
- schneider electric se citect anywhere, powerscada anywhere +1 moreA vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with...6.5 Medium
- schneider electric se citect anywhere, powerscada anywhere +1 moreA cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider...8.8 High
- magentoPassword reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via...9.8 Critical
- redhat openshiftselinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing...3.3 Low
- dropbox sdkDropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information...5.3 Medium
- ovirt ovirt-nodeovirt_safe_delete_config in ovirtfunctions.py and other unspecified locations in ovirt-node 3.0.0...8.8 High
- fso-frameworkd project fso-frameworkd, fso-gsmd project fso-gsmd, fso-usaged project fso-usaged +1 more +3 moreThe D-Bus security policy files in /etc/dbus-1/system.d/*.conf in fso-gsmd 0.12.0-3, fso...7.8 High
- google androidWiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806,...7.5 High
- elasticsearch logstashThe init script in the Gentoo app-admin/logstash-bin package before 5.5.3 and 5.6.x before 5.6.1...7.8 High
- wpdevart responsive image gallery gallery albumSQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress...9.8 Critical
- vebto pixie - image editorServer Side Request Forgery vulnerability in Vebto Pixie Image Editor 1.4 and 1.7 allows remote...10.0 Critical
- plonePlone Header Injection7.5 High
- kupu project kupu, plone +1 moreKupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7...6.8 Medium
- plonePlone Cross-site Scripting Vulnerability6.1 Medium
- plonePlone unauthorized member addition vulnerability5.9 Medium
- theforeman foremanCross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.6.1 Medium
- google protobufprotobuf susceptible to buffer overflow8.8 High
- xceedium xsuiteThe MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to...7.8 High
- xceedium xsuiteOpen redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect...6.1 Medium
- xceedium xsuiteMultiple hardcoded credentials in Xsuite 2.x.9.8 Critical
- cisco iosCisco IOS before 12.2(33)SXI allows remote authenticated users to cause a denial of service ...6.5 Medium
- cisco iosCisco IOS before 12.2(33)SXI allows local users to cause a denial of service (device reboot).5.5 Medium
- maharaMahara 15.04 before 15.04.14 and 16.04 before 16.04.8 and 16.10 before 16.10.5 and 17.04 before...6.1 Medium
- ibm api connectIBM API Connect 5.0.0.0 through 5.0.7.2 could allow an authenticated user to generate an API...4.3 Medium
- ibm api connectIBM API Connect 5.0.0.0 through 5.0.7.2 could allow a remote attacker to hijack the clicking...6.1 Medium
- gnu binutilsThe *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as...7.8 High
- ibm business process manager, business process manager advanced +1 moreIBM Business Process Manager 8.5.7 is vulnerable to cross-site scripting. This vulnerability...5.4 Medium
- ibm security identity managerIBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text...7.8 High
- ibm business process managerIBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder...2.5 Low
- ibm mq, websphere mq +1 moreIBM WebSphere MQ 8.0 could allow an authenticated user to cause a premature termination of a...6.5 Medium
- geminabox project geminaboxGem in a Box vulnerable to Cross-site Request Forgery8.8 High
- geminabox project geminaboxGem in a Box vulnerable to Cross-site Scripting5.4 Medium
- imagemagickThe ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers...6.5 Medium
- imagemagickThe AcquireResampleFilterThreadSet function in magick/resample-private.h in ImageMagick 7.0.7-4...7.5 High
- weechat loggerlogger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time...7.5 High
- wordpressBefore version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in...6.1 Medium
- wordpressBefore version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag...5.4 Medium
- wordpressBefore version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.6.1 Medium
- wordpressBefore version 4.8.2, WordPress mishandled % characters and additional placeholder values in ...9.8 Critical
- wordpressBefore version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component...7.5 High
- wordpressBefore version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted...6.1 Medium
- wordpressBefore version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view...6.1 Medium
- Show moreLoading…