CVEs published in September 2017
1,249 vulnerabilities, 250 critical, 14 exploited.
- jerryscriptJerryScript 1.0 allows remote attackers to cause a denial of service ...7.8 High
- ibm business process manager, business process manager advanced +1 moreIBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not...8.8 High
- ibm business process manager, business process manager advanced +1 moreIBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. This...5.4 Medium
- ibm business process manager, business process manager advanced +1 moreIBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to cross-site scripting. This...5.4 Medium
- ibm business process manager, business process manager advanced +1 moreIBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection ...8.1 High
- blizzard overwatchRace condition in Blizzard Overwatch 1.15.0.2 allows remote authenticated users to cause a denial...5.3 Medium
- ibm business process manager, business process manager advanced +1 moreIBM Business Process Manager 8.0.1.1 and 8.5.7 is vulnerable to cross-site scripting. This...5.4 Medium
- gnu binutilsThe *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as...7.8 High
- support ticket system project ticket systemMultiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System plugin...9.8 Critical
- testlinkMultiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote...6.1 Medium
- testlinkSQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute...9.8 Critical
- openhpiopenhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi...4.7 Medium
- saltstack saltSaltStack Salt Authentication Bypass when using the local_batch client from salt-api8.8 High
- claydip airbnb cloneMultiple unrestricted file upload vulnerabilities in the (1) imageSubmit and (2) proof_submit...8.8 High
- citrix application delivery controller firmware, netscaler gateway firmware +1 moreA vulnerability has been identified in the management interface of Citrix NetScaler Application...7.2 High
- zkteco zktime webCross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote...8.0 High
- okb smart passbookSmartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man...5.9 Medium
- cashbackcomparisonscript cash back comparisonSQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute...9.8 Critical
- baidu ueditorUEditor 1.4.3.3 has XSS via the SRC attribute of an IFRAME element.6.1 Medium
- faleemi fsc-880 firmwareFaleemi FSC-880 00.01.01.0048P2 devices allow unauthenticated SQL injection via the Username...8.1 High
- digium asterisk guiAn Improper Neutralization of Special Elements used in an OS Command issue was discovered in...8.8 High
- botan project botan, debian linux +1 moreA cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1...5.5 Medium
- git-scm git, debian linux +1 moreGit before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x...8.8 High
- linux kernel, centos, redhat enterprise linux +2 moreLinux distributions that have not patched their long-term kernels with https://git.kernel.org...7.8 High
- linux kernelThe KVM subsystem in the Linux kernel through 4.13.3 allows guest OS users to cause a denial of...5.5 Medium
- antisamy project antisamyOWASP AntiSamy Cross-site Scripting vulnerability6.1 Medium
- libbpg project libbpgThe build_msps function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of...8.8 High
- graphicsmagick, debian linux +1 moreReadRLEImage in coders/rle.c in GraphicsMagick 1.3.26 mishandles RLE headers that specify too few...6.5 Medium
- libofx project libofxofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of...6.5 Medium
- google androiddrivers/net/ethernet/msm/rndis_ipa.c in the Qualcomm networking driver in Android allows remote...7.0 High
- php-fusionCross-site scripting (XSS) vulnerability in PHP-Fusion 9.5.4 Medium
- unify openscape desk phone ip 35g eco sip firmware, openscape desk phone ip 35g hfa firmware, openscape desk phone ip 35g sip firmware +7 more +9 moreOpenStage 60 and OpenScape Desk Phone IP 55G SIP V3, OpenStage 15, 20E, 20 and 40 and OpenScape...5.9 Medium
- huawei ar1200 firmware, ar200 firmware, ar2200 firmware +4 more +6 moreHuawei S7700, S9700, S9300 before V200R07C00SPC500, and AR200, AR1200, AR2200, AR3200 before...4.6 Medium
- comicsmart ganma\!GANMA! App for iOS does not verify SSL certificates.5.9 Medium
- redhat enterprise virtualization managerredhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before...9.1 Critical
- systemd project systemdStack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss...9.8 Critical
- plone, zope management interface +1 morePlone vulnerable to cross-site request forgery8.8 High
- huawei uap2105 firmwareHuawei UAP2105 before V300R012C00SPC160(BootRom) does not require authentication to the serial...6.8 Medium
- devscripts devel team devscripts, fedoraproject fedora +1 morescripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell...7.8 High
- ana all nippon airwaysANA App for Android 3.1.1 and earlier, and ANA App for iOS 3.3.6 and earlier does not verify SSL...5.9 Medium
- pulpproject pulppulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures...8.1 High
- redhat amq, jboss enterprise web server +1 moreConsole: CORS headers set to allow all in Red Hat AMQ.7.5 High
- redhat amq, jboss a-mq, jboss enterprise web server +2 moreConsole: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.7.5 High
- redhat amqCross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ.8.8 High
- redhat jboss a-mqThe JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.5.4 Medium
- apache strutsCross-site Scripting in Apache Struts6.1 Medium
- cisco ios, nx-os +1 moreThe encryption library in Cisco IOS Software 15.2(1)T, 15.2(1)T1, and 15.2(2)T, Cisco NX-OS in...5.9 Medium
- aveva clearscadaSchneider Electric's ClearSCADA versions released prior to August 2017 are susceptible to a...7.5 High
- schneider-electric pro-face gp pro ex, schneider electric se proface gp-pro ex +1 moreA vulnerability exists in Schneider Electric's Pro-Face GP Pro EX version 4.07.000 that allows an...7.8 High
- schneider electric se u.motion, schneider-electric u.motion builder +1 moreAn information disclosure vulnerability exists in Schneider Electric's U.motion Builder software...5.3 Medium
- Show moreLoading…