CVEs published in October 2017
1,342 vulnerabilities, 197 critical, 6 exploited.
- typechoIn admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a...5.4 Medium
- nodejs node.js, siemens cadra +1 moreNode.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a...7.5 High
- apache cordova, cordova in-app-browser +1 moreThe CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache...9.8 Critical
- apache cordova, cordova file transfer +1 moreios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova...7.5 High
- apache httpclientHostname verification in Apache HttpClient 4.3 was disabled by default9.8 Critical
- apache wicketCross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5...6.1 Medium
- apache hadoopUse of a Broken or Risky Cryptographic Algorithm in Apache Hadoop9.8 Critical
- synology audio stationCross-site scripting (XSS) vulnerability in Custom Internet Radio List in Synology Audio Station...5.4 Medium
- apache stormApache Storm log viewer path traversal vulnerability7.5 High
- apache xerces2 javaDenial of service in Apache Xerces27.5 High
- apache juddiCross-site scripting (XSS) vulnerability in Apache jUDDI before 2.0 allows remote attackers to...6.1 Medium
- apache juddiApache jUDDI before 2.0 allows attackers to spoof entries in log files via vectors related to...5.3 Medium
- watchdogdevelopment anti-malware, online security pro +1 moreIn Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver...7.5 High
- watchdogdevelopment anti-malware, online security pro +1 moreIn Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver...7.5 High
- amazon web services cloudformation bootstrapThe Amazon Web Services (AWS) CloudFormation bootstrap tools package (aka aws-cfn-bootstrap)...7.8 High
- barco clickshare csc-1 firmware, clickshare csm-1 firmware +1 moreA command injection was identified on Barco ClickShare Base Unit devices with CSM-1 firmware...8.8 High
- enalean tuleapAn issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists...8.8 High
- xenAn issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any...9.1 Critical
- barco clickshare csm-1 firmware, clickshare csc-1 firmware +1 moreAn issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware...5.4 Medium
- apache strutsApache Struts RCE Vulnerability8.8 High
- apache traffic serverThe HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote...9.8 Critical
- apache wss4jUse of a Broken or Risky Cryptographic Algorithm in Apache WSS4J7.5 High
- apache qpidqpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service ...7.5 High
- apache traffic serverApache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by...9.8 Critical
- apache wicketApache Wicket Sensitive Data Exposure7.5 High
- apache subversionlibsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated...8.8 High
- ektron content management systemThe XSLTCompiledTransform function in Ektron Content Management System (CMS) before 8.02 SP5...9.8 Critical
- ektron content management systemEktron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with...9.8 Critical
- dulwich project dulwichDulwich RCE Vulnerability9.8 Critical
- eyesofnetworkSQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote...7.2 High
- nq contacts backup \& restoreIn the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for...9.8 Critical
- nq contacts backup \& restoreIn the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static...7.5 High
- nq contacts backup \& restoreIn the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to...7.8 High
- gnu binutilselfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service ...7.8 High
- samba rsyncrsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for...9.8 Critical
- zeescripts zeebuddyZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different...9.8 Critical
- vastal dating zoneVastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a...9.8 Critical
- datacomponents tpaneltPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.9.8 Critical
- sokialSokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view...9.8 Critical
- softdatepro dating softwareSoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid...9.8 Critical
- softdatepro same date proSame Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter,...9.8 Critical
- phpcityportalPHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action,...9.8 Critical
- pilotgroup allsharevideoPG All Share Video 1.0 allows SQL Injection via the PATH_INFO to search/tag, friends/index, users...9.8 Critical
- contractorscripts mybuildersiteMyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter.9.8 Critical
- mailing-manager mailing list manager proMailing List Manager Pro 3.0 allows SQL Injection via the edit parameter to admin/users in a sort...9.8 Critical
- zh yandexmap project yandexmapThe Zh YandexMap (aka com_zhyandexmap) component 6.1.1.0 for Joomla! allows SQL Injection via the...9.8 Critical
- nswd ns download shopThe NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection...9.8 Critical
- nicephpscripts job board scriptJob Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.9.8 Critical
- itechscripts gigs scriptiTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the...9.8 Critical
- istock management system project management systemiStock Management System 1.0 allows Arbitrary File Upload via user/profile.9.8 Critical
- Show moreLoading…