CVEs published in December 2017
1,146 vulnerabilities, 220 critical, 2 exploited.
- exiv2, debian linux +1 more Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp,... 5.5 Medium
- zurmo crm Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint. 5.4 Medium
- trustwave secure web gateway Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an... 9.8 Critical
- isc bind, bind 9, netapp data ontap edge +1 more +3 more An error handling certain queries using the nxdomain-redirect feature could cause a REQUIRE assertion failure in db.c 7.5 High
- swhouse istar ultra firmware A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569... 7.4 High
- apple icloud, itunes, safari +4 more +6 more An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11... 8.8 High
- apple safari, canonical ubuntu linux +1 more An issue was discovered in certain Apple products. Safari before 11.0.2 is affected. The issue... 8.8 High
- moinmo moinmoin, canonical ubuntu linux, debian linux +1 more +3 more Moderate severity vulnerability that affects moin 6.1 Medium
- apple icloud, itunes, safari +3 more +5 more An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11... 8.8 High
- apple icloud, itunes, safari +4 more +6 more An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11... 8.8 High
- puppet, puppet agent, puppetpu puppet agent +4 more +6 more Tarball permission preservation in puppet 5.5 Medium
- magento Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS... 6.1 Medium
- webmin custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS... 4.8 Medium
- redlion hmi panel firmware Red Lion HMI panels allow remote attackers to cause a denial of service (software exception) via... 8.6 High
- wireshark, debian linux +1 more In Wireshark before 2.2.12, the MRDISC dissector misuses a NULL pointer and crashes. This was... 7.5 High
- stivasoft phpjabbers file sharing script PHPJabbers File Sharing Script 1.0 has stored XSS in the comments section. 6.1 Medium
- stivasoft phpjabbers night club booking software PHPJabbers Night Club Booking Software has stored XSS in the name parameter in the reservations tab. 6.1 Medium
- stivasoft phpjabbers star rating script PHPJabbers Star Rating Script 4.0 has stored XSS via a rating item. 6.1 Medium
- stivasoft phpjabbers newsletter script PHPJabbers PHP Newsletter Script 4.2 has stored XSS in lists in the admin panel. 6.1 Medium
- iwcnetwork biometric shift employee management system Biometric Shift Employee Management System has XSS via the Last_Name parameter in an index.php... 5.4 Medium
- iwcnetwork biometric shift employee management system Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php... 5.4 Medium
- iwcnetwork biometric shift employee management system Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user... 5.4 Medium
- iwcnetwork biometric shift employee management system Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal... 9.8 Critical
- iwcnetwork biometric shift employee management system Biometric Shift Employee Management System has XSS via the expense_name parameter in an index.php... 5.4 Medium
- iwcnetwork biometric shift employee management system Biometric Shift Employee Management System has CSRF via index.php in an edit_holiday action. 8.8 High
- iwcnetwork biometric shift employee management system Biometric Shift Employee Management System has XSS via the index.php holiday_name parameter in an... 5.4 Medium
- muslim matrimonial script project matrimonial script PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title... 4.8 Medium
- muslim matrimonial script project matrimonial script PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit... 7.2 High
- muslim matrimonial script project matrimonial script PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter. 4.8 Medium
- muslim matrimonial script project matrimonial script PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter. 4.8 Medium
- muslim matrimonial script project matrimonial script PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter. 4.8 Medium
- muslim matrimonial script project matrimonial script PHP Scripts Mall Muslim Matrimonial Script has SQL injection via the view-profile.php mem_id... 8.8 High
- muslim matrimonial script project matrimonial script PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php. 6.8 Medium
- muslim matrimonial script project matrimonial script PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/slider_edit.php edit_id parameter. 5.4 Medium
- zyxel p-660hw firmware ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (CPU consumption)... 7.5 High
- mediawiki, fedoraproject fedora +1 more The OAuth extension for MediaWiki improperly negotiates a new client token only over Special... 7.5 High
- thecartpress ecommerce shopping cart The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin... 7.5 High
- dozer project dozer Dozer improperly uses a reflection-based approach to type conversion, which might allow remote... 9.8 Critical
- rawstudio, fedoraproject fedora +1 more The rs_filter_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to... 5.5 Medium
- lightbend play framework XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2... 9.8 Critical
- hawt hawtio, redhat jboss fuse +1 more The admin terminal in Hawt.io does not require authentication, which allows remote attackers to... 9.8 Critical
- hawt hawtio, redhat jboss fuse +1 more Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote... 8.8 High
- oracle jdk, jre +1 more jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code... 5.3 Medium
- basystems bas920 firmware, isc2000 firmware +1 more BA SYSTEMS BAS Web on BAS920 devices (with Firmware 01.01.00*, HTTPserv 00002, and Script 02.*)... 9.8 Critical
- libtiff ** DISPUTED ** In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc... 8.8 High
- hoermann hs5-868-bs firmware, hse1-868-bs firmware, hse2-868-bs firmware +2 more On Hoermann BiSecur devices before 2018, a vulnerability can be exploited by recording a single... 6.5 Medium
- dolibarr erp\/crm Dolibarr ERP and CRM contain XSS Vulnerability 6.1 Medium
- netwin surgeftp cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP... 6.1 Medium
- opencv, debian linux +1 more Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV 6.5 Medium
-
phpMyAdminSUSE Security update for phpMyAdmin No score - Show olderLoading…