CVEs published in December 2017
1,146 vulnerabilities, 220 critical, 2 exploited.
- giac project giacInput.cc in Bernard Parisse Giac 1.2.3.57 does not validate strings before launching the program...8.8 High
- xtuple postbooksguiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the...8.8 High
- swi-prologlibrary/www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program...8.8 High
- python** DISPUTED ** Lib/webbrowser.py in Python through 3.6.3 does not validate strings before...8.8 High
- fontforgeuiutil.c in FontForge through 20170731 does not validate strings before launching the program...8.8 High
- debian tin** DISPUTED ** tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the...8.8 High
- ocaml batteries project batteriesbatteriesConfig.mlp in OCaml Batteries Included (aka ocaml-batteries) 2.6 does not validate...8.8 High
- white dune project dune** DISPUTED ** swt/motif/browser.c in White_dune (aka whitedune) 0.30.10 does not validate...8.8 High
- sylpheed project sylpheedlibsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program...8.8 High
- reddit terminal viewer project terminal viewerReddit Terminal Viewer (RTV) vulnerable to argument injection attacks8.8 High
- ecmwf metview, debian linux +1 more** DISPUTED ** etc/ObjectList in Metview 4.7.3 does not validate strings before launching the...8.8 High
- nip2 project nip2, debian linux +1 more** DISPUTED ** boxes.c in nip2 8.4.0 does not validate strings before launching the program...8.8 High
- tug tex liveTeX Live through 20170524 does not validate strings before launching the program specified by the...8.8 High
- kildclient, debian linux +1 moreKildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER...8.8 High
- apache fineractIn Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated...8.8 High
- pandasecurity panda global protectionPanda Global Protection 17.0.1 allows a system crash via a 0xb3702c04 \\.\PSMEMDriver...7.5 High
- pandasecurity panda global protectionPanda Global Protection 17.0.1 allows a system crash via a 0xb3702c44 \\.\PSMEMDriver...7.5 High
- imagemagick, canonical ubuntu linux, debian linux +2 moreIn ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function...6.5 Medium
- imagemagick, canonical ubuntu linux +1 moreIn ImageMagick 7.0.7-12 Q16, an infinite loop vulnerability was found in the function...6.5 Medium
- imagemagick, canonical ubuntu linux +1 moreIn ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage...6.5 Medium
- vbulletinIn vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads...9.8 Critical
- vbulletinvBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call...9.8 Critical
- fortinet fortiosAn Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2...7.2 High
- adobe flash player, flash player desktop runtime, redhat enterprise linux desktop +2 more +4 moreA regression affecting Adobe Flash Player version 27.0.0.187 (and earlier versions) causes the...6.5 Medium
- octopus deployIn Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access...8.8 High
- digium asterisk, certified asterisk +1 moreA Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7...5.9 Medium
- emc isilon onefsIn EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x,...6.7 Medium
- symantec norton family, symantec corporation norton family android app +1 morePrior to 4.4.1.10, the Norton Family Android App can be susceptible to an Information Disclosure...3.3 Low
- symantec norton family, symantec corporation norton family android app +1 morePrior to 4.4.1.10, the Norton Family Android App can be susceptible to a Denial of Service (DoS)...6.2 Medium
- ibm tivoli workload schedulerIBM Tivoli Workload Scheduler 8.6.0, 9.1.0, and 9.2.0 could disclose sensitive information to a...3.3 Low
- ibm tivoli monitoring v6, tivoli monitoring +1 moreIBM Tivoli Monitoring V6 6.2.2.x could allow a remote attacker to execute arbitrary code on the...8.0 High
- ibm maximo asset management, maximo asset management essentials +1 moreIBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to conduct phishing attacks...6.1 Medium
- ibm rational doors next generation, rational requirements composer +1 moreIBM DOORS Next Generation (DNG/RRC) 4.07, 5.0, and 6.0 is vulnerable to cross-site scripting....5.4 Medium
- hcl software inotesIBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed...6.1 Medium
- entrepreneur dating script project dating scriptEntrepreneur Dating Script 2.0.1 has SQL Injection via the search_result.php marital, gender,...9.8 Critical
- citrix application delivery controller firmware, netscaler gateway firmware +1 moreCitrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67...5.9 Medium
- mikrotik routerboardMikroTik RouterBOARD v6.39.2 and v6.40.5 allows an unauthenticated remote attacker to cause a...7.5 High
- radware alteon firmwareRadware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vulnerable to an...5.9 Medium
- citrix application delivery controller firmware, netscaler gateway firmware +1 moreCitrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67...5.9 Medium
- atlassian bambooBamboo did not check that the name of a branch in a Mercurial repository contained argument...9.1 Critical
- atlassian bambooIt was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags...9.6 Critical
- basic job site script project job site scriptBasic Job Site Script 2.0.5 has SQL Injection via the keyword parameter to /job.9.8 Critical
- resume clone script project clone scriptResume Clone Script 2.0.5 has SQL Injection via the preview.php id parameter.9.8 Critical
- advanced world database project world databaseAdvanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or...9.8 Critical
- muslim matrimonial script project matrimonial scriptMuslim Matrimonial Script 3.02 has SQL Injection via the success-story.php succid parameter.9.8 Critical
- groupon clone script project clone scriptGroupon Clone Script 3.01 has SQL Injection via the city_ajax.php state_id parameter.9.8 Critical
- car rental script project rental scriptCar Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.9.8 Critical
- mlm forced matrix project forced matrixMLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.9.8 Critical
- mlm forex market plan script project forex market plan scriptMLM Forex Market Plan Script 2.0.4 has SQL Injection via the news_detail.php newid parameter or...9.8 Critical
- single theater booking script project theater booking scriptSingle Theater Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.9.8 Critical
- Show moreLoading…