CVEs published in December 2017
1,146 vulnerabilities, 220 critical, 2 exploited.
- k7computing antivirusK7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025ac...9.8 Critical
- cisco adaptive security appliance 5505 firmware, adaptive security appliance 5510 firmware, adaptive security appliance 5520 firmware +2 more +4 moreA vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505,...5.9 Medium
- zohocorp manageengine password manager proZoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec...6.1 Medium
- hp synaptics touchpad driverA debug tool in Synaptics TouchPad drivers allows local users with administrative access to...5.1 Medium
- meinbergglobal lantime firmwareDirectory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration...7.2 High
- meinbergglobal lantime firmwareThe Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows...6.5 Medium
- mckesson conserus workflow intelligenceSecurity researchers discovered an authentication bypass vulnerability in version 2.0.2 of the...8.1 High
- changehealthcare conserus image repositoryA security researcher found an XML External Entity (XXE) vulnerability on the Conserus Image...9.8 Critical
- synology mailplus serverCross-site scripting (XSS) vulnerability in Disclaimer in Synology MailPlus Server before 1.4.0...4.8 Medium
- rawether project rawether, printing communications assoc., inc. (pcausa) asus pce-ac56 wlan card utilities +1 morePCAUSA Rawether framework does not properly validate BPF data, allowing a crafted malicious BPF...7.8 High
- commvault edge, service pack 6 +1 moreCommvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix...9.8 Critical
- pandora, pandora media, inc. ios app +1 morePandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by...8.1 High
- dlink dir-850l firmware, d-link dir-850l and potentially others +1 moreMultiple D-Link devices including the DIR-850L firmware versions 1.14B07 and 2.07.B05 contain a...8.8 High
- d-link dir-130, dir-130 firmware, dir-330 +1 more +3 moreD-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently...9.8 Critical
- d-link dir-130, dir-130 firmware, dir-330 +1 more +3 moreD-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to...9.8 Critical
- axs flash seats, flash seats mobile app +1 moreFlash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and...7.5 High
- acti camera firmware, acti corporation d, b, i, and e series cameras +1 moreACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use...9.8 Critical
- acti camera firmware, acti corporation d, b, i, and e series cameras +1 moreACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have...9.8 Critical
- acti camera firmware, acti corporation d, b, i, and e series cameras +1 moreACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC fail...9.8 Critical
- trend micro scanmail for exchange, trendmicro scanmail +1 moreThe Log Query and Quarantine Query pages in Trend Micro ScanMail for Exchange 12.0 are vulnerable...6.1 Medium
- trendmicro scanmailThe absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms...8.8 High
- trend micro scanmail for exchange, trendmicro scanmail +1 moreA vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific...7.5 High
- trend micro scanmail for exchange, trendmicro scanmail +1 moreA vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to...9.1 Critical
- trend micro encryption for emailA service DLL preloading vulnerability in Trend Micro Encryption for Email versions 5.6 and below...7.8 High
- qt, the qt company qt for android +1 moreA vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to...5.3 Medium
- qt, the qt company qt for android +1 moreQt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via...9.8 Critical
linux-awsUbuntu,linux-lts-xenialUbuntu +1 morelinux-lts-xenial, linux-aws regressionNo score- linuxfoundation harborThe Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint...8.6 High
- techno - portfolio management panel project - portfolio management panelTechno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid...4.3 Medium
- techno - portfolio management panel project - portfolio management panelTechno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search...8.8 High
- techno - portfolio management panel project - portfolio management panelTechno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s...5.4 Medium
- techno - portfolio management panel project - portfolio management panelTechno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel...4.3 Medium
- videolan vlc media player, debian linux +1 moreIn VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules...8.8 High
linuxUbuntu,linux-awsUbuntu,linux-kvmUbuntu +1 more +3 morelinux, linux-aws, linux-kvm, linux-raspi2 regressionNo scorereportbugDebianreportbug - security updateNo score- linux kernelThe raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race...7.0 High
- ruby-lang ruby, debian linux, redhat enterprise linux desktop +5 more +7 moreRuby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile,...8.8 High
- phusion passenger, debian linux +1 morePhusion Passenger information disclosure4.7 Medium
- rapid7 nexposeVersions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests...8.8 High
- ecstatic project ecstaticDenial of Service in ecstatic7.5 High
- fortinet forticlient, forticlientwindows +1 moreA privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows...8.1 High
- gjots2 project gjots2lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program...8.8 High
- mensis project mensisuiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by...8.8 High
- tkabber project tkabber** DISPUTED ** default.tcl in Tkabber 1.1 does not validate strings before launching the program...8.8 High
- kiwi project kiwiexamples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the...8.8 High
- gnu globalgozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by...8.8 High
- geomviewcommon/help.c in Geomview 1.9.5 does not validate strings before launching the program specified...8.8 High
- abisource abiwordaf/util/xp/ut_go_file.cpp in AbiWord 3.0.2-2 does not validate strings before launching the...8.8 High
- scummvmbackends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching...8.8 High
- pasdoc project pasdoc, debian linux +1 more** DISPUTED ** delphi_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before...8.8 High
- Show moreLoading…