CVEs published in December 2017
1,146 vulnerabilities, 220 critical, 2 exploited.
- flexense syncbreezeThe Enterprise version of SyncBreeze 10.2.12 and earlier is affected by a Remote Denial of...7.5 High
- meinbergglobal lantime firmwareThe Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows...6.5 Medium
- zoomThe ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly...8.8 High
- zoomStack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0...8.8 High
- conarc ichannelConarc iChannel allows remote attackers to obtain sensitive information, modify the configuration...9.8 Critical
- tp-link tl-war1200l firmware, tl-war1300l firmware, tl-war1750l firmware +12 more +14 moreTP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands...8.8 High
- tp-link tl-war1200l firmware, tl-war1300l firmware, tl-war1750l firmware +12 more +14 moreTP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands...8.8 High
- apache sling authentication service, apache software foundation sling +1 moreApache Sling Authentication Service vulnerability8.8 High
- heketi, redhat enterprise linux +1 moreInformation Exposure in Heketi7.8 High
- heketi, redhat enterprise linux +1 moreHeketi Arbitrary Code Execution8.8 High
- zivif pr115-204-p-rs firmwareZivif PR115-204-P-RS V2.3.4.2103 web cameras contain a hard-coded cat1029 password for the root...9.8 Critical
- zivif pr115-204-p-rs firmwareCredentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated...9.8 Critical
- zivif pr115-204-p-rs firmwareZivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras...9.8 Critical
- accesspressthemes anonymous post proAn issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for...9.8 Critical
- sistemagpweb gpwebInsecure Permissions vulnerability in db.php file in GPWeb 8.4.61 allows remote attackers to view...9.8 Critical
- sistemagpweb gpwebUnrestricted File Upload vulnerability in GPWeb 8.4.61 allows remote authenticated users to...7.2 High
- sistemagpweb gpwebSQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to...9.8 Critical
- kemptechnologies web application firewallThe Application Firewall Pack (AFP, aka Web Application Firewall) component on Kemp Load Balancer...9.1 Critical
- mt4 senhaseguraA Session Fixation Vulnerability exists in the MT4 Networks SenhaSegura Web Application 2.2.23.8...8.8 High
- zuuse beims contractorweb .netCWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the...9.8 Critical
- netapp clustered data ontapNetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and 9.2P2 are susceptible to a...6.5 Medium
- apache drillApache Drill vulnerable to Cross-site Scripting5.4 Medium
- paid to read script project to read scriptPaid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin...9.8 Critical
- readymade video sharing script project video sharing scriptReadymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment...6.1 Medium
- phpautoclassifiedscript bus booking scriptBus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php.9.8 Critical
- lynda clone project cloneFS Lynda Clone 1.0 has SQL Injection via the keywords parameter to tutorial/.9.8 Critical
- openldap, mcafee policy auditor, opensuse leap +1 more +3 morecontrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the...7.5 High
- brightsign 4k242 firmwareThe BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal...9.8 Critical
- brightsign 4k242 firmwareThe BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and...7.5 High
- brightsign 4k242 firmwareThe BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF...6.1 Medium
- cmsmadesimple cms made simpleCMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.9.8 Critical
- cmsmadesimple cms made simpleCMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.9.8 Critical
- maccmsMaccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search...9.8 Critical
- dedecmsDedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.9.8 Critical
- dedecmsDedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php.9.8 Critical
- dedecmsDedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code...8.8 High
- debian linux, linux kernel +1 moreThe KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially...6.5 Medium
- net-ldap project net-ldapnet-ldap Improper Certificate Validation vulnerability5.9 Medium
- sonatype nexus repository managerSonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded...9.8 Critical
- gitlabGitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a...5.9 Medium
- urbackup serverCross - site scripting (XSS) vulnerability in UrBackup Server before 2.1.20 allows remote...6.1 Medium
- gnu glibc, redhat enterprise linux desktop, enterprise linux server +1 more +3 moreelf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and...7.8 High
- boxug trapeTrape before 2017-11-05 has XSS via the /nr red parameter, the /nr vId parameter, the /register...6.1 Medium
- boxug trapeTrape before 2017-11-05 has SQL injection via the /nr red parameter, the /nr vId parameter, the ...9.8 Critical
- telegram messengerThe saveFile method in MediaController.java in the Telegram Messenger application before 2017-12...8.8 High
- maplesoft maple t.a.A Reflected XSS Vulnerability affects the forgotten password page of Maplesoft Maple T.A. 2016.0...6.1 Medium
- google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreInappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239...6.1 Medium
- fortinet forticlient, forticlient for windows, forticlient sslvpn client +2 more +4 moreAn Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below...8.8 High
- k7computing antivirusK7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025c8...9.8 Critical
- k7computing antivirusK7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025a4...9.8 Critical
- Show moreLoading…