Lista CVE - 2017 / Dicembre
Visualizzazione 1001 - 1100 di 1105 CVE per Dicembre 2017 (Pagina 11 di 12)
| ID CVE | Data | Titolo |
|---|---|---|
| CVE-2017-17931 | 2017-12-26 | PHP Scripts Mall Resume Clone Script has SQL Injection via the forget.php username parameter. |
| CVE-2017-17934 | 2017-12-27 | ImageMagick 7.0.7-17 Q16 x86_64 has memory leaks in coders/msl.c, related to MSLPopImage and ProcessMSLScript, and associated with mishandling of MSLPushImage calls. |
| CVE-2017-17935 | 2017-12-27 | The File_read_line function in epan/wslua/wslua_file.c in Wireshark through 2.2.11 does not properly strip '\n' characters, which allows remote attackers to cause a denial of service (buffer underflow and application crash)... |
| CVE-2017-1191 | 2017-12-27 | An undisclosed vulnerability in CLM applications (including IBM Rational Collaborative Lifecycle Management 4.0, 5.0, and 6.0) with potential for failure to restrict URL Access. IBM X-Force ID: 123661. |
| CVE-2017-1365 | 2017-12-27 | IBM Team Concert (RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the... |
| CVE-2017-1698 | 2017-12-27 | IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could reveal sensitive information from an error message that could lead to further attacks against the system. IBM X-Force ID: 124390. |
| CVE-2016-6914 | 2017-12-27 | Ubiquiti UniFi Video before 3.8.0 for Windows uses weak permissions for the installation directory, which allows local users to gain SYSTEM privileges via a Trojan horse taskkill.exe file. |
| CVE-2017-13056 | 2017-12-27 | The launchURL function in PDF-XChange Viewer 2.5 (Build 314.0) might allow remote attackers to execute arbitrary code via a crafted PDF file. |
| CVE-2017-16768 | 2017-12-27 | Cross-site scripting (XSS) vulnerability in User Policy editor in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary HTML via the name parameter. |
| CVE-2014-8389 | 2017-12-27 | cgi-bin/mft/wireless_mft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive BU-3026 with firmware 1.43 21.08.2014, AirLive MD-3025 with firmware 1.81 21.08.2014, AirLive WL-2000CAM with firmware LM.1.6.18 14.10.2011, and AirLive POE-200CAM v2... |
| CVE-2015-3637 | 2017-12-27 | SQL injection vulnerability in phpMyBackupPro when run in multi-user mode before 2.5 allows remote attackers to execute arbitrary SQL commands via the username and password parameters. |
| CVE-2015-7889 | 2017-12-27 | The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND service action, which might allow remote attackers with knowledge of the... |
| CVE-2017-10910 | 2017-12-27 | MQTT.js 2.x.x prior to 2.15.0 issue in handling PUBLISH tickets may lead to an attacker causing a denial-of-service condition. |
| CVE-2015-6237 | 2017-12-27 | The RPC service in Tripwire (formerly nCircle) IP360 VnE Manager 7.2.2 before 7.2.6 allows remote attackers to bypass authentication and (1) enumerate users, (2) reset passwords, or (3) manipulate IP... |
| CVE-2015-7324 | 2017-12-27 | Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1)... |
| CVE-2015-7666 | 2017-12-27 | Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers... |
| CVE-2015-7667 | 2017-12-27 | Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in the ResAds plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via... |
| CVE-2015-7668 | 2017-12-27 | Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map_id parameter. |
| CVE-2015-7669 | 2017-12-27 | Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPress allow remote attackers to include and execute arbitrary files via the csvfile... |
| CVE-2017-11695 | 2017-12-27 | Heap-based buffer overflow in the alloc_segs function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file. |
| CVE-2017-11696 | 2017-12-27 | Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file. |
| CVE-2017-11697 | 2017-12-27 | The __hash_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context-dependent attackers to cause a denial of service (floating point exception and crash) via a crafted cert8.db file. |
| CVE-2017-11698 | 2017-12-27 | Heap-based buffer overflow in the __get_page function in lib/dbm/src/h_page.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file. |
| CVE-2017-9608 | 2017-12-27 | The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file. |
| CVE-2017-17932 | 2017-12-28 | A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on the victim... |
| CVE-2017-17942 | 2017-12-28 | In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c. |
| CVE-2017-17936 | 2017-12-28 | Vanguard Marketplace Digital Products PHP has CSRF via /search. |
| CVE-2017-17937 | 2017-12-28 | Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search. |
| CVE-2017-17938 | 2017-12-28 | PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter. |
| CVE-2017-17939 | 2017-12-28 | PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php. |
| CVE-2017-17940 | 2017-12-28 | PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php. |
| CVE-2017-17941 | 2017-12-28 | PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter. |
| CVE-2017-15886 | 2017-12-28 | Server-side request forgery (SSRF) vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to download arbitrary local files via a crafted URI. |
| CVE-2017-15892 | 2017-12-28 | Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated users to inject arbitrary web script or HTML via (1) COMMAND, (2) COMMANDS... |
| CVE-2017-5641 | 2017-12-28 | Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the deserialization process code is executed that... |
| CVE-2017-15667 | 2017-12-28 | In Flexense SysGauge Server 3.6.18, the Control Protocol suffers from a denial of service. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9221. |
| CVE-2017-17948 | 2017-12-28 | Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request. |
| CVE-2017-17949 | 2017-12-28 | Cells Blog 3.5 has XSS via the pub_readpost.php fmid parameter. |
| CVE-2017-17950 | 2017-12-28 | Cells Blog 3.5 has SQL Injection via the pub_readpost.php ptid parameter. |
| CVE-2017-17951 | 2017-12-28 | PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the shopping-cart.php cusid parameter. |
| CVE-2017-17952 | 2017-12-28 | PHP Scripts Mall PHP Multivendor Ecommerce has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed e-mail address. |
| CVE-2017-17953 | 2017-12-28 | PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the category.php chid1 parameter. |
| CVE-2017-17954 | 2017-12-28 | PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the seller-view.php usid parameter. |
| CVE-2017-17955 | 2017-12-28 | PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the shopping-cart.php cusid parameter. |
| CVE-2017-17956 | 2017-12-28 | PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter. |
| CVE-2017-17957 | 2017-12-28 | PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the my_wishlist.php fid parameter. |
| CVE-2017-17958 | 2017-12-28 | PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the my_wishlist.php fid parameter. |
| CVE-2017-17959 | 2017-12-28 | PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the seller-view.php usid parameter. |
| CVE-2017-17960 | 2017-12-28 | PHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php. |
| CVE-2017-17967 | 2017-12-28 | pptreader.dll in Kingsoft WPS Office 10.1.0.6930 allows remote attackers to cause a denial of service via a crafted PPT file, aka CNVD-2017-35482. |
| CVE-2014-4914 | 2017-12-29 | The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors. |
| CVE-2013-7400 | 2017-12-29 | The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes. |
| CVE-2014-3651 | 2017-12-29 | JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation. |
| CVE-2016-3695 | 2017-12-29 | The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequently cause a denial of service by leveraging failure to disable APEI error... |
| CVE-2017-16876 | 2017-12-29 | Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the... |
| CVE-2017-17968 | 2017-12-29 | A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long HTTP response. |
| CVE-2017-17916 | 2017-12-29 | SQL injection vulnerability in the 'find_by' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes... |
| CVE-2017-17917 | 2017-12-29 | SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' parameter. NOTE: The vendor disputes... |
| CVE-2017-17919 | 2017-12-29 | SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter. NOTE: The vendor... |
| CVE-2017-17920 | 2017-12-29 | SQL injection vulnerability in the 'reorder' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes... |
| CVE-2017-17760 | 2017-12-29 | OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used. |
| CVE-2017-17933 | 2017-12-29 | cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter. |
| CVE-2017-17971 | 2017-12-29 | The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS. |
| CVE-2017-17910 | 2017-12-29 | On Hoermann BiSecur devices before 2018, a vulnerability can be exploited by recording a single radio transmission. An attacker can intercept an arbitrary radio frame exchanged between a BiSecur transmitter... |
| CVE-2017-17973 | 2017-12-29 | In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue |
| CVE-2017-17974 | 2017-12-29 | BA SYSTEMS BAS Web on BAS920 devices (with Firmware 01.01.00*, HTTPserv 00002, and Script 02.*) and ISC2000 devices allows remote attackers to obtain sensitive information via a request for isc/get_sid_js.aspx... |
| CVE-2013-4578 | 2017-12-29 | jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper... |
| CVE-2014-0120 | 2017-12-29 | Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server,... |
| CVE-2014-0121 | 2017-12-29 | The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter. |
| CVE-2014-3630 | 2017-12-29 | XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial... |
| CVE-2014-4978 | 2017-12-29 | The rs_filter_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary files via a symlink attack on (1) /tmp/rs-filter-graph.png or (2) /tmp/rs-filter-graph. |
| CVE-2014-8119 | 2017-12-29 | The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involving augeas path expressions. |
| CVE-2014-9515 | 2017-12-29 | Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object. |
| CVE-2015-3302 | 2017-12-29 | The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication... |
| CVE-2015-8008 | 2017-12-29 | The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with... |
| CVE-2017-17901 | 2017-12-29 | ZyXEL P-660HW v3 devices allow remote attackers to cause a denial of service (CPU consumption) via a flood of IP packets with a TTL of 1. |
| CVE-2017-17975 | 2017-12-30 | Use-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c in the Linux kernel through 4.14.10 allows attackers to cause a denial of service (system crash) or possibly have unspecified other impact by... |
| CVE-2017-17981 | 2017-12-30 | PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/slider_edit.php edit_id parameter. |
| CVE-2017-17982 | 2017-12-30 | PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php. |
| CVE-2017-17983 | 2017-12-30 | PHP Scripts Mall Muslim Matrimonial Script has SQL injection via the view-profile.php mem_id parameter. |
| CVE-2017-17984 | 2017-12-30 | PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter. |
| CVE-2017-17985 | 2017-12-30 | PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter. |
| CVE-2017-17986 | 2017-12-30 | PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter. |
| CVE-2017-17987 | 2017-12-30 | PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php. |
| CVE-2017-17988 | 2017-12-30 | PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter. |
| CVE-2017-17989 | 2017-12-30 | Biometric Shift Employee Management System has XSS via the index.php holiday_name parameter in an edit_holiday action. |
| CVE-2017-17990 | 2017-12-30 | Biometric Shift Employee Management System has CSRF via index.php in an edit_holiday action. |
| CVE-2017-17991 | 2017-12-30 | Biometric Shift Employee Management System has XSS via the expense_name parameter in an index.php?user=expenses request. |
| CVE-2017-17992 | 2017-12-30 | Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php form_file_name parameter in a download_form action. |
| CVE-2017-17993 | 2017-12-30 | Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=addition_deduction request. |
| CVE-2017-17994 | 2017-12-30 | Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competency_criteria request. |
| CVE-2017-17995 | 2017-12-30 | Biometric Shift Employee Management System has XSS via the Last_Name parameter in an index.php?user=ajax request. |
| CVE-2017-12810 | 2017-12-30 | PHPJabbers PHP Newsletter Script 4.2 has stored XSS in lists in the admin panel. |
| CVE-2017-12811 | 2017-12-30 | PHPJabbers Star Rating Script 4.0 has stored XSS via a rating item. |
| CVE-2017-12812 | 2017-12-30 | PHPJabbers Night Club Booking Software has stored XSS in the name parameter in the reservations tab. |
| CVE-2017-12813 | 2017-12-30 | PHPJabbers File Sharing Script 1.0 has stored XSS in the comments section. |
| CVE-2017-17997 | 2017-12-30 | In Wireshark before 2.2.12, the MRDISC dissector misuses a NULL pointer and crashes. This was addressed in epan/dissectors/packet-mrdisc.c by validating an IPv4 address. This vulnerability is similar to CVE-2017-9343. |
| CVE-2017-14855 | 2017-12-30 | Red Lion HMI panels allow remote attackers to cause a denial of service (software exception) via an HTTP POST request to a long URI that does not exist, as demonstrated... |
| CVE-2017-17089 | 2017-12-30 | custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionality. |
| CVE-2016-10704 | 2017-12-30 | Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503. |