SB17-219: Vulnerability Summary for the Week of July 31, 2017

By Newsroom America Feeds at 7 Aug 2017

Original release date: August 07, 2017

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0

Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9

Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.

 

High VulnerabilitiesPrimary
Vendor -- ProductDescriptionPublishedCVSS ScoreSource & Patch Infocacti -- cactispikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.2017-08-017.5CVE-2017-12065
BID
CONFIRM
CONFIRM
CONFIRMcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to execute arbitrary commands as root by leveraging local network access and connecting to the syseventd server, as demonstrated by copying configuration data into a readable filesystem.2017-07-3010.0CVE-2017-9479
MISCcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to obtain root access to the Network Processor (NP) Linux system by enabling a TELNET daemon (through CVE-2017-9479 exploitation) and then establishing a TELNET session.2017-07-3010.0CVE-2017-9482
MISCcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows Network Processor (NP) Linux users to obtain root access to the Application Processor (AP) Linux system via shell metacharacters in commands.2017-07-3010.0CVE-2017-9483
MISCcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST); Cisco DPC3941T (firmware version DPC3941_2.5s3_PROD_sey); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices allows remote attackers to execute arbitrary code via a specific (but unstated) exposed service. NOTE: the scope of this CVE does NOT include the concept of "Unnecessary Services" in general; the scope is only a single service that is unnecessarily exposed, leading to remote code execution. The details of that service might be disclosed at a later date.2017-07-307.5CVE-2017-9521
MISCcisco -- mx011anm_firmwareThe Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows physically proximate attackers to execute arbitrary commands as root by pulling up the diagnostics menu on the set-top box, and then posting to a Web Inspector route.2017-07-307.2CVE-2017-9497
MISCetoilewebdesign -- ultimate_product_catalogThe Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue_update_order list-item, video_update_order video-item, image_update_order list-item, tag_group_update_order list_item, category_products_update_order category-product-item, custom_fields_update_order field-item, categories_update_order category-item, subcategories_update_order subcategory-item, and tags_update_order tag-list-item.2017-08-027.5CVE-2017-12199
MISCglpi-project -- glpiSQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter.2017-07-287.5CVE-2017-11184
CONFIRM
CONFIRMibm -- bigfix_platformIBM Tivoli Endpoint Manager could allow a unauthorized user to consume all resources and crash the system. IBM X-Force ID: 123906.2017-07-317.8CVE-2017-1227
CONFIRM
MISCimagemagick -- imagemagickThe ReadDCMImage function in coders\dcm.c in ImageMagick 7.0.6-1 has an integer signedness error leading to excessive memory consumption via a crafted DCM file.2017-08-027.1CVE-2017-12140
BID
CONFIRMimagemagick -- imagemagickIn ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service.2017-08-047.8CVE-2017-12429
CONFIRMimagemagick -- imagemagickIn ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of service.2017-08-047.8CVE-2017-12430
CONFIRMimagemagick -- imagemagickIn ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadPCXImage in coders/pcx.c, which allows attackers to cause a denial of service.2017-08-047.1CVE-2017-12432
CONFIRMimagemagick -- imagemagickIn ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service.2017-08-047.8CVE-2017-12435
CONFIRMinversepath -- tenshiTenshi 0.15 creates a tenshi.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tenshi.pid modification before a root script executes a "kill `cat /pathname/tenshi.pid`" command.2017-07-307.8CVE-2017-11746
MISCkiri -- tweenUntrusted search path vulnerability in Tween Ver1.6.6.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-08-029.3CVE-2017-2279
JVNlame_project -- lameThere is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file.2017-07-287.5CVE-2017-11720
MISCmicrosoft -- outlookMicrosoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a remote code execution vulnerability due to the way Microsoft Outlook parses specially crafted email messages, aka "Microsoft Office Outlook Memory Corruption Vulnerability"2017-08-019.3CVE-2017-8663
BID
SECTRACK
CONFIRMnetcomm -- 4gt101w_bootloaderNetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 do not require authentication for logfile.html, status.html, or system_config.html.2017-07-287.5CVE-2017-11645
MISCnvidia -- gpu_driverNVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of an input buffer is not validated which may lead to denial of service or potential escalation of privileges2017-07-287.2CVE-2017-6253
CONFIRMnvidia -- gpu_driverNVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer passed from an user to the driver is used without validation which may lead to denial of service or potential escalation of privileges.2017-07-287.2CVE-2017-6254
CONFIRMnvidia -- gpu_driverNVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where an improper input parameter handling may lead to a denial of service or potential escalation of privileges.2017-07-287.2CVE-2017-6255
CONFIRMopenexif_project -- openexifThe ExifImageFile::readImage function in ExifImageFileRead.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted jpg file.2017-07-317.1CVE-2017-11118
MISCtimidity++_project -- timidity++The play_midi function in playmidi.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mid file. NOTE: CPU consumption might be relevant when using the --background option.2017-07-317.1CVE-2017-11549
MISCtrendmicro -- control_managerSQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x1b07 due to lack of proper user input validation in cmdHandlerTVCSCommander.dll. Fomerly ZDI-CAN-4560.2017-08-027.5CVE-2017-11383
BID
SECTRACK
MISC
MISCtrendmicro -- control_managerSQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due to lack of proper user input validation in mdHandlerLicenseManager.dll. Fomerly ZDI-CAN-4561.2017-08-027.5CVE-2017-11384
BID
SECTRACK
MISC
MISCtrendmicro -- control_managerSQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x6b1b due to lack of proper user input validation in cmdHandlerStatusMonitor.dll. Formerly ZDI-CAN-4545.2017-08-027.5CVE-2017-11385
BID
SECTRACK
MISC
MISCtrendmicro -- control_managerSQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input validation in cmdHandlerNewReportScheduler.dll. Formerly ZDI-CAN-4549.2017-08-027.5CVE-2017-11386
BID
SECTRACK
MISC
MISCtrendmicro -- control_managerDirectory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing directory. Formerly ZDI-CAN-4684.2017-08-027.5CVE-2017-11389
BID
SECTRACK
MISC
MISCtrendmicro -- deep_discovery_directorA command injection vulnerability exists in Trend Micro Deep Discovery Director 1.1 that allows an attacker to restore accounts that can access the pre-configuration console.2017-08-017.5CVE-2017-11381
CONFIRM
MISCtrendmicro -- interscan_messaging_security_virtual_applianceProxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "t" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744.2017-08-039.0CVE-2017-11391
BID
MISC
MISCtrendmicro -- officescanProxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the tr parameter within Proxy.php. Formerly ZDI-CAN-4543.2017-08-0310.0CVE-2017-11393
BID
MISC
MISCBack to top

 

Medium VulnerabilitiesPrimary
Vendor -- ProductDescriptionPublishedCVSS ScoreSource & Patch Infoarris -- tg1682g_firmwareThe Comcast firmware on Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST) devices allows configuration changes via CSRF.2017-07-306.8CVE-2017-9489
MISCartifex -- ghostscriptpsi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document, related to an out-of-bounds read in the igc_reloc_struct_ptr function in psi/igc.c.2017-07-286.8CVE-2017-11714
CONFIRM
CONFIRMbigtreecms -- bigtree_cmsSQL injection vulnerability in core\admin\auto-modules\forms\process.php in BigTree 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via the tags array parameter.2017-07-296.5CVE-2017-11736
MISCcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST) and DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices sets the CM MAC address to a value with a two-byte offset from the MTA/VoIP MAC address, which indirectly allows remote attackers to discover hidden Home Security Wi-Fi networks by leveraging the embedding of the MTA/VoIP MAC address into the DNS hostname.2017-07-305.0CVE-2017-9478
MISCcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to obtain unintended access to the Network Processor (NP) 169.254/16 IP network by adding a routing-table entry that specifies the LAN IP address as the router for that network.2017-07-305.0CVE-2017-9481
MISCcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST) and DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to discover a CM MAC address by sniffing Wi-Fi traffic and performing simple arithmetic calculations.2017-07-305.0CVE-2017-9484
MISCcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to write arbitrary data to a known /var/tmp/sess_* pathname by leveraging the device's operation in UI dev mode.2017-07-305.0CVE-2017-9485
MISCcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to compute password-of-the-day values via unspecified vectors.2017-07-305.0CVE-2017-9486
MISCcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) and DPC3941T (firmware version DPC3941_2.5s3_PROD_sey) devices allows remote attackers to discover a WAN IPv6 IP address by leveraging knowledge of the CM MAC address.2017-07-304.3CVE-2017-9487
MISCcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) and DPC3941T (firmware version DPC3941_2.5s3_PROD_sey) devices allows remote attackers to access the web UI by establishing a session to the wan0 WAN IPv6 address and then entering unspecified hardcoded credentials. This wan0 interface cannot be accessed from the public Internet.2017-07-305.8CVE-2017-9488
MISCcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST); Cisco DPC3941T (firmware version DPC3941_2.5s3_PROD_sey); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices does not set the secure flag for cookies in an https session to an administration application, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session.2017-07-305.0CVE-2017-9491
MISCcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST); Cisco DPC3941T (firmware version DPC3941_2.5s3_PROD_sey); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices does not include the HTTPOnly flag in a Set-Cookie header for administration applications, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.2017-07-305.0CVE-2017-9492
MISCcisco -- iosCisco IOS before 15.2(4)S6 does not initialize an unspecified variable, which might allow remote authenticated users to cause a denial of service (CPU consumption, watchdog timeout, crash) by walking specific SNMP objects.2017-08-026.8CVE-2012-5030
CISCOcisco -- mx011anm_firmwareThe Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows remote attackers to conduct successful forced-pairing attacks (between an RF4CE remote and a set-top box) by repeatedly transmitting the same pairing code.2017-07-305.8CVE-2017-9493
MISCcisco -- mx011anm_firmwareThe Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows physically proximate attackers to access an SNMP server by connecting a cable to the Ethernet port, and then establishing communication with the device's link-local IPv6 address.2017-07-304.6CVE-2017-9496
MISCconnectwise -- manageservices/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery (CSRF), as demonstrated by changing an e-mail address setting.2017-07-316.8CVE-2017-11726
MISCconnectwise -- manageservices/system_io/actionprocessor/Contact.rails in ConnectWise Manage 2017.5 allows arbitrary client-side JavaScript code execution (involving a ContactCommon field) on victims who click on a crafted link, aka XSS.2017-07-314.3CVE-2017-11727
MISCearcms -- ear_musicIn Earcms Ear Music through 4.1 build 20170710, remote authenticated users can execute arbitrary PHP code by changing the allowable music-upload extensions to include .php in addition to .mp3 and .m4a in admin.php?iframe=config_upload, and then using user.php/music/add/ to upload the code.2017-07-306.0CVE-2017-11756
MISCffmpeg -- ffmpegThe dnxhd_decode_header function in libavcodec/dnxhddec.c in FFmpeg through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via a crafted DNxHD file.2017-07-286.8CVE-2017-11719
BID
CONFIRMgigaccsecure -- gigacc_officeGigaCC OFFICE ver.2.3 and earlier allows remote attackers to execute arbitrary OS commands via specially crafted mail template.2017-08-026.0CVE-2016-7844
BID
MISC
MISCgigaccsecure -- gigacc_officeGigaCC OFFICE ver.2.3 and earlier allows remote attackers to upload arbitrary files as a user profile image, which may be exploited for unauthorized file sharing.2017-08-025.5CVE-2016-7845
BID
MISC
MISCgitlab -- gitlabGitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read repositories belonging to other users.2017-08-024.0CVE-2017-11437
CONFIRMgnu -- glibcThe DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation.2017-08-014.3CVE-2017-12132
MISC
MISCgraphicsmagick -- graphicsmagickThe WriteOnePNGImage function in coders/png.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file, because the program's actual control flow was inconsistent with its indentation. This resulted in a logging statement executing outside of a loop, and consequently using an invalid array index corresponding to the loop's exit condition.2017-07-284.3CVE-2017-11722
MISCibm -- api_connectIBM API Connect 5.0.0.0 could allow a user to bypass policy restrictions and create non-compliant passwords which could be intercepted and decrypted using man in the middle techniques. IBM X-Force ID: 127160.2017-07-314.3CVE-2017-1386
CONFIRM
BID
MISCibm -- iIBM i OSPF 6.1, 7.1, 7.2, and 7.3 is vulnerable when a rogue router spoofs its origin. Routing tables are affected by a missing LSA, which may lead to loss of connectivity. IBM X-Force ID: 128379.2017-07-315.0CVE-2017-1460
MISC
MISCibm -- infosphere_information_serverIBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 127155.2017-08-026.4CVE-2017-1383
CONFIRM
MISCibm -- infosphere_information_serverA network layer security vulnerability in InfoSphere Information Server 9.1, 11.3, and 11.5 can lead to privilege escalation or unauthorized access. IBM X-Force ID: 128466.2017-08-026.8CVE-2017-1467
CONFIRM
BID
MISCibm -- infosphere_information_serverIBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a local user to gain elevated privileges by placing arbitrary files in installation directories. IBM X-force ID: 128467.2017-08-024.6CVE-2017-1468
CONFIRM
BID
MISCibm -- infosphere_information_serverIBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a privileged user to cause a memory dump that could contain highly sensitive information including access credentials. IBM X-Force ID: 128693.2017-08-024.0CVE-2017-1495
CONFIRM
MISCibm -- infosphere_master_data_management_serverIBM InfoSphere Master Data Management Server 10.1, 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 119727.2017-07-316.8CVE-2016-9714
CONFIRM
MISCibm -- infosphere_master_data_management_serverIBM InfoSphere Master Data Management Server 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 119729.2017-07-316.8CVE-2016-9716
CONFIRM
BID
MISCibm -- infosphere_master_data_management_serverHTTP Parameter Override is identified in the IBM Infosphere Master Data Management (MDM) 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 product. It enables attackers by exposing the presence of duplicated parameters which may produce an anomalous behavior in the application that can be potentially exploited.2017-07-314.0CVE-2016-9717
CONFIRM
BID
MISCibm -- inotesIBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126062.2017-08-034.3CVE-2017-1327
CONFIRM
BID
MISCibm -- inotesIBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126234.2017-07-314.3CVE-2017-1332
CONFIRM
BID
MISCibm -- jazz_reporting_serviceIBM Jazz Reporting Service (JRS) 5.0 and 6.0 could disclose sentive information, including user credentials, through an error message from the Report Builder administrator configuration page. IBM X-Force ID: 126863.2017-07-314.0CVE-2017-1370
CONFIRM
BID
MISCibm -- mobilefirst_platform_foundationA Reflected Cross Site Scripting (XSS) vulnerability exists in the authorization function exposed by RESTful Web Api of IBM Worklight Framework 6.1, 6.2, 6.3, 7.0, 7.1, and 8.0. The vulnerable parameter is "scope"; if you set as its value a "realm" not defined in authenticationConfig.xml, you get an HTTP 403 Forbidden response and the value will be reflected in the body of the HTTP response. By setting it to arbitrary JavaScript code it is possible to modify the flow of the authorization function, potentially leading to credential disclosure within a trusted session.2017-08-014.3CVE-2017-1500
CONFIRM
MISCibm -- websphere_application_serverIBM WebSphere Application Server version 9.0.0.4 could provide weaker than expected security after using the PasswordUtil command to enable AES password encryption. IBM X-Force ID: 129579.2017-08-034.0CVE-2017-1504
CONFIRM
BID
MISCibm -- websphere_mq_internet_pass-thruIBM WebSphere MQ Internet Pass-Thru 2.0 and 2.1 could allow n attacker to cause the MQIPT to stop responding due to an incorrectly configured security policy. IBM X-Force ID: 121156.2017-08-025.0CVE-2017-1118
CONFIRM
BID
MISCibm -- websphere_portalIBM WebSphere Portal and Web Content Manager 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125457.2017-07-314.3CVE-2017-1303
CONFIRM
BID
MISCiid -- rbb_speed_testThe RBB SPEED TEST App for Android version 2.0.3 and earlier, RBB SPEED TEST App for iOS version 2.1.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.2017-08-024.3CVE-2017-2278
MISC
JVNimagemagick -- imagemagickThe ReadMATImage function in coders/mat.c in ImageMagick through 6.9.9-3 and 7.x through 7.0.6-3 has memory leaks involving the quantum_info and clone_info data structures.2017-07-294.3CVE-2017-11724
CONFIRMimagemagick -- imagemagickThe ReadOneJNGImage function in coders/png.c in ImageMagick 6.9.9-4 and 7.0.6-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.2017-07-304.3CVE-2017-11750
CONFIRMimagemagick -- imagemagickThe WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file.2017-07-304.3CVE-2017-11751
CONFIRMimagemagick -- imagemagickThe ReadMAGICKImage function in coders/magick.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file.2017-07-304.3CVE-2017-11752
CONFIRMimagemagick -- imagemagickThe GetImageDepth function in MagickCore/attribute.c in ImageMagick 7.0.6-4 might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted Flexible Image Transport System (FITS) file.2017-07-304.3CVE-2017-11753
MISCimagemagick -- imagemagickThe WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file that is mishandled in an OpenPixelCache call.2017-07-304.3CVE-2017-11754
MISCimagemagick -- imagemagickThe WritePICONImage function in coders/xpm.c in ImageMagick 7.0.6-4 allows remote attackers to cause a denial of service (memory leak) via a crafted file that is mishandled in an AcquireSemaphoreInfo call.2017-07-304.3CVE-2017-11755
MISCimagemagick -- imagemagickImageMagick 7.0.6-5 has memory leaks in the parse8BIMW and format8BIM functions in coders/meta.c, related to the WriteImage function in MagickCore/constitute.c.2017-08-035.0CVE-2017-12418
CONFIRMimagemagick -- imagemagickThe ProcessMSLScript function in coders/msl.c in ImageMagick before 6.9.9-5 and 7.x before 7.0.6-5 allows remote attackers to cause a denial of service (memory leak) via a crafted file, related to the WriteMSLImage function.2017-08-044.3CVE-2017-12427
CONFIRM
CONFIRMimagemagick -- imagemagickIn ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service in CloneDrawInfo in draw.c.2017-08-045.0CVE-2017-12428
CONFIRMimagemagick -- imagemagickIn ImageMagick 7.0.6-1, a use-after-free vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service.2017-08-044.3CVE-2017-12431
CONFIRMimagemagick -- imagemagickIn ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadPESImage in coders/pes.c, which allows attackers to cause a denial of service, related to ResizeMagickMemory in memory.c.2017-08-044.3CVE-2017-12433
CONFIRMimagemagick -- imagemagickIn ImageMagick 7.0.6-1, a missing NULL check vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service (assertion failure) in DestroyImageInfo in image.c.2017-08-044.3CVE-2017-12434
CONFIRMjoomla -- joomla!The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs.2017-08-026.5CVE-2017-11364
SECTRACK
CONFIRM
MISC
MISClibid3tag_project -- libid3tagThe id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.2017-07-314.3CVE-2017-11550
MISClibid3tag_project -- libid3tagThe id3_field_parse function in field.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (OOM) via a crafted MP3 file.2017-07-314.3CVE-2017-11551
MISClibming -- mingA memory leak vulnerability was found in the function parseSWF_DOACTION in util/parser.c in Ming 0.4.8, which allows attackers to cause a denial of service via a crafted file.2017-07-284.3CVE-2017-11703
MISC
MISClibming -- mingA heap-based buffer over-read was found in the function decompileIF in util/decompile.c in Ming 0.4.8, which allows attackers to cause a denial of service via a crafted file.2017-07-284.3CVE-2017-11704
MISC
MISClibming -- mingA memory leak was found in the function parseSWF_SHAPEWITHSTYLE in util/parser.c in Ming 0.4.8, which allows attackers to cause a denial of service via a crafted file.2017-07-284.3CVE-2017-11705
MISC
MISClibming -- mingA heap-based buffer over-read was found in the function OpCode (called from decompileSETMEMBER) in util/decompile.c in Ming 0.4.8, which allows attackers to cause a denial of service via a crafted file.2017-07-294.3CVE-2017-11728
MISC
MISClibming -- mingA heap-based buffer over-read was found in the function OpCode (called from decompileINCR_DECR line 1440) in util/decompile.c in Ming 0.4.8, which allows attackers to cause a denial of service via a crafted file.2017-07-294.3CVE-2017-11729
MISC
MISClibming -- mingA heap-based buffer over-read was found in the function OpCode (called from decompileINCR_DECR line 1474) in util/decompile.c in Ming 0.4.8, which allows attackers to cause a denial of service via a crafted file.2017-07-294.3CVE-2017-11730
MISC
MISClibming -- mingAn invalid memory read vulnerability was found in the function OpCode (called from isLogicalOp and decompileIF) in util/decompile.c in Ming 0.4.8, which allows attackers to cause a denial of service via a crafted file.2017-07-294.3CVE-2017-11731
MISC
MISClibming -- mingA heap-based buffer overflow vulnerability was found in the function dcputs (called from decompileIMPLEMENTS) in util/decompile.c in Ming 0.4.8, which allows attackers to cause a denial of service via a crafted file.2017-07-294.3CVE-2017-11732
MISC
MISClibming -- mingA null pointer dereference vulnerability was found in the function stackswap (called from decompileSTACKSWAP) in util/decompile.c in Ming 0.4.8, which allows attackers to cause a denial of service via a crafted file.2017-07-294.3CVE-2017-11733
MISC
MISClibming -- mingA heap-based buffer over-read was found in the function decompileCALLFUNCTION in util/decompile.c in Ming 0.4.8, which allows attackers to cause a denial of service via a crafted file.2017-07-294.3CVE-2017-11734
MISC
MISClibquicktime -- libquicktimeIn libquicktime 1.2.4, an allocation failure was found in the function quicktime_read_info in lqt_quicktime.c, which allows attackers to cause a denial of service via a crafted file.2017-08-024.3CVE-2017-12143
MISC
MISClibquicktime -- libquicktimeIn libquicktime 1.2.4, an allocation failure was found in the function quicktime_read_ftyp in ftyp.c, which allows attackers to cause a denial of service via a crafted file.2017-08-024.3CVE-2017-12145
MISC
MISCmicrosoft -- outlookMicrosoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows a security feature bypass vulnerability due to the way that it handles input, aka "Microsoft Office Outlook Security Feature Bypass Vulnerability".2017-08-016.8CVE-2017-8571
BID
SECTRACK
CONFIRMmicrosoft -- outlookMicrosoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, and Outlook 2016 as packaged in Microsoft Office allows an information disclosure vulnerability due to the way that it discloses the contents of its memory, aka "Microsoft Office Outlook Information Disclosure Vulnerability".2017-08-014.3CVE-2017-8572
BID
SECTRACK
CONFIRMmodx -- modx_revolutionIn MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS. A malicious payload sent to connectors/index.php will be triggered by every user, when they visit this module.2017-07-304.3CVE-2017-11744
MISCmotorola -- mx011anm_firmwareThe Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows remote attackers to enable a Remote Web Inspector that is accessible from the public Internet.2017-07-305.0CVE-2017-9494
MISCnetcomm -- 4gt101w_bootloaderNetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 are vulnerable to CSRF attacks, as demonstrated by using administration.html to disable the firewall. They does not contain any token that can mitigate CSRF vulnerabilities within the device.2017-07-286.8CVE-2017-11646
MISCnvidia -- gpu_driverNVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value passed from a user to the driver is not correctly validated and used as the index to an array which may lead to denial of service or potential escalation of privileges.2017-07-284.6CVE-2017-6256
CONFIRMopen-emr -- openemrThe csv_log_html function in library/edihistory/edih_csv_inc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name.2017-08-015.0CVE-2017-12064
CONFIRMopenexif_project -- openexifThe ExifJpegHUFFTable::deriveTable function in ExifHuffmanTable.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted jpg file.2017-07-314.3CVE-2017-11115
MISCopenexif_project -- openexifThe ExifImageFile::readDQT function in ExifImageFileRead.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted jpg file.2017-07-316.8CVE-2017-11116
MISCopenexif_project -- openexifThe ExifImageFile::readDHT function in ExifImageFileRead.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted jpg file.2017-07-314.3CVE-2017-11117
MISCpaloaltonetworks -- pan-osCross-site scripting (XSS) vulnerability in the management web interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.2017-08-024.3CVE-2017-9459
BID
SECTRACK
CONFIRMpaloaltonetworks -- pan-osCross-site scripting (XSS) vulnerability in the GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.2017-08-024.3CVE-2017-9467
BID
SECTRACK
CONFIRMpega -- pega_platformMultiple cross-site scripting (XSS) vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to the main page; the (2) beanReference parameter to the JavaBean viewer page; or the (3) pyTableName to the System database schema modification page.2017-08-024.3CVE-2017-11355
FULLDISCpega -- pega_platformThe application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privileges to obtain sensitive configuration information by leveraging a missing access control.2017-08-024.0CVE-2017-11356
FULLDISCqemu -- qemuqemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.2017-08-025.0CVE-2017-10664
MLIST
BID
MISC
MLISTrspamd_project -- rspamdinterface/js/app/history.js in WebUI in Rspamd before 1.6.3 allows XSS via the Subject and Message-Id headers, which are mishandled in the history page.2017-07-294.3CVE-2017-11737
CONFIRM
CONFIRMsamsung -- samsung_mobileRace condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with Android L(5.0/5.1) allows local users to trigger memory errors by leveraging definition of g2d_lock and g2d_unlock lock macros as no-ops, aka SVE-2015-4598.2017-08-024.4CVE-2015-7891
MISC
CONFIRM
BID
MISC
EXPLOIT-DBsilkypress -- simple_custom_css_and_jsCross-site scripting vulnerability in Simple Custom CSS and JS prior to version 3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.2017-08-024.3CVE-2017-2285
JVN
MISC
MISC
MISCsound_exchange_project -- sound_exchangeThe startread function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted wav file.2017-07-314.3CVE-2017-11332
MISCsound_exchange_project -- sound_exchangeThe read_samples function in hcom.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted hcom file.2017-07-314.3CVE-2017-11358
MISCsound_exchange_project -- sound_exchangeThe wavwritehdr function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted snd file, during conversion to a wav file.2017-07-314.3CVE-2017-11359
MISCtechroutes -- tr_1803-3g_firmwareTechroutes TR 1803-3G Wireless Cellular Router/Modem 2.4.25 devices do not possess any protection against a CSRF vulnerability, as demonstrated by a goform/BasicSettings request to disable port filtering.2017-07-316.8CVE-2017-11648
MISCtimidity++_project -- timidity++The insert_note_steps function in readmidi.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted mid file. NOTE: a crash might be relevant when using the --background option.2017-07-314.3CVE-2017-11546
MISCtimidity++_project -- timidity++The resample_gauss function in resample.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted mid file. NOTE: a crash might be relevant when using the --background option. NOTE: the TiMidity++ README.alsaseq documentation suggests a setuid-root installation.2017-07-314.3CVE-2017-11547
MISCtrendmicro -- control_managerAuthentication Bypass in Trend Micro Control Manager 6.0 causes Information Disclosure when authentication validation is not done for functionality that can change debug logging level. Formerly ZDI-CAN-4512.2017-08-025.0CVE-2017-11387
BID
SECTRACK
MISC
MISCtrendmicro -- control_managerSQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate user provided strings before constructing SQL queries. Formerly ZDI-CAN-4639 and ZDI-CAN-4638.2017-08-026.5CVE-2017-11388
BID
SECTRACK
MISC
MISC
MISCtrendmicro -- control_managerXML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lead to information disclosure. Formerly ZDI-CAN-4706.2017-08-025.0CVE-2017-11390
BID
MISC
MISCtrendmicro -- deep_discovery_email_inspectorDenial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote attackers to delete arbitrary files on vulnerable installations, thus disabling the service. Formerly ZDI-CAN-4350.2017-08-036.4CVE-2017-11382
BID
MISC
MISCtrendmicro -- interscan_messaging_security_virtual_applianceProxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "T" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745.2017-08-036.5CVE-2017-11392
BID
MISC
MISCvmware -- vcenter_serverVMware vCenter Server (6.5 prior to 6.5 U1) contains an insecure library loading issue that occurs due to the use of LD_LIBRARY_PATH variable in an unsafe manner. Successful exploitation of this issue may allow unprivileged host users to load a shared library that may lead to privilege escalation.2017-08-016.5CVE-2017-4921
BID
SECTRACK
CONFIRMvmware -- vcenter_serverVMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure issue due to the service startup script using world writable directories as temporary storage for critical information. Successful exploitation of this issue may allow unprivileged host users to access certain critical information when the service gets restarted.2017-08-014.0CVE-2017-4922
BID
SECTRACK
CONFIRMvmware -- vcenter_serverVMware vCenter Server (6.5 prior to 6.5 U1) contains an information disclosure vulnerability. This issue may allow plaintext credentials to be obtained when using the vCenter Server Appliance file-based backup feature.2017-08-015.0CVE-2017-4923
BID
SECTRACK
CONFIRMwppopupmaker -- popup_makerCross-site scripting vulnerability in Popup Maker prior to version 1.6.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.2017-08-024.3CVE-2017-2284
JVN
MISC
MISCxinha -- xinhaDirectory traversal vulnerability in plugins/ImageManager/backend.php in Xinha 0.96, as used in Jojo 4.4.0, allows remote attackers to delete any folder via directory traversal sequences in the deld parameter.2017-07-295.0CVE-2017-11723
CONFIRMxiph.org -- libaoThe _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file.2017-07-314.3CVE-2017-11548
MISCxiph.org -- libvorbisThe vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.2017-07-314.3CVE-2017-11333
MISCxiph.org -- libvorbisThe vorbis_block_clear function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ogg file.2017-07-314.3CVE-2017-11735
MISCxiph.org -- vorbis-toolsThe wav_open function in oggenc/audio.c in Xiph.Org vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (memory allocation error) via a crafted wav file.2017-07-314.3CVE-2017-11331
MISCxoops -- xoopsXOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter.2017-08-025.8CVE-2017-12138
BID
CONFIRMxoops -- xoopsXOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php.2017-08-024.3CVE-2017-12139
BID
CONFIRMytnef_project -- ytnefIn ytnef 1.9.2, a heap-based buffer overflow vulnerability was found in the function TNEFFillMapi in ytnef.c, which allows attackers to cause a denial of service via a crafted file.2017-08-024.3CVE-2017-12141
MISC
MISCytnef_project -- ytnefIn ytnef 1.9.2, an invalid memory read vulnerability was found in the function SwapDWord in ytnef.c, which allows attackers to cause a denial of service via a crafted file.2017-08-024.3CVE-2017-12142
MISC
MISCytnef_project -- ytnefIn ytnef 1.9.2, an allocation failure was found in the function TNEFFillMapi in ytnef.c, which allows attackers to cause a denial of service via a crafted file.2017-08-024.3CVE-2017-12144
BID
MISC
MISCBack to top

 

Low VulnerabilitiesPrimary
Vendor -- ProductDescriptionPublishedCVSS ScoreSource & Patch Infocacti -- cactiCross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. NOTE: this vulnerability exists because of an incomplete fix (lack of the htmlspecialchars ENT_QUOTES flag) for CVE-2017-11163.2017-08-013.5CVE-2017-12066
CONFIRM
CONFIRM
CONFIRMcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices makes it easy for remote attackers to determine the hidden SSID and passphrase for a Home Security Wi-Fi network.2017-07-303.3CVE-2017-9476
MISCcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST) and DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows remote attackers to discover the CM MAC address by connecting to the device's xfinitywifi hotspot.2017-07-303.3CVE-2017-9477
MISCcisco -- dpc3939_firmwareThe Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) devices allows local users (e.g., users who have command access as a consequence of CVE-2017-9479 exploitation) to read arbitrary files via UPnP access to /var/IGD/.2017-07-302.1CVE-2017-9480
MISCcomcast -- xfinity_xr11-20_firmwareThe Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) and Xfinity XR11-20 Voice Remote devices allows local users to upload arbitrary firmware images to an XR11 by leveraging root access. In other words, there is no protection mechanism involving digital signatures for the firmware.2017-07-302.1CVE-2017-9498
MISCibm -- infosphere_master_data_management_serverIBM InfoSphere Master Data Management Server 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119728.2017-07-313.5CVE-2016-9715
CONFIRM
BID
MISCibm -- infosphere_master_data_management_serverIBM InfoSphere Master Data Management Server 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119732.2017-07-313.5CVE-2016-9718
CONFIRM
BID
MISCibm -- infosphere_master_data_management_serverIBM InfoSphere Master Data Management Server 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 119733.2017-07-313.5CVE-2016-9719
CONFIRM
BID
MISCibm -- infosphere_master_data_management_serverIBM InfoSphere Master Data Management Server 10.0, 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123674.2017-08-033.5CVE-2017-1199
CONFIRM
BID
MISCibm -- sterling_b2b_integratorIBM Sterling B2B Integrator Standard Edition 5.2.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128694.2017-07-313.5CVE-2017-1496
CONFIRM
MISCmotorola -- mx011anm_firmwareThe Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) devices allows physically proximate attackers to read arbitrary files by pressing "EXIT, Down, Down, 2" on an RF4CE remote to reach the diagnostic display, and then launching a Remote Web Inspector script.2017-07-302.1CVE-2017-9495
MISCnetcomm -- 4gt101w_bootloaderNetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 are vulnerable to stored cross-site scripting attacks. Creating an SSID with an XSS payload results in successful exploitation.2017-07-283.5CVE-2017-11647
MISCqemu -- qemuStack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages.2017-08-022.1CVE-2017-10806
MLIST
BID
CONFIRM
MLISTqemu -- qemuThe address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area.2017-08-022.1CVE-2017-11334
MLIST
BID
CONFIRM
MLISTtinyproxy_project -- tinyproxymain.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tinyproxy.pid modification before a root script executes a "kill `cat /run/tinyproxy/tinyproxy.pid`" command.2017-07-302.1CVE-2017-11747
MISCBack to top

 

Severity Not Yet AssignedPrimary
Vendor -- ProductDescriptionPublishedCVSS ScoreSource & Patch Infoaxis_communications -- axis_2100_devices
 AXIS 2100 devices 2.43 have XSS via the URI, possibly related to admin/admin.shtml.2017-08-04not yet calculatedCVE-2017-12413
MISCbaidu_japan -- baidu_ime
 Untrusted search path vulnerability in Installer of Baidu IME Ver3.6.1.6 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-08-04not yet calculatedCVE-2017-2221
JVNbank_of_tokyo-mitsubishi_ufj -- bank_of_tokyo-mitsubishi_ufj_app
 The Bank of Tokyo-Mitsubishi UFJ, Ltd. App for Android ver5.3.1, ver5.2.2 and earlier allow a man-in-the-middle attacker to downgrade the communication between the app and the server from TLS v1.2 to SSL v3.0, which may result in the attacker to eavesdrop on an encrypted communication.2017-08-02not yet calculatedCVE-2016-7812
BID
MISCbrother_industries -- dcp_printers
 Denial of Service vulnerability in Debut embedded httpd 1.20 in Brother DCP-J132W (and probably other DCP models) allows remote attackers to hang the printer (disrupting its network connection) by sending a large amount of HTTP packets.2017-08-05not yet calculatedCVE-2017-12568
MISCcitrix -- netscaler_devices
 The TLS and DTLS processing functionality in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway devices with firmware 9.x before 9.3 Build 68.5, 10.0 through Build 78.6, 10.1 before Build 130.13, 10.1.e before Build 130.1302.e, 10.5 before Build 55.8, and 10.5.e before Build 55.8007.e makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).2017-08-02not yet calculatedCVE-2015-3642
CONFIRMclaybird -- lhhaforge
 Untrusted search path vulnerability in LhaForge Ver.1.6.5 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-08-02not yet calculatedCVE-2017-2288
JVNcomcast -- arris_tg1682g_devices
 The Comcast firmware on Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices allows configuration changes via CSRF.2017-07-30not yet calculatedCVE-2017-9490
MISCcomcast -- xfinity_wifi_home_hotspot
 Comcast XFINITY WiFi Home Hotspot devices allow remote attackers to spoof the identities of Comcast customers via a forged MAC address.2017-07-30not yet calculatedCVE-2017-9475
MISCdashlane -- dashlane
 Dashlane might allow local users to gain privileges by placing a Trojan horse WINHTTP.dll in the %APPDATA%\Dashlane directory.2017-08-04not yet calculatedCVE-2017-11657
MISCdell -- storage_manager_2016
 Directory Traversal in Dell Storage Manager 2016 R2.1 causes Information Disclosure when the doGet method of the EmWebsiteServlet class doesn't properly validate user provided path before using it in file operations. Was ZDI-CAN-4459.2017-08-04not yet calculatedCVE-2017-10949
MISC
BID
MISCdivfix++ -- divfix++
 The DivFixppCore::avi_header_fix function in DivFix++Core.cpp in DivFix++ v0.34 allows remote attackers to cause a denial of service (invalid memory write and application crash) via a crafted avi file.2017-07-31not yet calculatedCVE-2017-11330
MISCdokuwiki -- dokuwiki
 DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php.2017-08-05not yet calculatedCVE-2017-12583
CONFIRMexpat -- expat
 The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory because of an untrusted search path, aka DLL hijacking.2017-07-30not yet calculatedCVE-2017-11742
CONFIRMf-secure_online_scanner -- f-secure_online_scanner
 Untrusted search path vulnerability in F-Secure Online Scanner allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is located in the same folder as F-SecureOnlineScanner.exe.2017-08-02not yet calculatedCVE-2015-8264
FULLDISC
BUGTRAQ
BID
CONFIRMfreetime -- formatfactory
 FormatFactory 4.1.0 has a DLL Hijacking Vulnerability because an untrusted search path is used for msimg32.dll, WindowsCodecs.dll, and dwmapi.dll.2017-08-03not yet calculatedCVE-2017-12414
MISCfrogman_office -- cs-cart
 Cross-site request forgery (CSRF) vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to hijack the authentication of administrators via unspecified vectors.2017-08-02not yet calculatedCVE-2017-2138
MISC
JVNgithub_inc -- electron
 GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user's host. Specifically, a chrome-devtools://devtools/bundled/inspector.html window could be used to eval a Node.js child_process.execFile API call.2017-08-05not yet calculatedCVE-2017-12581
MISCgitlab -- community_and_enterprise_editions
 GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup.2017-08-02not yet calculatedCVE-2017-11438
CONFIRMgnu_binutils -- gnu_binutilsThe bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted mach-o file.2017-08-04not yet calculatedCVE-2017-12452
MISCgnu_binutils -- gnu_binutilsThe bfd_make_section_with_flags function in section.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a NULL dereference via a crafted file.2017-08-04not yet calculatedCVE-2017-12457
MISCgnu_binutils -- gnu_binutils
 The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file.2017-08-04not yet calculatedCVE-2017-12456
MISCgnu_binutils -- gnu_binutils
 The nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted nlm file.2017-08-04not yet calculatedCVE-2017-12458
MISCgnu_binutils -- gnu_binutils
 The bfd_mach_o_read_symtab_strtab function in bfd/mach-o.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted mach-o file.2017-08-04not yet calculatedCVE-2017-12459
MISCgnu_binutils -- gnu_binutils
 The evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.2017-08-04not yet calculatedCVE-2017-12455
MISCgnu_binutils -- gnu_binutils
 The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.2017-08-04not yet calculatedCVE-2017-12454
MISCgnu_binutils -- gnu_binutils
 The _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds stack read via a crafted COFF image file.2017-08-04not yet calculatedCVE-2017-12451
MISCgnu_binutils -- gnu_binutils
 The _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.2017-08-04not yet calculatedCVE-2017-12453
MISCgnu_binutils -- gnu_binutils
 The alpha_vms_object_p function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted vms alpha file.2017-08-04not yet calculatedCVE-2017-12450
MISCgnu_binutils -- gnu_binutils
 The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms file.2017-08-04not yet calculatedCVE-2017-12449
MISCgnu_binutils -- gnu_binutils
 The bfd_cache_close function in bfd/cache.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a heap use after free and possibly achieve code execution via a crafted nested archive file. This issue occurs because incorrect functions are called during an attempt to release memory. The issue can be addressed by better input validation in the bfd_generic_archive_p function in bfd/archive.c.2017-08-04not yet calculatedCVE-2017-12448
MISChashicorp -- vagrant_vmware_fusion_plugin
 The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local users to gain root privileges by leveraging failure to verify the path to the encoded ruby script or scrub the PATH variable.2017-08-02not yet calculatedCVE-2017-7642
FULLDISC
CONFIRM
MISCheinekingmedia -- stashcat_for_androidAn issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is hashed directly with SHA-512 without a salt or another key-derivation mechanism to enable a secure secret for authentication. Moreover, only the first 32 bytes of the hash are used. This allows for easy dictionary and rainbow-table attacks if an attacker has access to the password hash.2017-08-01not yet calculatedCVE-2017-11131
MISCheinekingmedia -- stashcat_for_androidAn issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The logout mechanism does not check for authorization. Therefore, an attacker only needs to know the device ID. This causes a denial of service. This might be interpreted as a vulnerability in customer-controlled software, in the sense that the StashCat client side has no secure way to signal that it is ending a session and that data should be deleted.2017-08-01not yet calculatedCVE-2017-11135
MISCheinekingmedia -- stashcat_for_android
 An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. It uses RSA to exchange a secret for symmetric encryption of messages. However, the private RSA key is not only stored on the client but transmitted to the backend, too. Moreover, the key to decrypt the private key is composed of the first 32 bytes of the SHA-512 hash of the user password. But this hash is stored on the backend, too. Therefore, everyone with access to the backend database can read the transmitted secret for symmetric encryption, hence can read the communication.2017-08-01not yet calculatedCVE-2017-11136
MISCheinekingmedia -- stashcat_for_android
 An issue was discovered in heinekingmedia StashCat before 1.5.18 for Android. No certificate pinning is implemented; therefore the attacker could issue a certificate for the backend and the application would not notice it.2017-08-01not yet calculatedCVE-2017-11132
MISCheinekingmedia -- stashcat_for_android
 An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. To encrypt messages, AES in CBC mode is used with a pseudo-random secret. This secret and the IV are generated with math.random() in previous versions and with CryptoJS.lib.WordArray.random() in newer versions, which uses math.random() internally. This is not cryptographically strong.2017-08-01not yet calculatedCVE-2017-11133
MISCheinekingmedia -- stashcat_for_android
 An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The product's protocol only tries to ensure confidentiality. In the whole protocol, no integrity or authenticity checks are done. Therefore man-in-the-middle attackers can conduct replay attacks.2017-08-01not yet calculatedCVE-2017-11130
MISCheinekingmedia -- stashcat_for_android
 An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The login credentials are written into a log file on the device. Hence, an attacker with access to the logs can read them.2017-08-01not yet calculatedCVE-2017-11134
MISCheinekingmedia -- stashcat_for_android
 An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The keystore is locked with a hard-coded password. Therefore, everyone with access to the keystore can read the content out, for example the private key of the user.2017-08-01not yet calculatedCVE-2017-11129
MISChp -- linux_imaging_and_printing
 The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) makes it easier for man-in-the-middle attackers to execute arbitrary code by leveraging use of a short GPG key id from a keyserver to verify print plugin downloads.2017-08-02not yet calculatedCVE-2015-0839
FEDORA
FEDORA
MLIST
BID
UBUNTU
CONFIRM
CONFIRMi-o_data_device -- wn-ax1167gr_firmware
 WN-AX1167GR firmware version 3.00 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute arbitrary code on the device.2017-08-02not yet calculatedCVE-2017-2280
MISC
JVNi-o_data_device -- wn-ax1167gr_firmware
 WN-AX1167GR firmware version 3.00 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.2017-08-02not yet calculatedCVE-2017-2281
MISC
JVNi-o_data_device -- wn-ax1167gr_firmware
 Buffer overflow in WN-AX1167GR firmware version 3.00 and earlier allows an attacker to execute arbitrary commands via unspecified vectors.2017-08-02not yet calculatedCVE-2017-2282
MISC
JVNi-o_data_device -- wn-g300r3_firmware
 WN-G300R3 firmware version 1.0.2 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute arbitrary code on the device.2017-08-02not yet calculatedCVE-2017-2283
MISC
JVNibm -- appscan_enterprise_edition
 IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session. IBM X-Force ID: 1202572017-08-02not yet calculatedCVE-2016-9981
CONFIRM
SECTRACK
MISCibm -- content_navigator
 IBM Content Navigator 2.0.3 and 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126233.2017-08-04not yet calculatedCVE-2017-1331
CONFIRM
BID
MISCibm -- curam_social_program_management
 IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10 and 6.0.5 before 6.0.5.6 allows remote authenticated users to load arbitrary Java classes via unspecified vectors.2017-08-02not yet calculatedCVE-2014-8903
CONFIRM
BIDibm -- sterling_software
 XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote attackers to read arbitrary files via a crafted XML data.2017-08-02not yet calculatedCVE-2015-0194
AIXAPAR
CONFIRM
BIDimagemagick -- imagemagickIn ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadMVGImage in coders/mvg.c, which allows attackers to cause a denial of service, related to the function ReadSVGImage in svg.c.2017-08-05not yet calculatedCVE-2017-12566
CONFIRMimagemagick -- imagemagick
 In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c, which allows attackers to cause a denial of service.2017-08-05not yet calculatedCVE-2017-12565
CONFIRMimagemagick -- imagemagick
 In ImageMagick 7.0.6-2, a memory exhaustion vulnerability was found in the function ReadPSDImage in coders/psd.c, which allows attackers to cause a denial of service.2017-08-05not yet calculatedCVE-2017-12563
CONFIRMimagemagick -- imagemagick
 In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service.2017-08-05not yet calculatedCVE-2017-12564
CONFIRMintercom -- malion
 MaLion for Windows and Mac versions 3.2.1 to 5.2.1 uses a hardcoded cryptographic key which may allow an attacker to alter the connection settings of Terminal Agent and spoof the Relay Service.2017-08-04not yet calculatedCVE-2017-10818
MISC
MISCintercom -- malion
 MaLion for Mac 4.3.0 to 5.2.1 does not properly validate certificates, which may allow an attacker to eavesdrop on an encrypted communication.2017-08-04not yet calculatedCVE-2017-10819
MISC
MISCintercom -- malion
 SQL injection vulnerability in the MaLion for Windows and Mac 5.0.0 to 5.2.1 allows remote attackers to execute arbitrary SQL commands via Relay Service Server.2017-08-04not yet calculatedCVE-2017-10816
MISC
MISCintercom -- malion
 MaLion for Windows and Mac 5.0.0 to 5.2.1 allows remote attackers to bypass authentication to alter settings in Relay Service Server.2017-08-04not yet calculatedCVE-2017-10817
MISC
MISCintercom -- malion
 MaLion for Windows 5.2.1 and earlier (only when "Remote Control" is installed) and MaLion for Mac 4.0.1 to 5.2.1 (only when "Remote Control" is installed) allows remote attackers to bypass authentication to executue arbitrary commands or operations on Terminal Agent.2017-08-04not yet calculatedCVE-2017-10815
MISC
MISCinternetsoft -- ftp_commander
 InternetSoft FTP Commander 8.02 and prior has an untrusted search path, allowing DLL hijacking via a Trojan horse dwmapi.dll file.2017-07-30not yet calculatedCVE-2017-11749
MISCioquake3 -- ioquake3
 Buffer overflow in ioquake3 before 2017-08-02 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted packet.2017-08-03not yet calculatedCVE-2017-11721
MISCip_messenger -- ip_messenger
 Untrusted search path vulnerability in Installer of IP Messenger for Win 4.60 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-08-04not yet calculatedCVE-2017-10820
MISC
JVNjasper -- jasper
 Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.2017-08-02not yet calculatedCVE-2015-5203
SUSE
SUSE
SUSE
MLIST
REDHAT
CONFIRM
FEDORA
FEDORA
FEDORA
GENTOOledger -- ledgerThe ledger::parse_date_mask_routine function in times.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.2017-08-04not yet calculatedCVE-2017-12482
MISCledger -- ledger
 The find_option function in option.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.2017-08-04not yet calculatedCVE-2017-12481
MISClenovo -- sierra_wireless_windows_mobile_ broadband_driver_packages
 Multiple unquoted Windows search path vulnerabilities in Sierra Wireless Windows Mobile Broadband Driver Packages (MBDP) allow local users to gain privileges via a Trojan horse executable file.2017-08-02not yet calculatedCVE-2017-9247
CONFIRM
CONFIRMlibgd -- libgd
 The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.2017-08-02not yet calculatedCVE-2017-7890
CONFIRM
CONFIRM
BID
CONFIRM
CONFIRMlibmad -- libmadThe mad_decoder_run function in decoder.c in libmad 0.15.1b allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file.2017-08-01not yet calculatedCVE-2017-11552
MISClibsndfile -- libsndfile
 Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.2017-08-05not yet calculatedCVE-2017-12562
CONFIRMlinux -- linux_kernel
 Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that leverages simultaneous execution of the inotify_handle_event and vfs_rename functions, as exploited in the wild in August 2017.2017-08-05not yet calculatedCVE-2017-7533
MISC
MISC
BID
SECTRACK
MISC
MISC
MISC
MISC
MISCmanageengine -- desktop_central_9
 Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet.2017-08-02not yet calculatedCVE-2015-2560
MISC
BUGTRAQ
BID
CONFIRMmanageengine -- opmanagerZoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor.2017-08-03not yet calculatedCVE-2015-9107
MISCmantisbt -- mantisbt
 If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the 'admin' directory (as recommended in the "Post-installation and upgrade tasks" section of the MantisBT Admin Guide), and the MySQL client has a local_infile setting enabled (in php.ini mysqli.allow_local_infile, or the MySQL client config file, depending on the PHP setup), an attacker may take advantage of MySQL's "connect file read" feature to remotely access files on the MantisBT server.2017-08-05not yet calculatedCVE-2017-12419
CONFIRM
CONFIRMmantisbt -- mantisbt
 An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by the $f_database, $f_db_username, and $f_admin_username variables. This is mitigated by the fact that the admin/ folder should be deleted after installation, and also prevented by CSP.2017-08-01not yet calculatedCVE-2017-12061
CONFIRM
CONFIRM
SECTRACK
CONFIRM
CONFIRM
CONFIRMmantisbt -- mantisbt
 The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($g_view_proj_doc_threshold) is set to ANYBODY, allows remote authenticated users to download attachments linked to arbitrary private projects via a file id number in the file_id parameter to file_download.php.2017-08-01not yet calculatedCVE-2015-5059
FEDORA
MLIST
MLIST
BID
CONFIRM
CONFIRM
CONFIRMmantisbt -- mantisbt
 An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.2017-08-01not yet calculatedCVE-2017-12062
CONFIRM
CONFIRM
SECTRACK
CONFIRM
CONFIRMmirth_corporation -- medhost_connex
 MEDHOST Connex contains a hard-coded Mirth Connect admin credential that is used for customer Mirth Connect management access. An attacker with knowledge of the hard-coded credential and the ability to communicate directly with the Mirth Connect management console may be able to intercept sensitive patient information. The admin account password is hard-coded as $K8t1ng throughout the application, and is the same across all installations. Customers do not have the option to change the Mirth Connect admin account password. The Mirth Connect admin account is created during the Connex install. The plaintext account password is hard-coded multiple times in the Connex install and update scripts.2017-07-31not yet calculatedCVE-2017-11743
MISC
BIDnitro_software -- nitro_pro
 Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.2017-08-03not yet calculatedCVE-2017-7442
MISC
EXPLOIT-DBnosefart -- nosefart
 The chk_mem_access function in cpu/nes6502/nes6502.c in libnosefart.a in Nosefart 2.9-mls allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted nsf file.2017-07-31not yet calculatedCVE-2017-11119
MISConeplus -- oneplus_2_primary_bootloader
 The OnePlus 2 Primary Bootloader (PBL) does not validate the SBL1 partition before executing it, although it contains a certificate. This allows attackers with write access to that partition to disable signature validation.2017-08-03not yet calculatedCVE-2017-11105
MISCpalo_alto -- pan_os
 The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via a crafted domain name.2017-08-02not yet calculatedCVE-2017-8390
BID
SECTRACK
CONFIRMpervasive_software -- actian_psql_and_zen
 Heap-based buffer overflow in Actian Pervasive PSQL v12.10 and Zen v13 allows remote attackers to execute arbitrary code via crafted traffic to TCP port 1583. The overflow occurs after Server-Client encryption-key exchange. The issue results from an integer underflow that leads to a zero-byte allocation. The _srvLnaConnectMP1 function is affected.2017-07-31not yet calculatedCVE-2017-11757
MISC
MISC
MISCpotrace -- potrace
 Potrace 1.14 has a heap-based buffer over-read in the interpolate_cubic function in mkbitmap.c.2017-08-01not yet calculatedCVE-2017-12067
MISCprojeqtor -- projeqtor
 uploadImage.php in ProjeQtOr before 6.3.2 allows remote authenticated users to execute arbitrary PHP code by uploading a .php file composed of concatenated image data and script data, as demonstrated by uploading as an image within the description text area.2017-07-31not yet calculatedCVE-2017-11760
CONFIRMrazer -- synapse

 A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse that can cause an out of bounds read operation to occur due to a field within the IOCTL data being used as a length.2017-08-02not yet calculatedCVE-2017-9770
MISCrazer -- synapse
 A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a handle to be opened to an arbitrary process.2017-08-02not yet calculatedCVE-2017-9769
MISC
MISCsangoma_technologies -- freepbx
 Multiple cross-site scripting (XSS) vulnerabilities in views/add-license-form.php in the Digium Addons module (digiumaddoninstaller) before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the (1) add_license_key, (2) add_license_first_name, (3) add_license_last_name, (4) add_license_company, (5) add_license_address1, (6) add_license_address2, (7) add_license_city, (8) add_license_state, (9) add_license_post_code, (10) add_license_country, (11) add_license_phone, or (12) add_license_email parameter in an add-license-form page to admin/config.php.2017-08-02not yet calculatedCVE-2015-2690
CONFIRM
MISC
BUGTRAQ
BID
MISCshadow -- shadow
 In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.2017-08-04not yet calculatedCVE-2017-12424
CONFIRM
CONFIRM
CONFIRMslims_8_akasia -- slims_8_akasia
 SLiMS 8 Akasia through 8.3.1 has an arbitrary file reading issue because of directory traversal in the url parameter to admin/help.php. It can be exploited by remote authenticated librarian users.2017-08-05not yet calculatedCVE-2017-12586
CONFIRMslims_8_akasia -- slims_8_akasia
 SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAX_lookup_handler.php (tableName and tableFields parameters), admin/AJAX_check_id.php, and admin/AJAX_vocabolary_control.php. It can be exploited by remote authenticated librarian users.2017-08-05not yet calculatedCVE-2017-12585
CONFIRMslims_8_akasia -- slims_8_akasia
 There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile (including the password) can be updated without sending the current password. This allows remote attackers to trick a user into changing to an attacker-controlled password, a complete account takeover, via the passwd1 and passwd2 fields in an admin/modules/system/app_user.php changecurrent=true operation.2017-08-05not yet calculatedCVE-2017-12584
CONFIRMsma_solar_technology -- multiple_productsAn issue was discovered in SMA Solar Technology products. An attacker can use Sunny Explorer or the SMAdata2+ network protocol to update the device firmware without ever having to authenticate. If an attacker is able to create a custom firmware version that is accepted by the inverter, the inverter is compromised completely. This allows the attacker to do nearly anything: for example, giving access to the local OS, creating a botnet, using the inverters as a stepping stone into companies, etc.2017-08-05not yet calculatedCVE-2017-9860
MISCsma_solar_technology -- multiple_productsAn issue was discovered in SMA Solar Technology products. The SIP implementation does not properly use authentication with encryption: it is vulnerable to replay attacks, packet injection attacks, and man in the middle attacks. An attacker is able to successfully use SIP to communicate with the device from anywhere within the LAN. An attacker may use this to crash the device, stop it from communicating with the SMA servers, exploit known SIP vulnerabilities, or find sensitive information from the SIP communications. Furthermore, because the SIP communication channel is unencrypted, an attacker capable of understanding the protocol can eavesdrop on communications. For example, passwords can be extracted.2017-08-05not yet calculatedCVE-2017-9861
MISC
sma_solar_technology -- multiple_productsAn Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will almost always be default. Installer passwords are expected to be default or similar across installations installed by the same company (but are sometimes changed). Hidden user accounts have (at least in some cases, though more research is required to test this for all hidden user accounts) a fixed password for all devices; it can never be changed by a user. Other vulnerabilities exist that allow an attacker to get the passwords of these hidden user accounts.2017-08-05not yet calculatedCVE-2017-9852
MISCsma_solar_technology -- multiple_products
 An issue was discovered in SMA Solar Technology products. The inverters make use of a weak hashing algorithm to encrypt the password for REGISTER requests. This hashing algorithm can be cracked relatively easily. An attacker will likely be able to crack the password using offline crackers. This cracked password can then be used to register at the SMA servers.2017-08-05not yet calculatedCVE-2017-9859
MISCsma_solar_technology -- multiple_products
 An issue was discovered in SMA Solar Technology products. An attacker can change the plant time even when not authenticated in any way. This changes the system time, possibly affecting lockout policies and random-number generators based on timestamps, and makes timestamps for data analysis unreliable.2017-08-05not yet calculatedCVE-2017-9864
MISCsma_solar_technology -- multiple_products
 An issue was discovered in SMA Solar Technology products. By sending crafted packets to an inverter and observing the response, active and inactive user accounts can be determined. This aids in further attacks (such as a brute force attack) as one now knows exactly which users exist and which do not.2017-08-05not yet calculatedCVE-2017-9858
MISCsma_solar_technology -- multiple_products
 An issue was discovered in SMA Solar Technology products. A secondary authentication system is available for Installers called the Grid Guard system. This system uses predictable codes, and a single Grid Guard code can be used on any SMA inverter. Any such code, when combined with the installer account, allows changing very sensitive parameters.2017-08-05not yet calculatedCVE-2017-9855
MISCsma_solar_technology -- multiple_products
 An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity requirements or length requirements are set. Also, strong passwords are impossible due to a maximum of 12 characters and a limited set of characters.2017-08-05not yet calculatedCVE-2017-9853
MISCsma_solar_technology -- multiple_products
 An issue was discovered in SMA Solar Technology products. Sniffed passwords from SMAdata2+ communication can be decrypted very easily. The passwords are "encrypted" using a very simple encryption algorithm. This enables an attacker to find the plaintext passwords and authenticate to the device.2017-08-05not yet calculatedCVE-2017-9856
MISCsma_solar_technology -- sunny_explorer
 An issue was discovered in SMA Solar Technology products. If a user simultaneously has Sunny Explorer running and visits a malicious host, cross-site request forgery can be used to change settings in the inverters (for example, issuing a POST request to change the user password). All Sunny Explorer settings available to the authenticated user are also available to the attacker. (In some cases, this also includes changing settings that the user has no access to.) This may result in complete compromise of the device.2017-08-05not yet calculatedCVE-2017-9863
MISCsma_solar_technology -- sunny_explorer
 An issue was discovered in SMA Solar Technology products. By sending nonsense data or setting up a TELNET session to the database port of Sunny Explorer, the application can be crashed.2017-08-05not yet calculatedCVE-2017-9851
MISCsma_solar_technology -- sunny_explorer
 An issue was discovered in SMA Solar Technology products. When signed into Sunny Explorer with a wrong password, it is possible to create a debug report, disclosing information regarding the application and allowing the attacker to create and save a .txt file with contents to his liking. An attacker may use this for information disclosure, or to write a file to normally unavailable locations on the local system.2017-08-05not yet calculatedCVE-2017-9862
MISCsma_solar_technology -- sunny_explorer
 An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are typed into Sunny Explorer by the user. These passwords can then be used to compromise the overall device.2017-08-05not yet calculatedCVE-2017-9854
MISCsma_solar_technology -- sunny_explorer
 An issue was discovered in SMA Solar Technology products. The SMAdata2+ communication protocol does not properly use authentication with encryption: it is vulnerable to man in the middle, packet injection, and replay attacks. Any setting change, authentication packet, scouting packet, etc. can be replayed, injected, or used for a man in the middle session. All functionalities available in Sunny Explorer can effectively be done from anywhere within the network as long as an attacker gets the packet setup correctly. This includes the authentication process for all (including hidden) access levels and the changing of settings in accordance with the gained access rights. Furthermore, because the SMAdata2+ communication channel is unencrypted, an attacker capable of understanding the protocol can eavesdrop on communications.2017-08-05not yet calculatedCVE-2017-9857
MISCsocusoft -- flash_slideshow_maker_professional
 SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xml_path HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated redirection issues.2017-08-05not yet calculatedCVE-2017-12439
MISCsol.connect -- iset-mpp_meter
 SQL injection vulnerability in SOL.Connect ISET-mpp meter 1.2.4.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter in a login action.2017-08-02not yet calculatedCVE-2017-11494
BUGTRAQ
BIDsony -- nfc_port_softwareUntrusted search path vulnerability in NFC Port Software remover Ver.1.3.0.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-08-02not yet calculatedCVE-2017-2287
JVNsony -- nfc_port_software
 Untrusted search path vulnerability in NFC Port Software Version 5.5.0.6 and earlier (for RC-S310, RC-S320, RC-S330, RC-S370, RC-S380, RC-S380/S), NFC Port Software Version 5.3.6.7 and earlier (for RC-S320, RC-S310/J1C, RC-S310/ED4C), PC/SC Activator for Type B Ver.1.2.1.0 and earlier, SFCard Viewer 2 Ver.2.5.0.0 and earlier, NFC Net Installer Ver.1.1.0.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.2017-08-02not yet calculatedCVE-2017-2286
JVNsplunk -- enterprise
 Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2, with exploitation requiring administrative access, aka SPL-134104.2017-08-05not yet calculatedCVE-2017-12572
CONFIRMtechnicolor -- tc7337_routers
 Persistent XSS through the SSID of nearby Wi-Fi devices on Technicolor TC7337 routers 08.89.17.20.00 allows an attacker to cause DNS Poisoning and steal credentials from the router.2017-08-03not yet calculatedCVE-2017-11320
MISCtechnicolor -- tc8717t_devices
 The Time Warner firmware on Technicolor TC8717T devices sets the default Wi-Fi passphrase to a combination of the SSID and BSSID, which makes it easier for remote attackers to obtain network access by reading a beacon frame.2017-07-30not yet calculatedCVE-2017-9522
MISCtrello -- trello_app
 Cross-site scripting (XSS) vulnerability in the Trello app before 4.0.8 for iOS might allow remote attackers to inject arbitrary web script or HTML by uploading and attaching a crafted photo to a Card.2017-08-02not yet calculatedCVE-2017-9244
CONFIRMtrend_micro -- deep_discovery_director
 Backup archives were found to be encrypted with a static password across different installations, which suggest the same password may be used in all virtual appliance instances of Trend Micro Deep Discovery Director 1.1.2017-08-01not yet calculatedCVE-2017-11380
CONFIRM
MISCtrend_micro -- deep_discovery_director
 Configuration and database backup archives are not signed or validated in Trend Micro Deep Discovery Director 1.1.2017-08-01not yet calculatedCVE-2017-11379
CONFIRM
MISCtrend_micro -- officescan
 Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php. Formerly ZDI-CAN-4544.2017-08-03not yet calculatedCVE-2017-11394
BID
MISC
MISCtwibright_labs -- links
 The put_chars function in html_r.c in Twibright Links 2.14 allows remote attackers to cause a denial of service (buffer over-read) via a crafted HTML file.2017-07-31not yet calculatedCVE-2017-11114
MISCunit4_polska -- teta_web
 Session fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a session id.2017-08-02not yet calculatedCVE-2015-1174
MISCvarnish_cache_http -- varnish_cache_http
 An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases.2017-08-04not yet calculatedCVE-2017-12425
CONFIRM
CONFIRM
CONFIRM
CONFIRM
CONFIRMvit_software -- spider_player
 VIT Spider Player 2.5.3 has an untrusted search path, allowing DLL hijacking via a Trojan horse dwmapi.dll, olepro32.dll, dsound.dll, or AUDIOSES.dll file.2017-07-30not yet calculatedCVE-2017-11748
MISCvmware -- vcenter_server
 VMware vCenter Server 5.5, 6.0, 6.5 allows vSphere users with certain, limited vSphere privileges to use the VIX API to access Guest Operating Systems without the need to authenticate.2017-07-28not yet calculatedCVE-2017-4919
BID
SECTRACK
CONFIRMvmware -- vmware
 VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H2017-07-28not yet calculatedCVE-2015-5191
BID
SECTRACK
CONFIRMwordpress -- wordpress
 The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk action.2017-08-01not yet calculatedCVE-2017-12068
MISCwordpress -- wordpress
 The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component.2017-08-02not yet calculatedCVE-2017-12200
MISCwordpress -- wordpress
 The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens.2017-08-01not yet calculatedCVE-2017-12131
MISCyaml-cpp -- yaml-cpp
 The function "Token& Scanner::peek" in scanner.cpp in yaml-cpp 0.5.3 and earlier allows remote attackers to cause a denial of service (assertion failure and application exit) via a '!2' string.2017-07-30not yet calculatedCVE-2017-11692
MISCztrela_knowledge_solutions -- eapmd5pass
 A length validation (leading to out-of-bounds read and write) flaw was found in the way eapmd5pass 1.4 handled network traffic in the extract_eapusername function. A remote attacker could potentially use this flaw to crash the eapmd5pass process by generating specially crafted network traffic.2017-07-31not yet calculatedCVE-2017-11670
MISCztrela_knowledge_solutions -- eapmd5pass
 An out-of-bounds read flaw related to the assess_packet function in eapmd5pass.c:211 was found in the way eapmd5pass 1.4 handled processing of network packets. A remote attacker could potentially use this flaw to crash the eapmd5pass process under certain circumstances by generating specially crafted network traffic.2017-07-31not yet calculatedCVE-2017-11669
MISCztrela_knowledge_solutions -- eapmd5pass
 An out-of-bounds read flaw related to the assess_packet function in eapmd5pass.c:134 was found in the way eapmd5pass 1.4 handled processing of network packets. A remote attacker could potentially use this flaw to crash the eapmd5pass process under certain circumstances by generating specially crafted network traffic.2017-07-31not yet calculatedCVE-2017-11668
MISCBack to top

This product is provided subject to this Notification and this Privacy & Use policy.


https://www.us-cert.gov/ncas/bulletins/SB17-219

Categories:
Tags:

[D] [Digg] [FB] [R] [SU] [Tweet] [G]

NEWSMAIL