Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-28 19:48Z
2017-03-29
2017-03-29 14:59Z
HIGH

CVE-2017-5671 — Honeywell Intermec_pc23_firmware: Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-5671

Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x before 10.12.013309 have /usr/bin/lua installed setuid to the itadmin account, which allows local users to conduct a BusyBox jailbreak attack and obtain root privileges by overwriting the /etc/shadow file. CVSSv3.1 8.8 (HIGH)

CWECWE 269VNDHoneywellTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-03-29
2017-03-29 14:59Z
CRIT

CVE-2016-9924 — Synacor Zimbra_collaboration_suite: Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9924

Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks. CVSSv3.1 9.8 (CRITICAL)

CWECWE 611VNDZimbraVNDSynacorTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-29
2017-03-29 01:59Z
HIGH

CVE-2017-2689 — Siemens Ruggedcom_rox_i: RUGGEDCOM ROX I (all versions) allow an authenticated user to bypass access restrictions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-2689

Siemens RUGGEDCOM ROX I (all versions) allow an authenticated user to bypass access restrictions in the web interface at port 10000/TCP to obtain privileged file system access or change configuration settings. CVSSv3.1 8.8 (HIGH)

CWECWE 287CWECWE 285VNDSiemensTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-03-29
2017-03-29 01:59Z
HIGH

CVE-2017-2688 — Siemens Ruggedcom_rox_i: The integrated web server in Siemens RUGGEDCOM ROX I (all versions) at port 10000/TCP

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-2688

The integrated web server in Siemens RUGGEDCOM ROX I (all versions) at port 10000/TCP could allow remote attackers to perform actions with the privileges of an authenticated user, provided the targeted user has an active session and is induced into clicking on a malicious link or into visiting a malicious website, aka CSRF. CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDSiemensTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-03-29
2017-03-29 00:59Z
HIGH

CVE-2017-7297 — Suse Rancher: Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-7297

Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. This is fixed in versions rancher/server:v1.2.4, rancher/server:v1.3.5, rancher/server:v1.4.3, and rancher/server:v1.5.3. CVSSv3.1 8.8 (HIGH)

VNDRancherTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-03-28
2017-03-28 20:59Z
CRIT

CVE-2016-6807 — Apache Ambari: Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-6807

Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process. CVSSv3.1 9.8 (CRITICAL)

CWECWE 284VNDApacheVNDCustomTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-28
2017-03-28 18:59Z
CRIT

CVE-2016-8749 — Apache Camel: Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-8749

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502VNDApacheTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2017-03-28
2017-03-28 15:59Z
CRIT

CVE-2014-6440 — Videolan Vlc: media player before 2.1.5 allows remote attackers to execute arbitrary code or

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2014-6440

VideoLAN VLC media player before 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service. CVSSv3.1 9.8 (CRITICAL)

CWECWE 119VNDVideolanTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-28
2017-03-28 14:59Z
CRIT

CVE-2016-10152 — Hesiod_project Hesiod: The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-10152

The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache. CVSSv3.1 9.8 (CRITICAL)

CWECWE 264VNDHesiod ProjectTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-28
2017-03-28 02:59Z
CRIT

CVE-2016-9470 — Revive-adserver Revive_adserver: `www/delivery/asyncspc.php` was vulnerable to the fairly new Reflected File Download (RFD) web attack vector

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9470

Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. `www/delivery/asyncspc.php` was vulnerable to the fairly new Reflected File Download (RFD) web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a trusted domain. CVSSv3.1 9.0 (CRITICAL)

CWECWE 79CWECWE 254VNDRevive AdserverVNDReviveTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2017-03-28
2017-03-28 02:59Z
HIGH

CVE-2016-9469 — Gitlab Gitlab: Multiple versions of GitLab expose a dangerous method to any authenticated user that could

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9469

Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance. For GitLab instances with publicly available projects this vulnerability could be exploited by an unauthenticated user. A fix was included in versions 8.14.3, 8.13.8, and 8.12.11, which were released on December 5th 2016 at 3:59 PST. The GitLab versions vulnerable to this are 8.13.0, 8.13.0-ee, 8.13.1, 8.13 CVSSv3.1 8.2 (HIGH)

CWECWE 749CWECWE 264VNDGitlabTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2017-03-28
2017-03-28 02:59Z
HIGH

CVE-2016-9463 — Nextcloud Nextcloud_server: Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9463

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud include an optional and not by default enabled SMB authentication component that allows authenticating users against an SMB server. This backend is implemented in a way that tries to connect to a SMB server and if that succeeded consider the user logged-in. The backend did not properly take into account SMB servers that have CVSSv3.1 8.1 (HIGH)

CWECWE 287CWECWE 303VNDNextcloudVNDOwncloudTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2017-03-28
2017-03-28 02:59Z
HIGH

CVE-2016-9456 — Revive-adserver Revive_adserver: Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF).

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9456

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The Revive Adserver team conducted a security audit of the admin interface scripts in order to identify and fix other potential CSRF vulnerabilities. Over 20+ such issues were fixed. CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDRevive AdserverVNDReviveTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-03-28
2017-03-28 02:59Z
HIGH

CVE-2016-9455 — Revive-adserver Revive_adserver: Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF).

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9455

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). A number of scripts in Revive Adserver's user interface are vulnerable to CSRF attacks: `www/admin/banner-acl.php`, `www/admin/banner-activate.php`, `www/admin/banner-advanced.php`, `www/admin/banner-modify.php`, `www/admin/banner-swf.php`, `www/admin/banner-zone.php`, `www/admin/tracker-modify.php`. CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDRevive AdserverVNDReviveTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-03-28
2017-03-28 02:59Z
HIGH

CVE-2016-9127 — Revive-adserver Revive_adserver: Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF).

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9127

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The password recovery form in Revive Adserver is vulnerable to CSRF attacks. This vulnerability could be exploited to send a large number of password recovery emails to the registered users, especially in conjunction with a bug that caused recovery emails to be sent to all the users at once. Both issues have been fixed. CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDRevive AdserverVNDReviveTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-03-28
2017-03-28 02:59Z
CRIT

CVE-2016-9125 — Revive-adserver Revive_adserver: Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9125

Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to steal an authenticated session. CVSSv3.1 9.8 (CRITICAL)

CWECWE 384VNDRevive AdserverVNDReviveTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-28
2017-03-28 02:59Z
CRIT

CVE-2016-9124 — Revive-adserver Revive_adserver: The login page of Revive Adserver is vulnerable to password-guessing attacks.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9124

Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks. An account lockdown feature was considered, but rejected to avoid introducing service disruptions to regular users during such attacks. A random delay has instead been introduced as a countermeasure in case of password failures, along with a system to discourage parallel brute forcing. These systems CVSSv3.1 9.8 (CRITICAL)

CWECWE 287CWECWE 307VNDRevive AdserverVNDReviveTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-28
2017-03-28 02:59Z
CRIT

CVE-2016-9121 — Go-jose_project Go-jose: When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9121

go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack. CVSSv3.1 9.1 (CRITICAL)

CWECWE 326VNDGo Jose ProjectTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2017-03-27
2017-03-27 22:59Z
HIGH

CVE-2017-1153 — Ibm Tririga_application_platform: TRIRIGA Report Manager 3.2 through 3.5 contains a vulnerability that could allow an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-1153

IBM TRIRIGA Report Manager 3.2 through 3.5 contains a vulnerability that could allow an authenticated user to execute actions that they do not have access to. IBM Reference #: 1999563. CVSSv3.1 8.8 (HIGH)

VNDIbmTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-03-27
2017-03-27 22:59Z
HIGH

CVE-2016-8960 — Ibm Cognos_business_intelligence: Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-8960

IBM Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to adopt the Capabilities of a higher-privilege user by intercepting the higher-privilege user's cookie value from its HTTP request and then reusing it in subsequent requests. IBM Reference #: 1993718. CVSSv3.1 8.8 (HIGH)

CWECWE 264VNDIbmTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-03-27
2017-03-27 17:59Z
CRIT

CVE-2017-7191 — Irssi Irssi: The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-7191

The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service (use-after-free) and possibly execute arbitrary code via unspecified vectors. CVSSv3.1 9.8 (CRITICAL)

CWECWE 416VNDIrssiTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-27
2017-03-27 17:59Z
CRIT

CVE-2017-6542 — Putty Putty: The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-6542

The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overflow. CVSSv3.1 9.8 (CRITICAL)

CWECWE 119VNDPuttyVNDOpensuse ProjectTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-27
2017-03-27 17:59Z
HIGH

CVE-2017-6460 — Ntp Ntp: Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-6460

Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response. CVSSv3.1 8.8 (HIGH)

CWECWE 119VNDStackVNDNtpTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-03-27
2017-03-27 17:59Z
HIGH

CVE-2017-6458 — Ntp Ntp: Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-6458

Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable. CVSSv3.1 8.8 (HIGH)

CWECWE 119VNDNtpTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-03-27
2017-03-27 17:59Z
HIGH

CVE-2015-8764 — Freeradius Freeradius: Off-by-one error in the EAP-PWD module in FreeRADIUS 3.0 through 3.0.8, which triggers a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-8764

Off-by-one error in the EAP-PWD module in FreeRADIUS 3.0 through 3.0.8, which triggers a buffer overflow. CVSSv3.1 8.1 (HIGH)

CWECWE 119VNDFreeradiusVNDOffTYPVulnerability
8.1
CVSS v3.1
91
Edit Score