Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

1,569 results · page 16 of 32

Feb 27, 2018zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers).CVE-2014-10070 · Other software · ZSH Project · reported by MITREHigh 7.8
zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where "env_reset" has been disabled.
Product
ZSH
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zsh.sourceforge.net sourceforge.net
Feb 15, 2018An improper input validation vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found.CVE-2017-8973 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 4.3
An improper input validation vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com support.hpe.com
Feb 15, 2018A clickjacking vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found.CVE-2017-8972 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 4.3
A clickjacking vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com support.hpe.com
Feb 15, 2018A clickjacking vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found.CVE-2017-8971 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 4.3
A clickjacking vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com support.hpe.com
Feb 15, 2018A remote unauthenticated disclosure of information vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found.CVE-2017-8970 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.3
A remote unauthenticated disclosure of information vulnerability in HPE Matrix Operating Environment version 7.6 LR1 was found.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com support.hpe.com
Feb 15, 2018A remote information disclosure vulnerability in HPE Matrix Operating Environment version v7.6 was found.CVE-2017-5785 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 6.5
A remote information disclosure vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com support.hpe.com
Feb 15, 2018A missing HSTS Header vulnerability in HPE Matrix Operating Environment version v7.6 was found.CVE-2017-5784 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 6.5
A missing HSTS Header vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com support.hpe.com
Feb 15, 2018A remote clickjacking vulnerability in HPE Matrix Operating Environment version v7.6 was found.CVE-2017-5783 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.3
A remote clickjacking vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com support.hpe.com
Feb 15, 2018A missing HSTS Header vulnerability in HPE Matrix Operating Environment version v7.6 was found.CVE-2017-5782 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.4
A missing HSTS Header vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com support.hpe.com
Feb 15, 2018A CSRF vulnerability in HPE Matrix Operating Environment version v7.6 was found.CVE-2017-5781 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8.8
A CSRF vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com support.hpe.com
Feb 15, 2018A remote clickjacking vulnerability in HPE Matrix Operating Environment version v7.6 was found.CVE-2017-5780 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 6.5
A remote clickjacking vulnerability in HPE Matrix Operating Environment version v7.6 was found.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com support.hpe.com
Feb 15, 2018A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found.CVE-2016-8535 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comLow 3.5
A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com support.hpe.com
Feb 15, 2018A remote privilege elevation vulnerability in HPE Matrix Operating Environment version 7.6 was found.CVE-2016-8534 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8.8
A remote privilege elevation vulnerability in HPE Matrix Operating Environment version 7.6 was found.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com support.hpe.com
Feb 15, 2018A remote priviledge escalation vulnerability in HPE Matrix Operating Environment version 7.6 was found.CVE-2016-8533 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8.8
A remote priviledge escalation vulnerability in HPE Matrix Operating Environment version 7.6 was found.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com support.hpe.com
Feb 15, 2018A cross site scripting vulnerability in HPE Matrix Operating Environment version 7.6 was found.CVE-2016-8532 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.4
A cross site scripting vulnerability in HPE Matrix Operating Environment version 7.6 was found.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com support.hpe.com
Feb 15, 2018A remote information disclosure vulnerability in HPE Matrix Operating Environment version 7.6 was found.CVE-2016-8531 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comMedium 5.3
A remote information disclosure vulnerability in HPE Matrix Operating Environment version 7.6 was found.
Product
Matrix Operating Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com support.hpe.com
Feb 14, 2018In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environmentsCVE-2018-2376 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.1
In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space.
Product
SAP HANA Extended Application Services
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blogs.sap.com launchpad.support.sap.com
Feb 14, 2018In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environmentsCVE-2018-2375 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.1
In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environments within that space.
Product
SAP HANA Extended Application Services
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blogs.sap.com launchpad.support.sap.com
Feb 9, 2018In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from.CVE-2017-10690 · Other software · Puppet · reported by security@puppet.comMedium 6.5
In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4
Product
Puppet Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com puppet.com
Feb 6, 2018web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/templateCVE-2016-3952 · Other software · Web2py · reported by MITREHigh 7.8
web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify. NOTE: this issue can be leveraged by remote attackers to gain administrative access.
Product
Web2py
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devco.re github.com
Jan 31, 2018A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable.CVE-2017-1000409 · Other software · GNU · reported by MITREHigh 7
A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.
Product
Glibc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org security.netapp.com
Jan 31, 2018A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable.CVE-2017-1000408 · Other software · GNU · reported by MITREHigh 7.8
A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.
Product
Glibc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org openwall.com
Jan 10, 2018chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary files and gain privilCVE-2014-5003 · Other software · Ciborg Project · reported by MITREMedium 5.5
chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary files and gain privileges via a symlink attack on /tmp/perlbrew-installer.
Product
Ciborg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Jan 4, 2018In Dell EMC VNX2 versions prior to Operating Environment for File 8.1.9.217 and VNX1 versions prior to Operating Environment for File 7.1.80.8, a web server errCVE-2017-14383 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
In Dell EMC VNX2 versions prior to Operating Environment for File 8.1.9.217 and VNX1 versions prior to Operating Environment for File 7.1.80.8, a web server error page in VNX Control Station is impacted by a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to execute arbitrary HTML code in the user's browser session in the context of the affected web application.
Product
EMC Vnx2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org seclists.org
Dec 15, 2017A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors.CVE-2017-10905 · Other software · The Qt Company · reported by vultures@jpcert.or.jpMedium 5.3
A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors.
Product
Qt for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.qt.io jvn.jp
Dec 14, 2017lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow reCVE-2017-17535 · Other software · Gjots2 Project · reported by MITREHigh 8.8
lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Gjots2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attCVE-2017-17534 · Other software · Mensis Project · reported by MITREHigh 8.8
uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17521.
Product
Mensis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackCVE-2017-17533 · Other software · Tkabber Project · reported by MITREHigh 8.8
default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has indicated that the attack cannot occur because of the argument-parsing behavior of the Tcl exec function
Product
Tkabber
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which mighCVE-2017-17532 · Other software · Kiwi Project · reported by MITREHigh 8.8
examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Kiwi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attCVE-2017-17531 · Other software · GNU · reported by MITREHigh 8.8
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Global
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security.gentoo.org
Dec 14, 2017common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote aCVE-2017-17530 · Other software · Geomview · reported by MITREHigh 8.8
common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: this is disputed by a third party because no untrusted input can be used for the injection
Product
Geomview
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.gentoo.org security-tracker.debian.org
Dec 14, 2017af/util/xp/ut_go_file.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment variable, which might aCVE-2017-17529 · Other software · Abisource · reported by MITREHigh 8.8
af/util/xp/ut_go_file.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Abiword
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, whiCVE-2017-17528 · Other software · Scummvm · reported by MITREHigh 8.8
backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Scummvm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017delphi_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment variable, which migCVE-2017-17527 · Other software · Pasdoc Project · reported by MITREHigh 8.8
delphi_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer has indicated that the code referencing the BROWSER environment variable is never used
Product
Pasdoc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017Input.cc in Bernard Parisse Giac 1.2.3.57 does not validate strings before launching the program specified by the BROWSER environment variable, which might alloCVE-2017-17526 · Other software · Giac Project · reported by MITREHigh 8.8
Input.cc in Bernard Parisse Giac 1.2.3.57 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Giac
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environment variable, which miCVE-2017-17525 · Other software · Xtuple · reported by MITREHigh 8.8
guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Postbooks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017library/www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allCVE-2017-17524 · Other software · Swi-prolog · reported by MITREHigh 8.8
library/www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Swi-prolog
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might alloCVE-2017-17522 · Other software · Python · reported by MITREHigh 8.8
Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting
Product
Python
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugs.python.org
Dec 14, 2017uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow rCVE-2017-17521 · Other software · Fontforge · reported by MITREHigh 8.8
uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534.
Product
Fontforge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remoteCVE-2017-17520 · Other software · debian · reported by MITREHigh 8.8
tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has reported that this is intentional behavior, because the documentation states "url_handler.pl was designed to work together with tin which only issues shell escaped absolute URLs.
Product
tin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017swt/motif/browser.c in White_dune (aka whitedune) 0.30.10 does not validate strings before launching the program specified by the BROWSER environment variable, CVE-2017-17518 · Other software · White Dune Project · reported by MITREHigh 8.8
swt/motif/browser.c in White_dune (aka whitedune) 0.30.10 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: This issue is being disputed as not being a vulnerability because “the current version of white_dune (1.369 at https://wdune.ourproject.org/) do not use a "BROWSER environment variable". Instead, the "browser" variable is read from the $HOME/.dunerc file (or from the M$Windows registry). It is configurable in the "options" menu. The default is chosen in the ./configure script, which tests various programs, first tested is "xdg-open".
Product
White Dune
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allowCVE-2017-17517 · Other software · Sylpheed Project · reported by MITREHigh 8.8
libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Sylpheed
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by the BROWSER environmentCVE-2017-17516 · Other software · Reddit Terminal Viewer Project · reported by MITREHigh 8.8
scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Reddit Terminal Viewer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote aCVE-2017-17515 · Other software · Ecmwf · reported by MITREHigh 8.8
etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has indicated that the code to access this environment variable is not enabled in the shipped product
Product
Metview
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers tCVE-2017-17514 · Other software · debian · reported by MITREHigh 8.8
boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that this product does not use the BROWSER environment variable
Product
debian_linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com security-tracker.debian.org
Dec 14, 2017TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackeCVE-2017-17513 · Other software · TUG · reported by MITREHigh 8.8
TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to linked_scripts/context/stubs/unix/mtxrun, texmf-dist/scripts/context/stubs/mswin/mtxrun.lua, and texmf-dist/tex/luatex/lualibs/lualibs-os.lua.
Product
TEX Live
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 14, 2017KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conCVE-2017-17511 · Other software · Kildclient · reported by MITREHigh 8.8
KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to prefs.c and worldgui.c.
Product
Kildclient
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.debian.org security-tracker.debian.org
Dec 13, 2017In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments.CVE-2017-17665 · Other software · Octopus · reported by MITREHigh 8.8
In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass because the set of environments to which a machine is scoped may include environments in which the user lacks access.
Product
Octopus Deploy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 11, 2017lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows reCVE-2017-17523 · Other software · Lilypond · reported by MITREHigh 8.8
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument.
Product
Lilypond
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.debian.org bugs.debian.org
Dec 11, 2017sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allCVE-2017-17512 · Other software · Siemens · reported by MITREHigh 8.8
sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument.
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record metadata.ftp-master.debian.org bugs.debian.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.