Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,438 results · page 56 of 69
Apr 11, 2018A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affecCVE-2018-0966 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.3
A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.
- Product
- Windows Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Mar 30, 2018In the video_ioctl2() function in the camera driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-16, an untrusted pointer dereference CVE-2017-15846 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
In the video_ioctl2() function in the camera driver in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-09-16, an untrusted pointer dereference may potentially occur.
- Product
- Android for MSM, Firefox OS for MSM, QRD Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.codeaurora.org
Mar 26, 2018Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an untrusted SSL certificate vulnerability this could allow an attacker to gain unauthorized aCVE-2018-5464 · Other software · Philips · reported by ics-cert@hq.dhs.govHigh 7.5
Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an untrusted SSL certificate vulnerability this could allow an attacker to gain unauthorized access to resources and information.
- Product
- Philips IntelliSpace Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Mar 22, 2018Untrusted search path vulnerability in The installer of PhishWall Client Firefox and Chrome edition for Windows Ver.CVE-2018-0552 · Other software · SecureBrain Corporation · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in The installer of PhishWall Client Firefox and Chrome edition for Windows Ver. 5.1.26 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installer of PhishWall Client Firefox and Chrome edition for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurebrain.co.jp
Mar 22, 2018Untrusted search path vulnerability in ViX version 2.21.148.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.CVE-2018-0540 · Other software · K_OKADA · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in ViX version 2.21.148.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- ViX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2018In Omron CX-Supervisor Versions 3.30 and prior, processing a malformed packet by a certain executable may cause an untrusted pointer dereference vulnerability.CVE-2018-7525 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govMedium 5.3
In Omron CX-Supervisor Versions 3.30 and prior, processing a malformed packet by a certain executable may cause an untrusted pointer dereference vulnerability.
- Product
- Omron CX-Supervisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Mar 16, 2018In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, untrusted pointer dereference in update_userspacCVE-2017-15833 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, untrusted pointer dereference in update_userspace_power() function in power leads to information exposure.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.codeaurora.org
Mar 14, 2018SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External ECVE-2018-2401 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External Entity (XXE) vulnerability.
- Product
- SAP Business Process Automation (BPA) By Redwood
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comblogs.sap.com
Mar 14, 2018A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior.CVE-2018-7529 · Other software · Osisoft · reported by ics-cert@hq.dhs.govHigh 7.5
A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may modify deserialized data to send custom requests that crash the server.
- Product
- PI Data Archive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Mar 13, 2018IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path.CVE-2018-1437 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path. A local attacker could exploit this vulnerability to DLL hijacking to execute arbitrary code on the system or cause the application to crash. IBM X-Force ID: 139565.
- Product
- Notes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Mar 9, 2018JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which couCVE-2016-9606 · Other software · Red Hat, Inc. · reported by Red HatHigh 8.1
JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.
- Product
- RESTEasy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.comrhn.redhat.com
Mar 9, 2018Untrusted search path vulnerability in WinShot 1.53a and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified direCVE-2018-0544 · Other software · WoodyBells · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in WinShot 1.53a and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- WinShot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2018Untrusted search path vulnerability in Jtrim 1.53c and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directCVE-2018-0543 · Other software · WoodyBells · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Jtrim 1.53c and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Jtrim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2018Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it.CVE-2016-9585 · Other software · Red Hat, Inc. · reported by Red HatMedium 5.3
Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it. An attacker could exploit this vulnerability resulting in a denial of service attack.
- Product
- EAP-5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.combugzilla.redhat.com
Mar 1, 2018A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains.CVE-2017-6929 · Websites & servers · Drupal.org · reported by mlhess@drupal.orgMedium 6.1
A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal core upgrade to jQuery 3. For Drupal 7, it is fixed in the current release (Drupal 7.57) for jQuery 1.4.4 (the version that ships with Drupal 7 core) as well as for other newer versions of jQuery that might be used on the site, for example using the jQuery Update module.
- Product
- Drupal Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgdebian.org
Mar 1, 2018The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target CVE-2017-14804 · Other software · SUSE · reported by security@opentext.comCritical 9.9
The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target system,allowing escape out of buildroots.
- Product
- build
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Feb 22, 2018Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code running under a security manager to elevaCVE-2018-1417 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code running under a security manager to elevate its privileges. IBM X-Force ID: 138823.
- Product
- SDK, Java Technology Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2018Untrusted search path vulnerability in FLET'S v4 / v6 address selection tool allows an attacker to gain privileges via a Trojan horse DLL in an unspecified direCVE-2018-0516 · Other software · NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in FLET'S v4 / v6 address selection tool allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- FLET'S v4 / v6 address selection tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2018Untrusted search path vulnerability in "FLET'S Azukeru Backup Tool" version 1.5.2.6 and earlier allows an attacker to gain privileges via a Trojan horse DLL in CVE-2018-0515 · Other software · NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in "FLET'S Azukeru Backup Tool" version 1.5.2.6 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- "FLET'S Azukeru Backup Tool"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2018A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.CVE-2017-8967 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8.8
A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.
- Product
- Intelligent Management Center (iMC) PLAT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsupport.hpe.com
Feb 15, 2018A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.CVE-2017-8966 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8.8
A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.
- Product
- Intelligent Management Center (iMC) PLAT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsupport.hpe.com
Feb 15, 2018A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.CVE-2017-8965 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8.8
A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.
- Product
- Intelligent Management Center (iMC) PLAT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsupport.hpe.com
Feb 15, 2018A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.CVE-2017-8964 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8.8
A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.
- Product
- Intelligent Management Center (iMC) PLAT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsupport.hpe.com
Feb 15, 2018A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.CVE-2017-8963 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8.8
A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.
- Product
- Intelligent Management Center (iMC) PLAT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsupport.hpe.com
Feb 15, 2018A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.CVE-2017-8962 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comHigh 8.8
A Deserialization of Untrusted Data vulnerability in Hewlett Packard Enterprise Intelligent Management Center (iMC) PLAT version 7.3 E0504P2 was found.
- Product
- Intelligent Management Center (iMC) PLAT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsupport.hpe.com
Feb 15, 2018A remote deserialization of untrusted data vulnerability in HPE Intelligent Management Center (IMC) PLAT version 7.2 E0403P06 was found.CVE-2017-5790 · Other software · Hewlett Packard Enterprise · reported by security-alert@hpe.comCritical 9.8
A remote deserialization of untrusted data vulnerability in HPE Intelligent Management Center (IMC) PLAT version 7.2 E0403P06 was found.
- Product
- Intelligent Management Center (IMC) PLAT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsupport.hpe.com
Feb 8, 2018Versions of Epson AirPrint released prior to January 19, 2018 contain a reflective cross-site scripting (XSS) vulnerability, which can allow untrusted users on CVE-2018-5550 · Other software · Epson · reported by cve@rapid7.comMedium 6.1
Versions of Epson AirPrint released prior to January 19, 2018 contain a reflective cross-site scripting (XSS) vulnerability, which can allow untrusted users on the network to hijack a session cookie or perform other reflected XSS attacks on a currently logged-on user.
- Product
- Epson AirPrint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.rapid7.comepson.com
Feb 8, 2018Untrusted search path vulnerability in Anshin net security for Windows Version 16.0.1.44 and earlier allows an attacker to gain privileges via a Trojan horse DLCVE-2018-0517 · Other software · KDDI CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Anshin net security for Windows Version 16.0.1.44 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Anshin net security for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2018Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'CVE-2014-5282 · Other software · Docker · reported by MITREHigh 8.1
Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'.
- Product
- Docker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgroups.google.com
Jan 26, 2018Untrusted search path vulnerability in FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.11 and earlier versions, FLET'S VIRUS CLEAR v6 Easy Setup & ApplicatCVE-2018-0507 · Other software · NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.11 and earlier versions, FLET'S VIRUS CLEAR v6 Easy Setup & Application Tool ver.11 and earlier versions allow an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- FLET'S VIRUS CLEAR Easy Setup & Application Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2018Yandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path is used for dnsapi.dll, winmm.dll, ntmartaCVE-2017-7327 · Other software · Yandex N.V. · reported by browser-security@yandex-team.ruHigh 7.8
Yandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path is used for dnsapi.dll, winmm.dll, ntmarta.dll, cryptbase.dll or profapi.dll.
- Product
- Yandex Browser for Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbrowser.yandex.combrowser.yandex.com
Jan 17, 2018Untrusted search path in Intel Graphics Driver 15.40.x.x, 15.45.x.x, and 21.20.x.x allows unprivileged user to elevate privileges via local access.CVE-2017-5696 · Other software · Intel Corporation · reported by secure@intel.comHigh 7.8
Untrusted search path in Intel Graphics Driver 15.40.x.x, 15.45.x.x, and 21.20.x.x allows unprivileged user to elevate privileges via local access.
- Product
- Intel Graphics Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-center.intel.comsecurity-center.intel.com
Jan 9, 2018IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user.CVE-2017-1612 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: 132953.
- Product
- MQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Jan 5, 2018An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to 8.3.CVE-2017-16728 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple vulnerabilities that may allow an attacker to cause the program to use an invalid memory address, resulting in a program crash.
- Product
- Webaccess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Dec 27, 2017Untrusted search path vulnerability in Content Manager Assistant for PlayStation version 3.55.7671.0901 and earlier allows an attacker to gain privileges via a CVE-2017-17010 · Other software · Sony Interactive Entertainment Inc. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Content Manager Assistant for PlayStation version 3.55.7671.0901 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Content Manager Assistant for PlayStation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2017Untrusted search path vulnerability in Music Center for PC version 1.0.01 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspeciCVE-2017-10909 · Other software · Sony Video & Sound Products Inc. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Music Center for PC version 1.0.01 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Music Center for PC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2017Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software" Ver3.1 and earlier allows an attacker to gainCVE-2017-10893 · Other software · Japan Agency for Local Authority Information Systems · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software" Ver3.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The Public Certification Service for Individuals "The JPKI user's software"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2017Untrusted search path vulnerability in Music Center for PC version 1.0.00 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directoCVE-2017-10892 · Other software · Sony Video & Sound Products Inc. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Music Center for PC version 1.0.00 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Music Center for PC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2017Untrusted search path vulnerability in Media Go version 3.2.0.191 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified dirCVE-2017-10891 · Other software · Sony Video & Sound Products Inc. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Media Go version 3.2.0.191 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Media Go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2017Adobe ColdFusion has an Untrusted Data Deserialization vulnerability.CVE-2017-11284 · Websites & servers · Adobe · reported by AdobeCritical 9.8
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.
- Product
- Coldfusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Dec 1, 2017Adobe ColdFusion has an Untrusted Data Deserialization vulnerability.CVE-2017-11283 · Websites & servers · Adobe · reported by AdobeCritical 9.8
Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.
- Product
- Coldfusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Nov 23, 2017The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows CVE-2017-16927 · Other software · Neutrinolabs · reported by MITREHigh 8.4
The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp through 0.9.4 uses an untrusted integer as a write length, which allows local users to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted input stream.
- Product
- Xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Nov 17, 2017Untrusted search path vulnerability in BOOK WALKER for Windows Ver.1.2.9 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecifCVE-2017-10887 · Other software · BOOK WALKER Co.,Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in BOOK WALKER for Windows Ver.1.2.9 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- BOOK WALKER for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2017An untrusted search path (aka DLL Preload) vulnerability in the Cisco Network Academy Packet Tracer software could allow an authenticated, local attacker to exeCVE-2017-12313 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.7
An untrusted search path (aka DLL Preload) vulnerability in the Cisco Network Academy Packet Tracer software could allow an authenticated, local attacker to execute arbitrary code via DLL hijacking if a local user with administrative privileges executes the installer in the current working directory where a crafted DLL has been placed by an attacker. The vulnerability is due to incomplete input validation of path and file names of a DLL file before it is loaded. An attacker could exploit this vulnerability by creating a malicious DLL file and installing it in a specific system directory. A successful exploit could allow the attacker to execute commands on the underlying Microsoft Windows host with privileges equivalent to the SYSTEM account. An attacker would need valid user credentials to exploit this vulnerability.
- Product
- Packet Tracer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Nov 16, 2017An untrusted search path (aka DLL Preloading) vulnerability in the Cisco Immunet antimalware installer could allow an authenticated, local attacker to execute aCVE-2017-12312 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.7
An untrusted search path (aka DLL Preloading) vulnerability in the Cisco Immunet antimalware installer could allow an authenticated, local attacker to execute arbitrary code via DLL hijacking if a local user with administrative privileges executes the installer in the current working directory where a crafted DLL has been placed by an attacker. The vulnerability is due to incomplete input validation of path and file names of a DLL file before it is loaded. An attacker could exploit this vulnerability by creating a malicious DLL file and installing it in a specific system directory. A successful exploit could allow the attacker to execute commands on the underlying Microsoft Windows host with privileges equivalent to the SYSTEM account. An attacker would need valid user credentials to exploit this vulnerability. Cisco Bug IDs: CSCvf23928.
- Product
- Advanced Malware Protection For Endpoints
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Nov 13, 2017Untrusted search path vulnerability in HYPER SBI Ver.CVE-2017-10885 · Other software · SBI SECURITIES Co.,Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in HYPER SBI Ver. 2.2 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- HYPER SBI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2017An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to V8.2_20170817.CVE-2017-12719 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A remote attacker is able to execute code to dereference a pointer within the program causing the application to become unavailable.
- Product
- Webaccess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Nov 2, 2017Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in aCVE-2017-10825 · Other software · NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer of Flets Easy Setup Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2017A URL redirection to untrusted site vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1.CVE-2017-14358 · Other software · Micro Focus · reported by security@opentext.comMedium 6.1
A URL redirection to untrusted site vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow URL redirection to untrusted site.
- Product
- HP ArcSight ESM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsoftwaresupport.hpe.comauscert.org.au
Oct 27, 2017Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privileCVE-2017-5099 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privilege elevation via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.