CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In September 2017

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1151 CVE-2015-3450 119 DoS Exec Code Overflow Mem. Corr. 2017-09-06 2017-09-10
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted XML document.
1152 CVE-2015-3442 287 +Priv 2017-09-07 2018-10-09
7.5
None Remote Low Not required Partial Partial Partial
Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call.
1153 CVE-2015-3432 79 XSS 2017-09-19 2017-09-23
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Pydio (formerly AjaXplorer) before 6.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Pydio XSS Vulnerabilities."
1154 CVE-2015-3431 78 Exec Code 2017-09-19 2017-09-28
10.0
None Remote Low Not required Complete Complete Complete
Pydio (formerly AjaXplorer) before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities."
1155 CVE-2015-3420 295 DoS 2017-09-19 2017-10-05
4.3
None Remote Medium Not required None None Partial
The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (login process crash) via vectors related to handshake failures.
1156 CVE-2015-3419 20 Bypass 2017-09-19 2017-09-26
4.0
None Remote Low ??? None Partial None
vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure.
1157 CVE-2015-3314 89 Sql 2017-09-07 2017-09-11
6.8
None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.
1158 CVE-2015-3313 89 Sql 2017-09-07 2017-09-11
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in WordPress Community Events plugin before 1.4.
1159 CVE-2015-3299 79 XSS 2017-09-19 2017-09-25
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to original service order.
1160 CVE-2015-3296 79 XSS 2017-09-21 2017-09-28
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs.
1161 CVE-2015-3250 200 +Info 2017-09-07 2017-09-21
5.0
None Remote Low Not required Partial None None
Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.
1162 CVE-2015-3248 400 DoS 2017-09-26 2017-10-10
4.7
None Local Medium Not required None None Complete
openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when quotas are not properly setup, to fill the filesystem hosting /var/lib and cause a denial of service (disk consumption).
1163 CVE-2015-3222 264 Exec Code 2017-09-07 2017-09-13
6.9
None Local Medium Not required Complete Complete Complete
syscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute arbitrary code as root.
1164 CVE-2015-3169 79 XSS 2017-09-07 2017-09-12
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch.
1165 CVE-2015-3163 284 2017-09-06 2020-03-09
4.0
None Remote Low ??? None Partial None
The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users to modify power types and key types via navigating to $BEAKER/powertypes and $BEAKER/keytypes respectively.
1166 CVE-2015-3162 79 XSS 2017-09-06 2017-09-26
3.5
None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 allows remote authenticated users to inject arbitrary web script or HTML via writing a crafted comment on an acked or nacked canceled job.
1167 CVE-2015-3161 79 XSS 2017-09-06 2017-09-10
3.5
None Remote Medium ??? None Partial None
The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape </script> tags in string literals when producing JSON.
1168 CVE-2015-3160 611 +Info 2017-09-06 2017-09-09
4.0
None Remote Low ??? Partial None None
XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing entity references which reference files from the Beaker server's file system.
1169 CVE-2015-3138 20 DoS 2017-09-28 2018-10-30
5.0
None Remote Low Not required None None Partial
print-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service (segmentation fault and process crash).
1170 CVE-2015-2943 295 2017-09-06 2017-09-08
4.3
None Remote Medium Not required Partial None None
Honda Moto LINC 1.6.1 does not verify SSL certificates.
1171 CVE-2015-2927 399 DoS 2017-09-20 2019-11-25
6.8
None Remote Low ??? None None Complete
node 0.3.2 and URONode before 1.0.5r3 allows remote attackers to cause a denial of service (bandwidth consumption).
1172 CVE-2015-2826 200 +Info 2017-09-20 2018-10-09
5.0
None Remote Low Not required Partial None None
WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.
1173 CVE-2015-2750 601 2017-09-13 2017-09-20
5.8
None Remote Medium Not required Partial Partial None
Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence.
1174 CVE-2015-2749 601 2017-09-13 2017-09-21
5.8
None Remote Medium Not required Partial Partial None
Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.
1175 CVE-2015-2210 77 Exec Code 2017-09-06 2018-10-09
7.2
None Local Low Not required Complete Complete Complete
The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell.
1176 CVE-2015-1866 79 XSS 2017-09-20 2017-09-27
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.
1177 CVE-2015-1865 362 2017-09-20 2017-09-27
3.3
None Local Medium Not required None Partial Partial
fts.c in coreutils 8.4 allows local users to delete arbitrary files.
1178 CVE-2015-1864 79 XSS 2017-09-19 2020-05-28
3.5
None Remote Medium ??? None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name user details, or the (3) repository, (4) repository group, or (5) user group description.
1179 CVE-2015-1854 284 Bypass 2017-09-19 2019-04-16
5.0
None Remote Low Not required None Partial None
389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
1180 CVE-2015-1849 200 +Info 2017-09-19 2017-10-04
4.3
None Remote Medium Not required Partial None None
AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled.
1181 CVE-2015-1590 264 2017-09-07 2017-09-13
4.6
None Local Low Not required Partial Partial Partial
The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl.
1182 CVE-2015-1537 190 Exec Code Overflow 2017-09-28 2017-10-06
9.3
None Remote Medium Not required Complete Complete Complete
Integer overflow in IHDCP.cpp in the media_server component in Android allows remote attackers to execute arbitrary code via a crafted application.
1183 CVE-2015-1527 190 Overflow +Priv 2017-09-15 2017-09-21
4.6
None Local Low Not required Partial Partial Partial
Integer overflow in IAudioPolicyService.cpp in Android allows local users to gain privileges via a crafted application, aka Android Bug ID 19261727.
1184 CVE-2015-1526 190 DoS 2017-09-28 2017-10-06
7.1
None Remote Medium Not required None None Complete
The media_server component in Android allows remote attackers to cause a denial of service via a crafted application.
1185 CVE-2015-1336 284 +Priv 2017-09-28 2017-10-11
7.2
None Local Low Not required Complete Complete Complete
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
1186 CVE-2015-1329 416 Exec Code 2017-09-20 2017-09-28
9.3
None Remote Medium Not required Complete Complete Complete
Use-after-free vulnerability in oxide::qt::URLRequestDelegatedJob in oxide-qt in Ubuntu 15.04 and 14.04 LTS might allow remote attackers to execute arbitrary code.
1187 CVE-2015-1187 287 Exec Code 2017-09-21 2017-10-05
10.0
None Remote Low Not required Complete Complete Complete
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.
1188 CVE-2015-1027 200 +Info 2017-09-29 2017-10-10
4.3
None Remote Medium Not required Partial None None
The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Middle attacks in which the server response could be modified to allow the attacker to respond with modified command payload and have the client return additional running configuration information leading to an information disclosure of running configuration of MySQL.
1189 CVE-2015-0874 295 +Info 2017-09-26 2017-10-10
4.3
None Remote Medium Not required Partial None None
Smartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information from encrypted communications via a crafted certificate.
1190 CVE-2015-0853 20 Exec Code 2017-09-06 2021-09-09
9.3
None Remote Medium Not required Complete Complete Complete
svn-workbench 1.6.2 and earlier on a system with xeyes installed allows local users to execute arbitrary commands by using the "Command Shell" menu item while in the directory trunk/$(xeyes).
1191 CVE-2015-0689 119 Overflow Bypass 2017-09-19 2017-09-22
5.0
None Remote Low Not required None Partial None
Cisco Cloud Web Security before 3.0.1.7 allows remote attackers to bypass intended filtering protection mechanisms by leveraging improper handling of HTTP methods, aka Bug ID CSCut69743.
1192 CVE-2015-0276 352 CSRF 2017-09-21 2020-05-28
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Kallithea before 0.2.
1193 CVE-2015-0238 200 +Info 2017-09-26 2017-10-10
2.1
None Local Low Not required Partial None None
selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack.
1194 CVE-2015-0162 264 +Priv 2017-09-20 2017-09-27
6.9
None Local Medium Not required Complete Complete Complete
IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges.
1195 CVE-2015-0110 284 Bypass 2017-09-15 2017-09-26
4.0
None Remote Low ??? None Partial None
IBM Business Process Manager (aka BPM) 7.5.x, 8.0.x, and 8.5.x and WebSphere Lombardi Edition (aka WLE) 7.2.x allow remote authenticated users to bypass intended access restrictions on internal service types via vectors involving the executeServiceByName URL.
1196 CVE-2014-9758 79 XSS 2017-09-20 2020-07-29
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1.
1197 CVE-2014-9686 399 DoS 2017-09-28 2017-10-06
4.3
None Remote Medium Not required None None Partial
The Googlemaps plugin 3.2 and earlier for Joomla! allows remote attackers with control of a sub-domain belonging to a victim domain to cause a denial of service via the 'url' parameter to plugin_googlemap3_kmlprxy.php. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7428.
1198 CVE-2014-9635 254 +Info 2017-09-12 2017-09-21
5.0
None Remote Low Not required Partial None None
Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.
1199 CVE-2014-9634 254 2017-09-12 2017-09-21
5.0
None Remote Low Not required Partial None None
Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.
1200 CVE-2014-9624 287 Bypass 2017-09-12 2017-09-20
5.0
None Remote Low Not required None Partial None
CAPTCHA bypass vulnerability in MantisBT before 1.2.19.
Total number of vulnerabilities : 1228   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 (This Page)25
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.