CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2017

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2014-0097 287 2017-05-25 2022-04-20
7.5
 None Remote Low Not required Partial Partial Partial
The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.
2 CVE-2014-0225 611 2017-05-25 2022-04-11
6.8
 None Remote Medium Not required Partial Partial Partial
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
3 CVE-2014-3527 287 Bypass 2017-05-25 2021-06-08
7.5
 None Remote Low Not required Partial Partial Partial
When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request. This means if there are access control restrictions on which CAS services can authenticate to one another, those restrictions can be bypassed. If users are not using CAS Proxy tickets and not basing access control decisions based upon the CAS Service, then there is no impact to users.
4 CVE-2014-9931 119 Overflow 2017-05-16 2017-07-11
9.3
 None Remote Medium Not required Complete Complete Complete
A buffer overflow vulnerability in all Android releases from CAF using the Linux kernel can potentially occur if an OEM performs an app region size customization due to a hard-coded value.
5 CVE-2014-9932 190 Overflow 2017-05-16 2017-07-11
9.3
 None Remote Medium Not required Complete Complete Complete
In TrustZone, an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel due to an improper address range computation.
6 CVE-2014-9933 20 2017-05-16 2017-07-11
9.3
 None Remote Medium Not required Complete Complete Complete
Due to missing input validation in all Android releases from CAF using the Linux kernel, HLOS can write to fuses for which it should not have access.
7 CVE-2014-9934 347 2017-05-16 2017-07-11
9.3
 None Remote Medium Not required Complete Complete Complete
A PKCS#1 v1.5 signature verification routine in all Android releases from CAF using the Linux kernel may not check padding.
8 CVE-2014-9935 190 Overflow 2017-05-16 2017-07-11
9.3
 None Remote Medium Not required Complete Complete Complete
In TrustZone an integer overflow vulnerability leading to a buffer overflow could potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel.
9 CVE-2014-9936 362 2017-05-16 2017-07-11
7.6
 None Remote High Not required Complete Complete Complete
In TrustZone a time-of-check time-of-use race condition could potentially exist in an authentication routine in all Android releases from CAF using the Linux kernel.
10 CVE-2014-9937 119 Overflow 2017-05-16 2017-07-11
9.3
 None Remote Medium Not required Complete Complete Complete
In TrustZone a buffer overflow vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel.
11 CVE-2014-9940 416 DoS +Priv 2017-05-02 2017-11-04
7.6
 None Remote High Not required Complete Complete Complete
The regulator_ena_gpio_free function in drivers/regulator/core.c in the Linux kernel before 3.19 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted application.
12 CVE-2014-9970 200 +Info 2017-05-21 2018-02-14
5.0
 None Remote Low Not required Partial None None
jasypt before 1.9.2 allows a timing attack against the password hash comparison.
13 CVE-2015-0269 22 Dir. Trav. 2017-05-26 2017-06-08
4.0
 None Remote Low ??? Partial None None
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors.
14 CVE-2015-1529 190 DoS Overflow 2017-05-23 2017-05-26
5.0
 None Remote Low Not required None None Partial
Integer overflow in soundtrigger/ISoundTriggerHwService.cpp in Android allows attacks to cause a denial of service via unspecified vectors.
15 CVE-2015-1834 22 Dir. Trav. 2017-05-25 2021-08-25
4.0
 None Remote Low ??? None Partial None
A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 and Pivotal Cloud Foundry Elastic Runtime versions prior to 1.4.2. Path traversal is the 'outbreak' of a given directory structure through relative file paths in the user input. It aims at accessing files and directories that are stored outside the web root folder, for disallowed reading or even executing arbitrary system commands. An attacker could use a certain parameter of the file path for instance to inject '../' sequences in order to navigate through the file system. In this particular case a remote authenticated attacker can exploit the identified vulnerability in order to upload arbitrary files to the server running a Cloud Controller instance - outside the isolated application container.
16 CVE-2015-3189 640 2017-05-25 2021-08-25
4.3
 None Remote Medium Not required Partial None None
With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.
17 CVE-2015-3190 601 2017-05-25 2021-08-25
5.8
 None Remote Medium Not required Partial Partial None
With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the UAA logout link is susceptible to an open redirect which allows an attacker to insert malicious web page as a redirect parameter.
18 CVE-2015-3191 352 CSRF 2017-05-25 2021-08-25
6.8
 None Remote Medium Not required Partial Partial Partial
With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the change_email form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user logged into a cloud foundry instance via a malicious link on a attacker controlled site. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.
19 CVE-2015-3998 79 XSS 2017-05-17 2017-05-24
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php.
20 CVE-2015-4045 264 +Priv 2017-05-23 2017-05-30
7.2
 None Local Low Not required Complete Complete Complete
The sudoers file in the asset discovery scanner in AlienVault OSSIM before 5.0.1 allows local users to gain privileges via a crafted nmap script.
21 CVE-2015-4046 77 Exec Code 2017-05-23 2017-05-30
6.5
 None Remote Low ??? Partial Partial Partial
The asset discovery scanner in AlienVault OSSIM before 5.0.1 allows remote authenticated users to execute arbitrary commands via the assets array parameter to netscan/do_scan.php.
22 CVE-2015-4054 476 DoS 2017-05-23 2020-11-03
5.0
 None Remote Low Not required None None Partial
PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.
23 CVE-2015-4070 601 2017-05-17 2017-05-24
5.8
 None Remote Medium Not required Partial Partial None
Open redirect vulnerability in the proxyimages function in wowproxy.php in the Wow Moodboard Lite plugin 1.1.1.1 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
24 CVE-2015-4455 434 Exec Code 2017-05-23 2017-06-08
7.5
 None Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.
25 CVE-2015-4704 22 Dir. Trav. 2017-05-23 2017-05-31
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the File parameter to download.php.
26 CVE-2015-5211 552 2017-05-25 2022-06-05
9.3
 None Remote Medium Not required Complete Complete Complete
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.
27 CVE-2015-5241 601 2017-05-19 2017-05-31
5.8
 None Remote Medium Not required Partial Partial None
After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to redirect the browser to an unintended web page in Apache jUDDI 3.1.2, 3.1.3, 3.1.4, and 3.1.5 when utilizing the portlets based user interface also known as 'Pluto', 'jUDDI Portal', 'UDDI Portal' or 'uddi-console'. User session data, credentials, and auth tokens are cleared before the redirect.
28 CVE-2015-5381 79 XSS 2017-05-23 2018-10-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
29 CVE-2015-5382 200 +Info 2017-05-23 2018-10-30
4.0
 None Remote Low ??? Partial None None
program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.
30 CVE-2015-5383 200 +Info 2017-05-23 2018-10-30
5.0
 None Remote Low Not required Partial None None
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
31 CVE-2015-5401 20 DoS 2017-05-23 2017-06-06
5.0
 None Remote Low Not required None None Partial
Teradata Gateway before 15.00.03.02-1 and 15.10.x before 15.10.00.01-1 and TD Express before 15.00.02.08_Sles10 and 15.00.02.08_Sles11 allow remote attackers to cause a denial of service (database crash) via a malformed CONFIG REQUEST message.
32 CVE-2015-5436 DoS 2017-05-11 2020-11-24
7.8
 None Remote Low Not required None None Complete
A potential security vulnerability has been identified with HP Integrated Lights-Out 4 (iLO 4) firmware version 2.11 and later, but prior to version 2.30. The vulnerability could be exploited remotely resulting in Denial of Service (DoS). Note this was originally published in 2015 however the CVE entry was added in 2020.
33 CVE-2015-5468 22 Dir. Trav. 2017-05-23 2017-06-01
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to includes/download.php.
34 CVE-2015-5469 22 Dir. Trav. 2017-05-23 2017-05-31
5.0
 None Remote Low Not required Partial None None
Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter to includes/download.php.
35 CVE-2015-5609 22 Dir. Trav. 2017-05-23 2017-06-08
6.4
 None Remote Low Not required Partial Partial None
Absolute path traversal vulnerability in the Image Export plugin 1.1 for WordPress allows remote attackers to read and delete arbitrary files via a full pathname in the file parameter to download.php.
36 CVE-2015-5682 264 2017-05-23 2017-06-08
5.0
 None Remote Low Not required None Partial None
upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variable.
37 CVE-2015-6586 200 +Info 2017-05-23 2017-06-07
5.0
 None Remote Low Not required Partial None None
The mDNS module in Huawei WLAN AC6005, AC6605, and ACU2 devices with software before V200R006C00SPC100 allows remote attackers to obtain sensitive information by leveraging failure to restrict processing of mDNS unicast queries to the link local network.
38 CVE-2015-6817 287 2017-05-23 2020-11-03
6.8
 None Remote Medium Not required Partial Partial Partial
PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.
39 CVE-2015-8089 264 DoS +Priv 2017-05-23 2017-06-06
6.9
 None Local Medium Not required Complete Complete Complete
The GPU driver in Huawei P7 phones with software P7-L00 before P7-L00C17B851, P7-L05 before P7-L05C00B851, and P7-L09 before P7-L09C92B851 allows local users to read or write to arbitrary kernel memory locations and consequently cause a denial of service (system crash) or gain privileges via a crafted application.
40 CVE-2015-8257 77 Exec Code 2017-05-02 2017-05-16
9.0
 None Remote Low ??? Complete Complete Complete
The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in the app parameter to (1) app_license.shtml, (2) app_license_custom.shtml, (3) app_index.shtml, or (4) app_params.shtml.
41 CVE-2015-8477 79 XSS 2017-05-23 2017-05-31
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering.
42 CVE-2015-8995 190 Overflow 2017-05-16 2017-07-11
9.3
 None Remote Medium Not required Complete Complete Complete
In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.
43 CVE-2015-8996 362 2017-05-16 2017-07-11
7.6
 None Remote High Not required Complete Complete Complete
In TrustZone a time-of-check time-of-use race condition could potentially exist in a QFPROM routine in all Android releases from CAF using the Linux kernel.
44 CVE-2015-8997 362 2017-05-16 2017-07-11
7.6
 None Remote High Not required Complete Complete Complete
In TrustZone a time-of-check time-of-use race condition could potentially exist in a listener routine in all Android releases from CAF using the Linux kernel.
45 CVE-2015-8998 190 Overflow 2017-05-16 2017-07-11
9.3
 None Remote Medium Not required Complete Complete Complete
In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.
46 CVE-2015-8999 119 Overflow 2017-05-16 2017-07-11
9.3
 None Remote Medium Not required Complete Complete Complete
In TrustZone a buffer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel while loading an ELF file.
47 CVE-2015-9000 476 2017-05-16 2017-07-11
9.3
 None Remote Medium Not required Complete Complete Complete
In TrustZone an untrusted pointer dereference vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel.
48 CVE-2015-9001 200 +Info 2017-05-16 2017-07-11
4.3
 None Remote Medium Not required Partial None None
In TrustZone an information exposure vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.
49 CVE-2015-9002 189 2017-05-16 2017-07-11
9.3
 None Remote Medium Not required Complete Complete Complete
In TrustZone an out-of-range pointer offset vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel.
50 CVE-2015-9003 310 2017-05-16 2017-07-11
9.3
 None Remote Medium Not required Complete Complete Complete
In TrustZone a cryptographic issue can potentially occur in all Android releases from CAF using the Linux kernel.
Total number of vulnerabilities : 1015   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.