CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In July 2017

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1251 CVE-2015-4462 434 2017-07-25 2017-08-10
4.0
None Remote Low ??? Partial None None
Absolute path traversal vulnerability in the file_manager component of eFront CMS before 3.6.15.5 allows remote authenticated users to read arbitrary files via a full pathname in the "Upload file from url" field in the file manager for professor.php.
1252 CVE-2015-4035 20 Exec Code 2017-07-25 2019-04-22
4.6
None Local Low Not required Partial Partial Partial
scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name.
1253 CVE-2015-3932 91 2017-07-21 2017-07-26
6.8
None Remote Medium Not required Partial Partial Partial
Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object.
1254 CVE-2015-3931 91 2017-07-21 2017-07-26
6.8
None Remote Medium Not required Partial Partial Partial
Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object.
1255 CVE-2015-3886 295 2017-07-21 2017-07-25
7.5
None Remote Low Not required Partial Partial Partial
libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors.
1256 CVE-2015-3640 94 2017-07-21 2017-07-25
6.0
None Remote Medium ??? Partial Partial Partial
phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote authenticated users with knowledge of a web-accessible and web-writeable directory on the target system to inject and execute arbitrary PHP scripts by injecting scripts via the path, filename, and dirs parameters to scheduled.php, and making requests to injected scripts.
1257 CVE-2015-3639 20 Exec Code 2017-07-21 2017-07-25
6.5
None Remote Low ??? Partial Partial Partial
phpMyBackupPro 2.5 and earlier does not properly sanitize input strings, which allows remote authenticated users to execute arbitrary PHP code by storing a crafted string in a user configuration file.
1258 CVE-2015-3638 94 Exec Code 2017-07-21 2017-07-25
6.5
None Remote Low ??? Partial Partial Partial
phpMyBackupPro before 2.5 does not validate integer input, which allows remote authenticated users to execute arbitrary PHP code by injecting scripts via the path, filename, and period parameters to scheduled.php, and making requests to injected scripts, or by injecting PHP into a PHP configuration variable via a PHP variable variable.
1259 CVE-2015-3421 79 XSS 2017-07-21 2017-07-26
4.3
None Remote Medium Not required None Partial None
The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which allows remote attackers to perform cross-site scripting (XSS) attacks, or a path disclosure attack via crafted variables named after target PHP variables.
1260 CVE-2015-3297 22 Dir. Trav. 2017-07-07 2017-07-14
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests.
1261 CVE-2015-3278 20 2017-07-25 2017-07-31
7.5
None Remote Low Not required Partial Partial Partial
The cipherstring parsing code in nss_compat_ossl while in multi-keyword mode does not match the expected set of ciphers for a given cipher combination, which allows attackers to have unspecified impact via unknown vectors.
1262 CVE-2015-3243 532 +Info 2017-07-25 2017-07-31
2.1
None Local Low Not required Partial None None
rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by reading files in /var/log/cron.
1263 CVE-2015-3208 611 2017-07-25 2018-10-17
7.5
None Remote Low Not required Partial Partial Partial
XML external entity (XXE) vulnerability in the XPath selector component in Artemis ActiveMQ before commit 48d9951d879e0c8cbb59d4b64ab59d53ef88310d allows remote attackers to have unspecified impact via unknown vectors.
1264 CVE-2015-3198 200 +Info 2017-07-21 2017-08-07
5.0
None Remote Low Not required Partial None None
The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL.
1265 CVE-2015-3171 200 +Info 2017-07-25 2019-12-11
2.1
None Local Low Not required Partial None None
sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.
1266 CVE-2015-3170 254 DoS 2017-07-21 2017-07-26
2.1
None Local Low Not required None None Partial
selinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by creating a hardlink to /etc/passwd from a directory named .config, and updating selinux-policy.
1267 CVE-2015-3149 59 2017-07-25 2017-07-31
2.1
None Local Low Not required None Partial None
The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack.
1268 CVE-2015-2798 89 Exec Code Sql 2017-07-25 2017-08-10
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
1269 CVE-2015-2280 78 Exec Code 2017-07-25 2018-10-09
9.0
None Remote Low ??? Complete Complete Complete
snwrite.cgi in AirLink101 SkyIPCam1620W Wireless N MPEG4 3GPP network camera with firmware FW_AIC1620W_1.1.0-12_20120709_r1192.pck allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the mac parameter.
1270 CVE-2015-2279 78 Exec Code 2017-07-25 2018-10-09
10.0
None Remote Low Not required Complete Complete Complete
cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the write_mac write_pid, write_msn, write_tan, or write_hdv parameter.
1271 CVE-2015-1847 22 Dir. Trav. 2017-07-25 2017-08-04
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally inaccessible files via a .. (dot dot) in a crafted URL.
1272 CVE-2015-1438 119 Exec Code Overflow 2017-07-25 2017-07-31
7.2
None Local Low Not required Complete Complete Complete
Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary code with kernel privileges via a crafted size input for allocated kernel paged pool and allocated non-paged pool buffers.
1273 CVE-2015-1417 400 DoS 2017-07-25 2019-03-20
5.0
None Remote Low Not required None None Partial
The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x before 9.3-STABLE, 9.3-RELEASE-p21, and 8.x before 8.4-STABLE, 8.4-RELEASE-p35 on systems with VNET enabled and at least 16 VNET instances allows remote attackers to cause a denial of service (mbuf consumption) via multiple concurrent TCP connections.
1274 CVE-2015-1332 119 DoS Exec Code Overflow 2017-07-25 2017-08-10
6.8
None Remote Medium Not required Partial Partial Partial
The oxide::JavaScriptDialogManager function in oxide-qt before 1.9.1 as packaged in Ubuntu 15.04 and Ubuntu 14.04 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted website.
1275 CVE-2015-1323 200 +Info 2017-07-21 2017-07-25
4.9
None Local Low Not required Complete None None
The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to obtain sensitive information, or access files with root permissions.
1276 CVE-2015-0904 295 +Info 2017-07-25 2017-07-31
4.3
None Remote Medium Not required Partial None None
The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote attackers to obtain sensitive information via a man-in-the-middle attack.
1277 CVE-2015-0674 79 XSS 2017-07-25 2017-07-31
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Alert Service of Cisco Cloud Web Security base revision allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
1278 CVE-2015-0249 94 Exec Code 2017-07-17 2017-07-27
6.5
None Remote Low ??? Partial Partial Partial
The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka VTL).
1279 CVE-2014-7954 22 Dir. Trav. 2017-07-07 2018-10-09
2.1
None Local Low Not required None Partial None
Directory traversal vulnerability in the doSendObjectInfo method in frameworks/av/media/mtp/MtpServer.cpp in Android 4.4.4 allows physically proximate attackers with a direct connection to the target Android device to upload files outside of the sdcard via a .. (dot dot) in a name parameter of an MTP request.
1280 CVE-2014-7953 362 Exec Code 2017-07-07 2018-10-09
6.9
None Local Medium Not required Complete Complete Complete
Race condition in the bindBackupAgent method in the ActivityManagerService in Android 4.4.4 allows local users with adb shell access to execute arbitrary code or any valid package as system by running "pm install" with the target apk, and simultaneously running a crafted script to process logcat's output looking for a dexopt line, which once found should execute bindBackupAgent with the uid member of the ApplicationInfo parameter set to 1000.
Total number of vulnerabilities : 1280   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.