VulnCheck KEV: CVE-2009-2526

Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remote attackers to cause a denial of service infinite loop and system hang via a crafted packet to the Server service, aka "SMBv2 Infinite Loop Vulnerability."...

CVE-2017-9673

In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account via the index.php/user/new URI or change its settings via the index.php/user/1 URI, including its password...

EFS Software Easy Chat Server Password Reset Vulnerability

EFS Software Easy Chat Server is a simple Web-based chat program from EFS Software. A security vulnerability exists in the register.ghp file in EFS Software Easy Chat Server versions 2.0 through 3.1. A remote attacker can exploit this vulnerability by sending a specially crafted POST request to t...

CVE-2017-9543

register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to reset arbitrary passwords via a crafted POST request to registresult.htm...

Zend Framework Cross-Site Request Forgery Vulnerability

Zend Framework ZF is the United States Zend company developed a set of open source PHP5 development framework , it is mainly used for the development of Web programs and services. A cross-site request forgery vulnerability exists in Zend/Validator/Csrf in version 2.3.x prior to ZF 2.3.6. A remote...

CICMS V2.1 suffers from sql injection vulnerability

CICMS system is developed by php+mysql, based on CodeIgniter, and is mainly used for enterprise building. CICMS V2.1 suffers from a sql injection vulnerability. An attacker can exploit this vulnerability to obtain the server's password...

WebsiteBaker cross-site scripting vulnerability (CNVD-2017-08708)

WebsiteBaker is an open source PHP content management system CMS maintained and developed by the WebsiteBaker organization. The system supports WYSIWYG editor, search engine optimization and add-ons. A cross-site scripting vulnerability exists in the /account/details.php file in WebsiteBaker...

ALPINE-CVE-2017-9354

In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the RGMP dissector could crash. This was addressed in epan/dissectors/packet-rgmp.c by validating an IPv4 address...

OpenEXR "= operator" Denial of Service Vulnerability

OpenEXR is an open-standard, high dynamic range image format that is widely used in computer graphics to store image data, but can also store some data needed for post-synthesis processing. A denial of service vulnerability exists in the = operator function in half.h in OpenEXR version 2.2.0, whi...

Ecshop has an arbitrary file read vulnerability

ECShop is a B2C independent online store system developed based on PHP language and MYSQL database framework, suitable for enterprises and individuals to quickly build a personalized online store. An arbitrary file read vulnerability exists in Ecshop version 2.7.3, which can be exploited by...

e107 SQL Injection Vulnerability (CNVD-2017-10152)

e107 is an open source, free and PHP and MySQL based Content Management System CMS developed by e107 team. The system supports a variety of plug-in programs and appearance of the theme , can be used as a personal blog , discussion community , archive repository and so on. A SQL injection...

VideoLAN VLC Denial of Service Vulnerability (CNVD-2017-10161)

VideoLAN VLC media player is a free, open source cross-platform multimedia player also a multimedia framework developed by the French organization VideoLAN. The product supports playback of a variety of media files, CD-ROMs, etc., a variety of audio and video formats WMV, MP3, etc. and so on. A...

nss: Null pointer dereference when handling empty SSLv2 messages

A null pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library...

systemd-resolved denial of service vulnerability

systemd-resolved is a system service used to manage network name resolution. A denial of service vulnerability exists in systemd-resolved version 233 and earlier. A remote attacker could use this vulnerability to cause a denial of service daemon crash with a specially crafted DNS response...

LibRaw-demosaic-pack-GPL2 stack buffer overflow vulnerability

LibRaw is a library for reading RAW files from digital cameras. A stack-based buffer overflow vulnerability exists in LibRaw-demosaic-pack-GPL2. An attacker can exploit this vulnerability to cause a boundary condition error and also launch further attacks...

Exadel Flamingo Remote Code Execution Vulnerability (CNVD-2017-10732)

Exadel Flamingo is a set of tools for bootstrapping RIA applications built with a Java backend. A remote code execution vulnerability exists in Exadel Flamingo version 2.2.0. A remote attacker could exploit this vulnerability to execute arbitrary code in the context of an affected application...

CVE-2017-6027

An Arbitrary File Upload issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following versions of CODESYS Web Server, part of the CODESYS WebVisu web browser visualization software, are affected: CODESYS Web Server Versions 2.3 and prior. A specially crafted web serv...

Juniper Networks NorthStar Controller Application Remote Elevation of Privilege Vulnerability (CNVD-2017-07238)

Juniper Networks NorthStar Controller Application is a traffic planning controller from Juniper Networks, Inc. The controller optimizes service provider transport networks by establishing open industry standard protocols. A remote elevation of privilege vulnerability exists in Juniper Networks...

Juniper Networks NorthStar Controller Application Buffer Overflow Vulnerability (CNVD-2017-07222)

Juniper Networks NorthStar Controller Application is a traffic planning controller from Juniper Networks, Inc. The controller optimizes service provider transport networks by establishing open industry standard protocols. A buffer overflow vulnerability exists in Juniper Networks NorthStar...

Juniper Networks NorthStar Controller Application Buffer Overflow Vulnerability

Juniper Networks NorthStar Controller Application is a traffic planning controller from Juniper Networks, Inc. The controller optimizes service provider transport networks by establishing open industry standard protocols. A buffer overflow vulnerability exists in Juniper Networks NorthStar...