CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 03:14 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2017-10399 | HC Hospitality Cruise Fleet Management Oracle | 3.1 | Oct 19 | Vulnerability in the Oracle Hospitality Cruise Fleet Management component of Oracle Hospitality Applications (subcomponent: GangwayActivityWebApp) |
| CVE-2017-10365 | MY MySQL Oracle | 3.8 | Oct 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB) |
| CVE-2017-10345 | DL Debian Linux Debian | 3.1 | Oct 19 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization) |
| CVE-2017-10341 | JA Java Advanced Management Console Oracle | 3.7 | Oct 19 | Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server) |
| CVE-2017-10308 | AP Agile Product Lifecycle Management Oracle | 3.5 | Oct 19 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Performance) |
| CVE-2017-10292 | DA Database Oracle | 2.3 | Oct 19 | Vulnerability in the RDBMS Security component of Oracle Database Server |
| CVE-2017-10194 | IL Integrated Lights Out Manager Firmware Oracle | 2.7 | Oct 19 | Vulnerability in the Oracle Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: System Management) |
| CVE-2017-10166 | SS Security Service Oracle | 3.7 | Oct 19 | Vulnerability in the Oracle Security Service component of Oracle Fusion Middleware (subcomponent: C Oracle SSL API) |
| CVE-2017-10014 | HH Hospitality Hotel Mobile Oracle | 3.5 | Oct 19 | Vulnerability in the Oracle Hospitality Hotel Mobile component of Oracle Hospitality Applications (subcomponent: Suite8/RESTAPI) |
| CVE-2017-1000114 | DA Datadog Jenkins | 3.1 | Oct 5 | The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration |
| CVE-2017-14772 | SM Skybox Manager Client Application Skyboxsecurity | 3.3 | Oct 3 | Skybox Manager Client Application is prone to information disclosure via a username enumeration attack |
| CVE-2015-5070 | FE Fedora Fedoraproject | 3.1 | Sep 26 | The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before… |
| CVE-2015-0238 | OP Openshift Redhat | 3.3 | Sep 26 | selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack |
| CVE-2017-1346 | BP Business Process Manager Ibm | 2.5 | Sep 25 | IBM Business Process Manager 7.5, 8.0, and 8.5 temporarily stores files in a temporary folder during offline installs which could be read by a local user within a short timespan |
| CVE-2017-14595 | JO Joomla Joomla | 3.7 | Sep 20 | In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state |
| CVE-2015-8224 | PF P8 Firmware Huawei | 3.7 | Sep 20 | Huawei P8 before GRA-CL00C92B210, before GRA-L09C432B200, before GRA-TL00C01B210, and before GRA-UL00C00B210 allows remote attackers to obtain user equipment (aka UE) measurements… |
| CVE-2017-10856 | BF B1 Firmware Seil | 3.7 | Sep 15 | SEIL/X 4.60 to 5.72, SEIL/B1 4.60 to 5.72, SEIL/x86 3.20 to 5.72, SEIL/BPV4 5.00 to 5.72 allows remote attackers to cause a temporary failure of the device's encrypted… |
| CVE-2017-8676 | OF Office Microsoft | 3.3 | Sep 13 | The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows… |
| CVE-2017-1520 | DB Db2 Ibm | 3.7 | Sep 12 | IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorized command that allows the database to be activated when authentication type is CLIENT |
| CVE-2016-2978 | SA Sametime Ibm | 3.3 | Aug 29 | IBM Sametime 8.5.2 and 9.0 could store potentially sensitive information from the browser cache locally that could be available to a local user |
| CVE-2016-2974 | SA Sametime Ibm | 3.3 | Aug 29 | IBM Sametime Connect 8.5.2 and 9.0, after uninstalling the Sametime Rich Client, could disclose potentially sensitive information related to the Sametime environment as well as… |
| CVE-2017-1422 | MD Maas360 Dtm Ibm | 3.3 | Aug 22 | IBM MaaS360 DTM all versions up to 3.81 does not perform proper verification for user rights of certain applications which could disclose sensitive information |
| CVE-2017-12973 | NJ Nimbus Jose+jwt Connect2id | 3.1 | Aug 20 | Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack |
| CVE-2017-3653 | MY MySQL Oracle | 3.1 | Aug 8 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) |
| CVE-2017-3650 | MY MySQL Oracle | 3.7 | Aug 8 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: C API) |
| CVE-2017-10254 | PE Peoplesoft Enterprise Staffing Front Office Oracle | 2.7 | Aug 8 | Vulnerability in the PeopleSoft Enterprise FSCM component of Oracle PeopleSoft Products (subcomponent: Staffing Front Office) |
| CVE-2017-10193 | DL Debian Linux Debian | 3.1 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security) |
| CVE-2017-10122 | SO Solaris Oracle | 1.8 | Aug 8 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel) |
| CVE-2017-10120 | DS Database Server Oracle | 1.9 | Aug 8 | Vulnerability in the RDBMS Security component of Oracle Database Server |
| CVE-2017-10095 | SO Solaris Oracle | 3.3 | Aug 8 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel) |
| CVE-2017-10088 | AP Agile Product Lifecycle Management Oracle | 3.4 | Aug 8 | Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Security) |
| CVE-2015-7561 | KU Kubernetes Kubernetes | 3.1 | Aug 7 | Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image |
| CVE-2017-9856 | SB Sunny Boy 1.5 Firmware Sma | 3.4 | Aug 5 | An issue was discovered in SMA Solar Technology products |
| CVE-2016-7812 | MU Mitsubishi Ufj Mufg | 3.1 | Aug 2 | The Bank of Tokyo-Mitsubishi UFJ, Ltd |
| CVE-2017-1381 | WA Websphere Application Server Ibm | 3.3 | Jul 21 | IBM WebSphere Application Server Proxy Server or On-demand-router (ODR) 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensitive information, caused by stale data… |
| CVE-2017-7058 | IO iOS Apple | 2.4 | Jul 20 | An issue was discovered in certain Apple products |
| CVE-2017-9843 | NA Netweaver Abap Sap | 2.7 | Jul 12 | SAP NetWeaver AS ABAP 7.40 allows remote authenticated users with certain privileges to cause a denial of service (process crash) via vectors involving disp+work.exe, aka SAP… |
| CVE-2017-0709 | AN Android Google | 3.3 | Jul 6 | A information disclosure vulnerability in the HTC sensor hub driver |
| CVE-2017-1144 | IB Integration Bus Ibm | 2.5 | Jul 5 | IBM WebSphere Message Broker could allow a local user with specialized access to prevent the message broker from starting |
| CVE-2017-1176 | MA Maximo Asset Management Ibm | 3.3 | Jul 5 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local user to obtain sensitive information due to inappropriate data retention of attachments |
| CVE-2016-0238 | SG Security Guardium Ibm | 3.7 | Jul 5 | IBM Security Guardium 9.0, 9.1, 9.5, 10.0, and 10.1 transmits sensitive data in cleartext in the query of the request |
| CVE-2017-5244 | ME Metasploit Rapid7 | 3.5 | Jun 15 | Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests |
| CVE-2015-9032 | AN Android Google | 3.3 | Jun 13 | In all Android releases from CAF using the Linux kernel, a DRM key was exposed to QTEE applications |
| CVE-2015-9031 | AN Android Google | 3.3 | Jun 13 | In all Android releases from CAF using the Linux kernel, a TZ memory address is exposed to HLOS by HDCP |
| CVE-2017-1125 | CB Cognos Business Intelligence Server Ibm | 3.3 | Jun 7 | IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents of a file |
| CVE-2017-9441 | BC Bigtree Cms Bigtreecms | 2.7 | Jun 5 | Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted… |
| CVE-2017-3741 | PM Power Management Lenovo | 3.3 | Jun 4 | In the Lenovo Power Management driver before 1.67.12.24, a local user may alter the trackpoint's firmware and stop the trackpoint from functioning correctly |
| CVE-2015-3189 | CF Cf-release Cloudfoundry | 3.7 | May 25 | With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset… |
| CVE-2017-2161 | FL Flashair Toshiba | 3.5 | May 22 | FlashAirTM SDHC Memory Card (SD-WE Series <W-03>) V3.00.02 and earlier and FlashAirTM SDHC Memory Card (SD-WD/WC Series <W-02>) V2.00.04 and earlier allows authenticated attackers… |
| CVE-2017-9139 | FF F1200 Firmware Tendacn | 3.5 | May 21 | There is a stack-based buffer overflow on some Tenda routers (FH1202/F1202/F1200: versions before 1.2.0.20) |