product: Synology DiskStation Manager (DSM)

summary: Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager (DSM) 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows remote authenticated users to write arbitrary files via the dest_folder_path parameter.


product: Synology Router Manager (SRM)

vendor: Synology

status: affected

ecosystem: software/application

metric_type: Primary

severity: medium

part: a

vendor: synology

quality: metadata-backed

recipe_kind: composed

status: Modified

summary: Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager (SRM) before 1.1.5-6542-4 allows remote authenticated users to write arbitrary files via the dest_folder_path parameter.

title: Synology Router Manager security vulnerability


vendor: The Node.js Project

version: 4.0.0 and higher

version: 6.0.0 and higher

version: 8.0.0 and higher

version: 9.0.0 and higher

archetype: generic

ecosystem: javascript/npm

severity: critical

vendor: nodejs

summary: Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.


version: 8.0 and higher

version: 9.0 and higher

severity: low

summary: Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, "This is not correctly encoded", "hex");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.

title: Nodejs Node.Js security vulnerability


metric_type: Secondary

product: openssh

vendor: openbsd

vendor: oracle

part: o

vendor: debian

vendor: netapp

product: solidfire

summary: The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.

title: Openbsd Openssh security vulnerability


severity: high

product: phpcollab

vendor: phpcollab

summary: SQL injection vulnerability in phpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to newsdesk/newsdesk.php.

title: Phpcollab security vulnerability


product: systemd

summary: In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() function of the 'systemd-resolved' service and cause a DoS of the affected service.

title: Systemd Project Systemd security vulnerability


ecosystem: operating-system

vendor: dlink

summary: D-Link DGS-1500 Ax devices before 2.51B021 have a hardcoded password, which allows remote attackers to obtain shell access.


product: openfire

vendor: igniterealtime

summary: The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application.

title: Igniterealtime Openfire security vulnerability


product: whale

vendor: navercorp

summary: The Installer in Whale allows DLL hijacking.


product: borg

vendor: borgbackup

summary: Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3.


vendor: paessler

summary: In Paessler PRTG Network Monitor 17.3.33.2830, it's possible to create a Map as a read-only user, by forging a request and sending it to the server.

title: Paessler Prtg Network Monitor security vulnerability


product: sera

vendor: ignitum

summary: Sera 1.2 stores the user's login password in plain text in their home directory. This makes privilege escalation trivial and also exposes the user and system keychains to local attacks.


ecosystem: php/wordpress

product: ultimate-form-builder-lite

vendor: accesspressthemes

summary: The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin-ajax.php.

title: Accesspressthemes Ultimate-Form-Builder-Lite security vulnerability


product: anti-malware

vendor: watchdogdevelopment

summary: In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer dereference vulnerability that gets triggered when sending an operation to ioctl 0x80002054. This is due to the input buffer being NULL or the input buffer size being 0 as they are not validated.

title: Watchdogdevelopment Anti-Malware security vulnerability


summary: In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer dereference vulnerability that gets triggered when sending an operation to ioctl 0x80002010. This is due to the input buffer being NULL or the input buffer size being 0 as they are not validated.


product: libextractor

vendor: gnu

summary: In GNU Libextractor 1.4, there is an out-of-bounds read in the EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c.


product: konversation

vendor: konversation

summary: Konversation 1.4.x, 1.5.x, 1.6.x, and 1.7.x before 1.7.3 allow remote attackers to cause a denial of service (crash) via vectors related to parsing of IRC color formatting codes.

title: Konversation security vulnerability


product: shadowsocks-libev

vendor: shadowsocks

summary: In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the add_server, build_config, and construct_command_line functions.

title: Shadowsocks Shadowsocks-Libev security vulnerability


product: ox

summary: In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.


product: graphicsmagick

vendor: graphicsmagick

summary: In ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26, a Null Pointer Dereference occurs while transferring JPEG scanlines, related to a PixelPacket pointer.

title: Graphicsmagick security vulnerability


vendor: radare

summary: In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c via crafted ELF files on 32bit systems.

title: Radare Radare2 security vulnerability


summary: In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c via crafted ELF files when parsing the ELF version on 32bit systems.

title: Radare Radare2 security vulnerability


product: eyesofnetwork

vendor: eyesofnetwork

summary: SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the host parameter to module/capacity_per_device/index.php.

title: Eyesofnetwork security vulnerability


vendor: artica

summary: Artica Pandora FMS version 7.0 is vulnerable to stored Cross-Site Scripting in the map name parameter.


summary: Artica Pandora FMS version 7.0 is vulnerable to remote PHP code execution through the manager files function. This is only exploitable by administrators who upload a PHP file.


summary: In Artica Pandora FMS version 7.0, an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, the script will get executed.

title: Artica Pandora Fms security vulnerability


summary: Artica Pandora FMS version 7.0 leaks a full installation pathname via GET data when intercepting the main page's graph requisition. This also implies that general OS information is leaked (e.g., a /var/www pathname typically means Linux or UNIX).


product: binutils

summary: dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, miscalculates DW_FORM_ref_addr die refs in the case of a relocatable object file, which allows remote attackers to cause a denial of service (find_abstract_instance_name invalid memory read, segmentation fault, and application crash).

title: Gnu Binutils security vulnerability


summary: dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles NULL files in a .debug_line file table, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename. NOTE: this issue is caused by an incomplete fix for CVE-2017-15023.

title: Gnu Binutils security vulnerability


product: pan-os

vendor: paloaltonetworks

summary: The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote authenticated users to execute arbitrary code via unspecified vectors.

title: Paloaltonetworks Pan-Os security vulnerability


summary: Cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.7, when the GlobalProtect gateway or portal is configured, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


summary: Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.13, and 8.0.x before 8.0.6 allows remote attackers to cause a denial of service via vectors related to the management interface.


archetype: ssrf

summary: The configuration file import for applications, spyware and vulnerability objects functionality in the web interface in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, and 7.1.x before 7.1.14 allows remote attackers to conduct server-side request forgery (SSRF) attacks and consequently obtain sensitive information via vectors related to parsing of external entities.


business_risk: Critical. CVE-2017-15944 enables unauthenticated remote code execution through the PAN-OS or Panorama management interface. CISA lists it in the Known Exploited Vulnerabilities Catalog, so exposed vulnerable devices should be treated as potentially compromised and prioritized for remediation.

claim: The vulnerability affects PAN-OS and Panorama on the management interface.

claim: Palo Alto Networks identifies PAN-OS 6.1.18 and earlier, 7.0.18 and earlier, and 7.1.13 and earlier as affected; NVD additionally records the 8.0.x range before 8.0.6.

claim: Exploitation is performed remotely through the device management interface and can result in code execution before authentication; management-interface isolation and access restriction reduce exposure.

kind: exposure

claim: The vendor identifies PAN-OS 6.1.19, 7.0.19, 7.1.14, and 8.0.6 as the relevant unaffected or patched thresholds.

claim: The vendor recommends upgrading and describes content update 756 with signatures 40483 and 40484 as an interim mitigation for traffic destined for the management interface.

kind: remediation

claim: Verification can be performed by comparing the running PAN-OS or Panorama release with the vendor's unaffected-version table and confirming management-interface isolation or access restrictions; this does not require exploit testing.

kind: verification

exposure_conditions: The device runs an affected PAN-OS release: 6.1.18 or earlier; 7.0.18 or earlier; 7.1.13 or earlier; or 8.0.x before 8.0.6.

exposure_conditions: The management interface is reachable by an attacker. Palo Alto Networks states that exploitation occurs through the device management interface and can occur before authentication.

exposure_conditions: The vulnerable device or management interface is insufficiently isolated from untrusted or broadly reachable networks.

recipe_specificity: specific

remediation_steps: Upgrade PAN-OS to at least 6.1.19, 7.0.19, 7.1.14, or 8.0.6, according to the installed release branch and vendor support guidance.

remediation_steps: Until software updates are applied, isolate the management interface and restrict access to authorized security-administration personnel using network segmentation or PAN-OS IP access-control restrictions.

remediation_steps: Apply Palo Alto Networks content update 756 with vulnerability signatures 40483 and 40484 as an interim mitigation, ensuring the signatures are applied to a firewall rule protecting traffic destined for the management interface.

remediation_steps: Where applicable, use Panorama for centralized administration and disable HTTP/HTTPS management access on vulnerable appliances, consistent with the vendor's stated mitigation guidance.

remediation_steps: Because the CVE is listed in CISA's Known Exploited Vulnerabilities Catalog, investigate relevant devices for signs of unauthorized access or compromise in accordance with incident-response procedures.

status: complete

uncertainty: The supplied source record contains a generic affected-data entry with product and version listed as n/a; the product, version ranges, exposure condition, fixes, and mitigations are instead supported by the Palo Alto Networks advisory and NVD.

uncertainty: The vendor advisory states that PAN-OS 8.0 was not remotely exploitable by an unauthenticated user using this vulnerability, while also noting that PAN-OS 8.0.6 includes related patches. Apply the vendor's branch-specific guidance rather than inferring exploitability solely from the CPE range.

uncertainty: No device inventory, running version, management-interface exposure, patch state, or compromise status was provided.

verification_steps: Identify the running PAN-OS or Panorama release through the normal administrative interface or approved asset-inventory process.

verification_steps: Confirm the installed release is at or above the vendor's unaffected threshold: 6.1.19, 7.0.19, 7.1.14, or 8.0.6, as applicable.

verification_steps: Confirm that management-interface access is restricted to authorized administration networks or addresses and is not broadly reachable from untrusted networks.

verification_steps: If interim signatures were used, confirm through the normal administrative interface that content update 756 and signatures 40483 and 40484 are installed and associated with the management-interface protection policy.

verification_steps: Do not use exploit payloads or active exploitation tests for verification.

known_ransomware_campaign_use: Unknown

product: PAN-OS

required_action: Apply updates per vendor instructions.

vendor_project: Palo Alto Networks

vulnerability_name: Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

author: Codex

description: CVE-2017-15944 is CISA KEV PAN-OS leftover. NVD CPE excludes 6.1.19 / 7.0.19 / 7.1.14 / 8.0.6. Content update 756 is not a floor.

maturity: development

title: CVE-2017-15944: PAN-OS management-interface RCE

recipe_kind: markdown-draft

status: Analyzed

summary: Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.


product: mariadb

vendor: mariadb

product: mysql

vendor: mysql

summary: The installation scripts in the Gentoo dev-db/mysql, dev-db/mariadb, dev-db/percona-server, dev-db/mysql-cluster, and dev-db/mariadb-galera packages before 2017-09-29 have chown calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to the mysql account for creation of a link.

title: Mariadb security vulnerability


vendor: selfget

summary: In the com_tag component 1.7.6 for Joomla!, a SQL injection vulnerability is located in the `tag` parameter to index.php. The request method to execute is GET.


vendor: aspsource

summary: Simple ASC Content Management System v1.2 has XSS in the location field in the sign function, related to guestbook.asp, formgb.asp, and msggb.asp.

title: Aspsource Simple Asc Content Management System security vulnerability


product: perch

vendor: grabaperch

summary: Perch Content Management System 3.0.3 allows unrestricted file upload (with resultant XSS) via the Asset Title field in conjunction with the Select File field. This is exploitable with a Limited Admin account.

title: Grabaperch Perch security vulnerability


product: xavier

vendor: angry-frog

summary: Xavier PHP Management Panel 2.4 allows SQL injection via the usertoedit parameter to admin/adminuseredit.php or the log_id parameter to admin/editgroup.php.

title: Angry-Frog Xavier security vulnerability


product: syncbreeze

vendor: flexense

summary: Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution. The flaw is triggered by providing a long input into the "Destination directory" field, either within an XML document or through use of passive mode.


ecosystem: linux/kernel

vendor: linux

summary: The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the "negative" state to avoid a race condition, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.

title: Linux Linux Kernel security vulnerability


vendor: debian

product: bchunk

summary: bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE (.cue) file.

title: Bchunk Project Bchunk security vulnerability


summary: bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow (with a resultant invalid free) and crash when processing a malformed CUE (.cue) file.


summary: bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to an "Access violation near NULL on destination operand" and crash when processing a malformed CUE (.cue) file.


summary: ConverTo Video Downloader & Converter 1.4.1 allows Arbitrary File Download via the token parameter to download.php.


summary: my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.


vendor: domainzaar

summary: D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.


product: adultscriptpro

vendor: adultscriptpro

summary: Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-2007-6576.


vendor: yourarticlesdirectory

summary: Article Directory Script 3.0 allows SQL Injection via the id parameter to author.php or category.php.


summary: iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php.


summary: iStock Management System 1.0 allows Arbitrary File Upload via user/profile.


vendor: itechscripts

summary: iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser parameter.


vendor: nicephpscripts

summary: Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.


vendor: nswd

summary: The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in an invoice.create action.


summary: The Zh YandexMap (aka com_zhyandexmap) component 6.1.1.0 for Joomla! allows SQL Injection via the placemarklistid parameter to index.php.


vendor: mailing-manager

summary: Mailing List Manager Pro 3.0 allows SQL Injection via the edit parameter to admin/users in a sort=login action, or the edit parameter to admin/template.

title: Mailing-Manager Mailing List Manager Pro security vulnerability


product: mybuildersite

vendor: contractorscripts

summary: MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter.


product: allsharevideo

vendor: pilotgroup

summary: PG All Share Video 1.0 allows SQL Injection via the PATH_INFO to search/tag, friends/index, users/profile, or video_catalog/category.


product: phpcityportal

vendor: phpcityportal

summary: PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.


vendor: softdatepro

summary: Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sender_id parameter, or the /admin Email field, a related issue to CVE-2017-15972.

title: Softdatepro Same Date Pro security vulnerability


summary: SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sender_id parameter, or the /admin Email field, a related issue to CVE-2017-15971.

title: Softdatepro Dating Software security vulnerability


product: sokial

vendor: sokial

summary: Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view.php.


product: tpanel

vendor: datacomponents

summary: tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.


vendor: vastal

summary: Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability than CVE-2008-4461.


product: zeebuddy

vendor: zeescripts

summary: ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-2008-3604.


vendor: protectedlinks

summary: Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter.


vendor: arox

summary: AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter.


product: shareet

vendor: odallated

summary: Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter.


vendor: rowindex

summary: US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter.


product: newspaper

vendor: geniusocean

summary: Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.


product: news

summary: Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.


summary: MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.


vendor: bekirk

summary: Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php.


summary: Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter.


summary: CPA Lead Reward Script allows SQL Injection via the username parameter.


summary: Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter.


vendor: nicephpscripts

summary: Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008-6525.


summary: Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action.


product: phpinventory

vendor: savsofteproducts

summary: Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/.


summary: Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searchResidential.php via the property_type, city, or bedroom parameter, a different vulnerability than CVE-2008-3951, CVE-2009-3497, and CVE-2012-0982.

title: Vastal Agent Zone security vulnerability


summary: Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php.


summary: Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.


product: rsync

vendor: samba

summary: rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.

title: Samba Rsync security vulnerability


product: binutils

vendor: gnu

summary: elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggers a "buffer overflow on fuzzed archive header," related to an uninitialized variable, an improper conditional jump, and the get_archive_member_name, process_archive_index_and_symbols, and setup_archive functions.

title: Gnu Binutils security vulnerability


vendor: nq

summary: In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password locally stored in shared preferences. Because there is a static RC4 key, an attacker can gain access to user credentials more easily by leveraging access to the preferences XML file.

title: Nq Contacts Backup & Restore security vulnerability


summary: In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact data. This makes it easier for remote attackers to obtain cleartext information by sniffing the network.


summary: In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attacks where only the hash value is required.