NVD脆弱性情報トップ

検索メニュー表示

ベンダー名
プロダクト・サービス名
タイトル
CRITICAL
HIGH
MEDIUM
LOW
CVE
CWE
公表日降順
更新日降順
表示数

NVD（National Vulnerability Database）で管理されている脆弱性の一覧を検索することが出来ます。
JVN（Japan Vulnerability Note）より先に脆弱性情報が更新される事が多いため、JVNに未記載の脆弱性が更新されている場合があります。

JVN（Japan Vulnerability Note）に関連した脆弱性がある場合は詳細画面で情報を表示します。

CWEで検索する場合は、CWE概要を参照して、CWE番号を確認してください。

CRITICAL
HIGH
MEDIUM
LOW

更新日:2024年11月17日16:13

No	CVSS	レベル攻撃区分	ベンダー名	プロダクト名	タイトル	CWE	CVE	更新日	公表日	影響表示	Exploit PoC 検索
245701	5.5	MEDIUM ローカル	openbsd	openbsd	OpenBSD 5.8 and 5.9 allows certain local users to cause a denial of service (kernel panic) by unmounting a filesystem with an open vnode on the mnt_vnodelist.	CWE-20 不適切な入力確認	CVE-2016-6247	2017-03-9 11:59	2017-03-8	表示	GitHub Exploit DB Packet Storm

245702	5.5	MEDIUM ローカル	openbsd	openbsd	OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (NULL pointer dereference and panic) via a sysctl call with a path starting with 10,9.	CWE-476 NULL ポインタデリファレンス	CVE-2016-6350	2017-03-9 11:59	2017-03-8	表示	GitHub Exploit DB Packet Storm

245703	5.5	MEDIUM ローカル	openbsd	openbsd	Integer overflow in the uvm_map_isavail function in uvm/uvm_map.c in OpenBSD 5.9 allows local users to cause a denial of service (kernel panic) via a crafted mmap call, which triggers the new mapping…	CWE-190 整数オーバーフローまたはラップアラウンド	CVE-2016-6522	2017-03-9 11:59	2017-03-8	表示	GitHub Exploit DB Packet Storm

245704	5.3	MEDIUM ネットワーク	ibm	qradar_security_information_and_event_manager	IBM QRadar Incident Forensics 7.2 allows for Cross-Origin Resource Sharing (CORS), which is a mechanism that allows web sites to request resources from external sites, avoiding the need to duplicate …	CWE-200 情報漏えい	CVE-2016-9725	2017-03-9 11:59	2017-03-8	表示	GitHub Exploit DB Packet Storm

245705	6.5	MEDIUM ネットワーク	ibm	qradar_security_information_and_event_manager	IBM QRadar 7.2 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM Reference #: 1999545.	CWE-287 不適切な認証	CVE-2016-9729	2017-03-9 11:59	2017-03-8	表示	GitHub Exploit DB Packet Storm

245706	7.5	HIGH ネットワーク	ibm	qradar_security_information_and_event_manager	IBM QRadar 7.2 could allow a remote attacker to consume all resources on the server due to not properly restricting the size or amount of resources requested by an actor. IBM Reference #: 1999556.	CWE-399 リソース管理の問題	CVE-2016-9740	2017-03-9 11:59	2017-03-8	表示	GitHub Exploit DB Packet Storm

245707	8.1	HIGH ネットワーク	ibm	qradar_security_information_and_event_manager	IBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose high…	CWE-611 XML 外部エンティティ参照の不適切な制限	CVE-2016-9724	2017-03-9 03:44	2017-03-8	表示	GitHub Exploit DB Packet Storm

245708	7.5	HIGH ネットワーク	ibm	qradar_security_information_and_event_manager	IBM Qradar 7.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, information in the back-end database. IBM Referen…	CWE-89 SQLインジェクション	CVE-2016-9728	2017-03-9 03:42	2017-03-8	表示	GitHub Exploit DB Packet Storm

245709	7.2	HIGH ネットワーク	sophos	web_appliance	The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. These vulnerabilities occur in the MgrReport.php (…	CWE-77 コマンドインジェクション	CVE-2016-9553	2017-03-9 02:36	2017-01-28	表示	GitHub Exploit DB Packet Storm

245710	9.8	CRITICAL ネットワーク	espeak-ruby_project	espeak-ruby	The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or bytes_wav method in lib/espeak/speech…	CWE-284 不適切なアクセス制御	CVE-2016-10193	2017-03-9 02:32	2017-03-4	表示	GitHub Exploit DB Packet Storm

245711	9.8	CRITICAL ネットワーク	nefarious2_project	nefarious2	The m_authenticate function in ircd/m_authenticate.c in nefarious2 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE paramet…	CWE-287 不適切な認証	CVE-2016-7145	2017-03-9 02:06	2017-03-8	表示	GitHub Exploit DB Packet Storm

245712	5.5	MEDIUM ローカル	qt	qxmlsimplereader	Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags.	CWE-119 バッファエラー	CVE-2016-10040	2017-03-9 01:55	2017-03-8	表示	GitHub Exploit DB Packet Storm

245713	5.5	MEDIUM ローカル	libtiff debian	libtiff debian_linux	The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tiff image.	CWE-125 境界外読み取り	CVE-2016-5315	2017-03-9 01:52	2017-03-8	表示	GitHub Exploit DB Packet Storm

245714	7.5	HIGH ネットワーク	openbsd	openbsd	The sys_thrsigdivert function in kern/kern_sig.c in the OpenBSD kernel 5.9 allows remote attackers to cause a denial of service (panic) via a negative "ts.tv_sec" value.	CWE-20 不適切な入力確認	CVE-2016-6244	2017-03-9 01:39	2017-03-8	表示	GitHub Exploit DB Packet Storm

245715	9.8	CRITICAL ネットワーク	flexense	sysgauge	An issue was discovered in SysGauge 1.5.18. A buffer overflow vulnerability in SMTP connection verification leads to arbitrary code execution. The attack vector is a crafted SMTP daemon that sends a …	CWE-119 バッファエラー	CVE-2017-6416	2017-03-8 11:59	2017-03-6	表示	GitHub Exploit DB Packet Storm

245716	6.1	MEDIUM ネットワーク	dotclear	dotclear	XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters.	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2017-6446	2017-03-8 11:59	2017-03-6	表示	GitHub Exploit DB Packet Storm

245717	6.1	MEDIUM ネットワーク	fenix_hosting	fenix-open-source	FenixHosting/fenix-open-source before 2017-03-04 is vulnerable to a reflected XSS in forums/search.php (search-by-topic parameter).	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2017-6479	2017-03-8 11:59	2017-03-6	表示	GitHub Exploit DB Packet Storm

245718	6.1	MEDIUM ネットワーク	groovel_project	cmsgroovel	groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php (path parameter).	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2017-6480	2017-03-8 11:59	2017-03-6	表示	GitHub Exploit DB Packet Storm

245719	6.1	MEDIUM ネットワーク	phpipam	phpipam	Multiple Cross-Site Scripting (XSS) issues were discovered in phpipam 1.2. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to several pages (instructions in app/…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2017-6481	2017-03-8 11:59	2017-03-6	表示	GitHub Exploit DB Packet Storm

245720	6.1	MEDIUM ネットワーク	atutor	atutor	Multiple Cross-Site Scripting (XSS) issues were discovered in ATutor 2.2.2. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to several pages (lang_code in themes…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2017-6483	2017-03-8 11:59	2017-03-6	表示	GitHub Exploit DB Packet Storm

245721	3.7	LOW ネットワーク	owncloud	owncloud	The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is v…	CWE-200 情報漏えい	CVE-2017-5865	2017-03-8 10:50	2017-03-4	表示	GitHub Exploit DB Packet Storm

245722	6.1	MEDIUM ネットワーク	burgundy-cms_project	burgundy-cms	Smith0r/burgundy-cms before 2017-03-06 is vulnerable to a reflected XSS in admin/components/menu/views/menuitems.php (id parameter).	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2017-6509	2017-03-8 10:48	2017-03-8	表示	GitHub Exploit DB Packet Storm

245723	4.3	MEDIUM ネットワーク	owncloud	owncloud	The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to obtain sensit…	CWE-200 情報漏えい	CVE-2017-5866	2017-03-8 10:45	2017-03-4	表示	GitHub Exploit DB Packet Storm

245724	6.1	MEDIUM ネットワーク	ca	service_desk_manager	Cross-site scripting (XSS) vulnerability in CA Service Desk Manager (formerly CA Service Desk) 12.9 and 14.1 allows remote attackers to inject arbitrary web script or HTML via the QBE.EQ.REF_NUM para…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-9148	2017-03-8 10:41	2017-03-8	表示	GitHub Exploit DB Packet Storm

245725	6.7	MEDIUM ローカル	emc	recoverpoint recoverpoint_for_virtual_machines	EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0 are affected by multiple command injection vulnerabilities where a malicious administrator with …	CWE-77 コマンドインジェクション	CVE-2016-6649	2017-03-8 10:23	2017-02-3	表示	GitHub Exploit DB Packet Storm

245726	4.4	MEDIUM ローカル	emc	recoverpoint recoverpoint_for_virtual_machines	EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0 are affected by sensitive information disclosure vulnerability as a result of incorrect permissi…	CWE-275 パーミッションの問題	CVE-2016-6648	2017-03-8 10:10	2017-02-3	表示	GitHub Exploit DB Packet Storm

245727	9.0	CRITICAL ネットワーク	pysaml2_project	pysaml2	PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.	CWE-611 XML 外部エンティティ参照の不適切な制限	CVE-2016-10127	2017-03-8 10:07	2017-03-4	表示	GitHub Exploit DB Packet Storm

245728	7.8	HIGH ローカル	rapid7	metasploit	Rapid7 Metasploit Pro installers prior to version 4.13.0-2017022101 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current wor…	CWE-426 信頼性のない検索パス	CVE-2017-5235	2017-03-8 01:24	2017-03-3	表示	GitHub Exploit DB Packet Storm

245729	7.8	HIGH ローカル	rapid7	insight_collector	Rapid7 Insight Collector installers prior to version 1.0.16 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working dir…	CWE-426 信頼性のない検索パス	CVE-2017-5234	2017-03-8 00:41	2017-03-3	表示	GitHub Exploit DB Packet Storm

245730	6.1	MEDIUM ネットワーク	php-calendar	php-calendar	A Cross-Site Scripting (XSS) issue was discovered in php-calendar before 2017-03-03. The vulnerability exists due to insufficient filtration of user-supplied data (errorMsg) passed to the "php-calend…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2017-6485	2017-03-7 23:14	2017-03-6	表示	GitHub Exploit DB Packet Storm

245731	7.5	HIGH ネットワーク	imagemagick	imagemagick	magick/memory.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via vectors involving "too many exceptions," which trigger a buffer overflow.	CWE-119 バッファエラー	CVE-2016-10067	2017-03-7 23:11	2017-03-3	表示	GitHub Exploit DB Packet Storm

245732	5.5	MEDIUM ローカル	imagemagick opensuse_project	imagemagick leap	coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of frames.	CWE-20 不適切な入力確認	CVE-2016-10069	2017-03-7 23:11	2017-03-3	表示	GitHub Exploit DB Packet Storm

245733	8.8	HIGH ネットワーク	umbraco	umbraco	Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by editing user account information in the …	CWE-352 同一生成元ポリシー違反	CVE-2015-8814	2017-03-7 22:47	2017-03-4	表示	GitHub Exploit DB Packet Storm

245734	8.2	HIGH ネットワーク	umbraco	umbraco	The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks vi…	CWE-918 サーバサイドリクエストフォージェリ	CVE-2015-8813	2017-03-7 22:46	2017-03-4	表示	GitHub Exploit DB Packet Storm

245735	7.8	HIGH ローカル	cpanel	cgiecho cgiemail	Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.	CWE-134 書式文字列の問題	CVE-2017-5613	2017-03-7 22:38	2017-03-4	表示	GitHub Exploit DB Packet Storm

245736	6.1	MEDIUM ネットワーク	cpanel	cgiecho cgiemail	cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location.	CWE-601 オープンリダイレクト	CVE-2017-5615	2017-03-7 22:34	2017-03-4	表示	GitHub Exploit DB Packet Storm

245737	6.1	MEDIUM ネットワーク	zoneminder	zoneminder	Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the path info to index.php.	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-10202	2017-03-7 22:11	2017-03-4	表示	GitHub Exploit DB Packet Storm

245738	6.1	MEDIUM ネットワーク	zoneminder	zoneminder	Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php.	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-10201	2017-03-7 21:58	2017-03-4	表示	GitHub Exploit DB Packet Storm

245739	9.8	CRITICAL ネットワーク	zoneminder	zoneminder	SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php.	CWE-89 SQLインジェクション	CVE-2016-10204	2017-03-7 21:58	2017-03-4	表示	GitHub Exploit DB Packet Storm

245740	6.1	MEDIUM ネットワーク	umbraco	umbraco	Multiple cross-site scripting (XSS) vulnerabilities in Umbraco before 7.4.0 allow remote attackers to inject arbitrary web script or HTML via the name parameter to (1) the media page, (2) the develop…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2015-8815	2017-03-7 21:56	2017-03-4	表示	GitHub Exploit DB Packet Storm

245741	6.1	MEDIUM ネットワーク	cpanel	cgiecho cgiemail	Cross-site scripting (XSS) vulnerability in cgiemail and cgiecho allows remote attackers to inject arbitrary web script or HTML via the addendum parameter.	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2017-5616	2017-03-7 21:55	2017-03-4	表示	GitHub Exploit DB Packet Storm

245742	6.1	MEDIUM ネットワーク	qbittorrent	qbittorrent	WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking.	CWE-20 不適切な入力確認	CVE-2017-6504	2017-03-7 21:39	2017-03-6	表示	GitHub Exploit DB Packet Storm

245743	5.4	MEDIUM ネットワーク	cisco	firepower_management_center	A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interf…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2017-3847	2017-03-7 11:59	2017-02-22	表示	GitHub Exploit DB Packet Storm

245744	5.9	MEDIUM ネットワーク	revive-adserver	revive_adserver	Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID.	CWE-384 セッションの固定化	CVE-2017-5831	2017-03-7 11:59	2017-03-4	表示	GitHub Exploit DB Packet Storm

245745	5.4	MEDIUM ネットワーク	revive-adserver	revive_adserver	Cross-site scripting (XSS) vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address.	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2017-5832	2017-03-7 11:59	2017-03-4	表示	GitHub Exploit DB Packet Storm

245746	6.1	MEDIUM ネットワーク	revive-adserver	revive_adserver	Cross-site scripting (XSS) vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via un…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2017-5833	2017-03-7 11:59	2017-03-4	表示	GitHub Exploit DB Packet Storm

245747	5.5	MEDIUM ローカル	libimobiledevice	libplist	The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file.	CWE-125 境界外読み取り	CVE-2017-5834	2017-03-7 11:59	2017-03-4	表示	GitHub Exploit DB Packet Storm

245748	7.5	HIGH ネットワーク	libimobiledevice	libplist	The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an inv…	CWE-415 二重解放	CVE-2017-5836	2017-03-7 11:59	2017-03-4	表示	GitHub Exploit DB Packet Storm

245749	4.0	MEDIUM ローカル	linux	linux_kernel	The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is enabled, allows local users to discover real PID values (as distinguished from PID values inside a PID namespace) by r…	CWE-200 情報漏えい	CVE-2017-5967	2017-03-7 11:59	2017-02-14	表示	GitHub Exploit DB Packet Storm

245750	5.5	MEDIUM ローカル	zziplib_project	zziplib	The zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted ZIP file.	CWE-125 境界外読み取り	CVE-2017-5977	2017-03-7 11:59	2017-03-2	表示	GitHub Exploit DB Packet Storm