NVD脆弱性情報トップ

検索メニュー表示

ベンダー名
プロダクト・サービス名
タイトル
CRITICAL
HIGH
MEDIUM
LOW
CVE
CWE
公表日降順
更新日降順
表示数

NVD（National Vulnerability Database）で管理されている脆弱性の一覧を検索することが出来ます。
JVN（Japan Vulnerability Note）より先に脆弱性情報が更新される事が多いため、JVNに未記載の脆弱性が更新されている場合があります。

JVN（Japan Vulnerability Note）に関連した脆弱性がある場合は詳細画面で情報を表示します。

CWEで検索する場合は、CWE概要を参照して、CWE番号を確認してください。

CRITICAL
HIGH
MEDIUM
LOW

更新日:2024年11月18日16:13

No	CVSS	レベル攻撃区分	ベンダー名	プロダクト名	タイトル	CWE	CVE	更新日	公表日	影響表示	Exploit PoC 検索
246301	4.3	MEDIUM ネットワーク	ibm	kenexa_lms_on_cloud	IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 stores potentially sensitive information in in log files that could be read by an authenticated user.	CWE-532 ログファイルからの情報漏えい	CVE-2016-8912	2017-02-8 03:25	2017-02-2	表示	GitHub Exploit DB Packet Storm

246302	5.5	MEDIUM ローカル	libavformat_project	libavformat	The avcodec_decode_audio4 function in libavcodec in libavformat 57.34.103, as used in MPlayer, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mp3 file.	CWE-125 境界外読み取り	CVE-2016-5115	2017-02-8 03:24	2017-02-4	表示	GitHub Exploit DB Packet Storm

246303	9.8	CRITICAL ネットワーク	google	android	Buffer overflow vulnerability while processing QMI QOS TLVs. Product: Android. Versions: versions that have qmi_qos_srvc.c. Android ID: 31805216. References: QC CR#912775.	CWE-119 バッファエラー	CVE-2016-8411	2017-02-8 03:14	2017-01-28	表示	GitHub Exploit DB Packet Storm

246304	4.3	MEDIUM ネットワーク	ibm	rational_doors_next_generation rational_engineering_lifecycle_manager rational_quality_manager rational_rhapsody_design_manager rational_software_architect_design_manager rational_team…	An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker.	CWE-200 情報漏えい	CVE-2016-2987	2017-02-8 01:32	2017-02-2	表示	GitHub Exploit DB Packet Storm

246305	5.4	MEDIUM ネットワーク	ibm	jazz_reporting_service	IBM Jazz Reporting Service (JRS) is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the secur…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-5897	2017-02-8 01:25	2017-02-2	表示	GitHub Exploit DB Packet Storm

246306	4.3	MEDIUM ネットワーク	ibm	jazz_reporting_service	IBM Jazz Reporting Service (JRS) could allow a remote attacker to obtain sensitive information, caused by not restricting JSON serialization. By sending a direct request, an attacker could exploit th…	CWE-254 セキュリティ機能	CVE-2016-5898	2017-02-8 01:24	2017-02-2	表示	GitHub Exploit DB Packet Storm

246307	5.4	MEDIUM ネットワーク	ibm	jazz_reporting_service	IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality poten…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-5899	2017-02-8 01:23	2017-02-2	表示	GitHub Exploit DB Packet Storm

246308	5.4	MEDIUM ネットワーク	ibm	jazz_reporting_service	IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality poten…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-6047	2017-02-8 01:22	2017-02-2	表示	GitHub Exploit DB Packet Storm

246309	5.4	MEDIUM ネットワーク	ibm	jazz_reporting_service	IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality poten…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-6039	2017-02-8 01:21	2017-02-2	表示	GitHub Exploit DB Packet Storm

246310	5.4	MEDIUM ネットワーク	ibm	rational_collaborative_lifecycle_management	IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-6030	2017-02-8 01:20	2017-02-2	表示	GitHub Exploit DB Packet Storm

246311	5.4	MEDIUM ネットワーク	ibm	rational_collaborative_lifecycle_management	IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-6061	2017-02-8 01:20	2017-02-2	表示	GitHub Exploit DB Packet Storm

246312	5.4	MEDIUM ネットワーク	ibm	jazz_reporting_service	IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-6054	2017-02-8 01:19	2017-02-2	表示	GitHub Exploit DB Packet Storm

246313	4.3	MEDIUM ネットワーク	ibm	rational_collaborative_lifecycle_management	IBM Jazz technology based products might allow an attacker to view work item titles that they do not have privilege to view.	CWE-264 認可・権限・アクセス制御	CVE-2016-6028	2017-02-8 01:18	2017-02-2	表示	GitHub Exploit DB Packet Storm

246314	9.8	CRITICAL ネットワーク	akamai	netsession	Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because the mentioned DLL is missing from the inst…	CWE-94 コード・インジェクション	CVE-2016-10157	2017-02-7 11:59	2017-01-23	表示	GitHub Exploit DB Packet Storm

246315	7.5	HIGH ネットワーク	libreswan fedoraproject	libreswan fedora	Libreswan 3.16 might allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transform.	CWE-310 CWE-20 暗号の問題不適切な入力確認	CVE-2016-3071	2017-02-7 11:59	2016-04-18	表示	GitHub Exploit DB Packet Storm

246316	7.4	HIGH ネットワーク	mybb	merge_system mybb	The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecif…	CWE-918 サーバサイドリクエストフォージェリ	CVE-2016-9417	2017-02-6 06:13	2017-02-1	表示	GitHub Exploit DB Packet Storm

246317	5.3	MEDIUM ネットワーク	mybb	merge_system mybb	The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails.	CWE-200 情報漏えい	CVE-2016-9411	2017-02-6 06:12	2017-02-1	表示	GitHub Exploit DB Packet Storm

246318	9.8	CRITICAL ネットワーク	mybb	merge_system mybb	MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy.	CWE-284 不適切なアクセス制御	CVE-2016-9412	2017-02-6 06:12	2017-02-1	表示	GitHub Exploit DB Packet Storm

246319	9.8	CRITICAL ネットワーク	mybb	merge_system mybb	MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comparison false positives."	CWE-20 不適切な入力確認	CVE-2016-9420	2017-02-6 06:12	2017-02-1	表示	GitHub Exploit DB Packet Storm

246320	8.3	HIGH ネットワーク	mybb	merge_system mybb	xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to…	CWE-284 不適切なアクセス制御	CVE-2015-8973	2017-02-6 06:11	2017-02-1	表示	GitHub Exploit DB Packet Storm

246321	9.8	CRITICAL ネットワーク	mybb	merge_system mybb	newreply.php in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a missing permission check.	CWE-264 認可・権限・アクセス制御	CVE-2016-9403	2017-02-6 06:10	2017-02-1	表示	GitHub Exploit DB Packet Storm

246322	6.5	MEDIUM ネットワーク	mybb	merge_system mybb	The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors.	CWE-284 不適切なアクセス制御	CVE-2016-9413	2017-02-6 06:10	2017-02-1	表示	GitHub Exploit DB Packet Storm

246323	9.8	CRITICAL ネットワーク	mybb	merge_system mybb	SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to execute arbitrary SQL commands via unspe…	CWE-89 SQLインジェクション	CVE-2016-9416	2017-02-6 06:10	2017-02-1	表示	GitHub Exploit DB Packet Storm

246324	7.5	HIGH ネットワーク	mybb	merge_system mybb	MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import."	CWE-284 不適切なアクセス制御	CVE-2016-9415	2017-02-6 06:01	2017-02-1	表示	GitHub Exploit DB Packet Storm

246325	7.5	HIGH ネットワーク	mybb	merge_system mybb	MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.	CWE-200 情報漏えい	CVE-2016-9410	2017-02-6 05:58	2017-02-1	表示	GitHub Exploit DB Packet Storm

246326	7.5	HIGH ネットワーク	mybb	merge_system mybb	MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload director…	CWE-200 情報漏えい	CVE-2016-9414	2017-02-6 05:58	2017-02-1	表示	GitHub Exploit DB Packet Storm

246327	9.8	CRITICAL ネットワーク	mybb	merge_system mybb	SQL injection vulnerability in the moderation tool in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to execute arbitrary SQL commands via uns…	CWE-89 SQLインジェクション	CVE-2016-9402	2017-02-6 05:57	2017-02-1	表示	GitHub Exploit DB Packet Storm

246328	7.5	HIGH ネットワーク	mybb	merge_system mybb	MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.	CWE-532 ログファイルからの情報漏えい	CVE-2015-8977	2017-02-6 05:57	2017-02-1	表示	GitHub Exploit DB Packet Storm

246329	7.5	HIGH ネットワーク	mybb	merge_system mybb	MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a …	CWE-200 情報漏えい	CVE-2016-9418	2017-02-6 05:56	2017-02-1	表示	GitHub Exploit DB Packet Storm

246330	10.0	CRITICAL ネットワーク	mybb	merge_system mybb	SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remo…	CWE-89 SQLインジェクション	CVE-2015-8974	2017-02-6 05:56	2017-02-1	表示	GitHub Exploit DB Packet Storm

246331	5.5	MEDIUM ローカル	docker2aci_project	docker2aci	Directory traversal vulnerability in docker2aci before 0.13.0 allows remote attackers to write to arbitrary files via a .. (dot dot) in the embedded layer data in an image.	CWE-22 パス・トラバーサル	CVE-2016-7569	2017-02-6 05:45	2017-01-28	表示	GitHub Exploit DB Packet Storm

246332	5.7	MEDIUM ネットワーク	ibm	kenexa_lms	IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing dot dot sequences (/../) to view arbitra…	CWE-22 パス・トラバーサル	CVE-2016-5941	2017-02-6 05:41	2017-02-2	表示	GitHub Exploit DB Packet Storm

246333	3.3	LOW ローカル	ibm	kenexa_lms	IBM Kenexa LMS on Cloud allows web pages to be stored locally which can be read by another user on the system.	CWE-200 情報漏えい	CVE-2016-5938	2017-02-6 05:39	2017-02-2	表示	GitHub Exploit DB Packet Storm

246334	3.7	LOW ネットワーク	ibm	bigfix_platform	IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) could allow a remote attacker to obtain sensitive information due to a missing HTTP Strict-Transport-Security Header through man in the mi…	CWE-200 情報漏えい	CVE-2016-0297	2017-02-6 05:38	2017-02-2	表示	GitHub Exploit DB Packet Storm

246335	3.3	LOW ローカル	ibm	bigfix_platform	IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available to a local user.	CWE-532 ログファイルからの情報漏えい	CVE-2016-0296	2017-02-6 05:37	2017-02-2	表示	GitHub Exploit DB Packet Storm

246336	5.3	MEDIUM ネットワーク	ibm	security_appscan_source	IBM AppScan Source could reveal some sensitive information through the browsing of testlinks on the server.	CWE-200 情報漏えい	CVE-2016-3035	2017-02-6 05:35	2017-02-2	表示	GitHub Exploit DB Packet Storm

246337	5.4	MEDIUM ネットワーク	ibm	kenexa_lms	IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially le…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-5942	2017-02-6 05:33	2017-02-2	表示	GitHub Exploit DB Packet Storm

246338	5.4	MEDIUM ネットワーク	ibm	kenexa_lms_on_cloud	IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended funct…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-6123	2017-02-6 05:32	2017-02-2	表示	GitHub Exploit DB Packet Storm

246339	5.4	MEDIUM ネットワーク	ibm	kenexa_lms_on_cloud	IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended funct…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-6125	2017-02-6 05:32	2017-02-2	表示	GitHub Exploit DB Packet Storm

246340	5.4	MEDIUM ネットワーク	ibm	kenexa_lms	IBM Kenexa LMS on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially le…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-5940	2017-02-6 05:30	2017-02-2	表示	GitHub Exploit DB Packet Storm

246341	5.4	MEDIUM ネットワーク	ibm	kenexa_lms_on_cloud	IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended funct…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-8920	2017-02-6 05:30	2017-02-2	表示	GitHub Exploit DB Packet Storm

246342	5.4	MEDIUM ネットワーク	ibm	campaign	IBM Campaign is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute s…	CWE-79 クロスサイト・スクリプティング（XSS）	CVE-2016-0265	2017-02-6 05:29	2017-02-2	表示	GitHub Exploit DB Packet Storm

246343	5.5	MEDIUM ローカル	potrace_project	potrace	The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted BMP image, a different vulne…	CWE-476 NULL ポインタデリファレンス	CVE-2016-8696	2017-02-6 05:17	2017-02-1	表示	GitHub Exploit DB Packet Storm

246344	7.8	HIGH ローカル	potrace_project	potrace	Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability …	CWE-119 バッファエラー	CVE-2016-8698	2017-02-6 05:17	2017-02-1	表示	GitHub Exploit DB Packet Storm

246345	7.8	HIGH ローカル	potrace_project	potrace	The bm_new function in bitmap.h in potrace 1.13 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.	CWE-119 バッファエラー	CVE-2016-8686	2017-02-6 05:16	2017-02-1	表示	GitHub Exploit DB Packet Storm

246346	5.5	MEDIUM ローカル	potrace_project	potrace	The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted BMP image, a different vulne…	CWE-476 NULL ポインタデリファレンス	CVE-2016-8694	2017-02-6 05:16	2017-02-1	表示	GitHub Exploit DB Packet Storm

246347	5.5	MEDIUM ローカル	potrace_project	potrace	The bm_new function in bitmap.h in potrace before 1.13 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a crafted BMP image.	CWE-369 ゼロ除算	CVE-2016-8697	2017-02-6 05:16	2017-02-1	表示	GitHub Exploit DB Packet Storm

246348	7.8	HIGH ローカル	potrace_project	potrace	Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability …	CWE-119 バッファエラー	CVE-2016-8702	2017-02-6 05:16	2017-02-1	表示	GitHub Exploit DB Packet Storm

246349	7.8	HIGH ローカル	potrace_project	potrace	Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability …	CWE-119 バッファエラー	CVE-2016-8703	2017-02-6 05:16	2017-02-1	表示	GitHub Exploit DB Packet Storm

246350	5.5	MEDIUM ローカル	potrace_project	potrace	The findnext function in decompose.c in potrace 1.13 allows remote attackers to cause a denial of service (invalid memory access and crash) via a crafted BMP image.	CWE-119 バッファエラー	CVE-2016-8685	2017-02-6 05:15	2017-02-1	表示	GitHub Exploit DB Packet Storm