Vulnerabilities > Medium

DATE CVE VULNERABILITY TITLE RISK
2017-11-06 CVE-2017-15039 Cross-site Scripting vulnerability in Zurmo CRM 3.2.1.57987Acc3018
Cross-site scripting (XSS) exists in Zurmo 3.2.1.57987acc3018 via a data: URL in the redirectUrl parameter to app/index.php/meetings/default/createMeeting.
network
low complexity
zurmo CWE-79
4.8
2017-11-04 CVE-2017-16541 Information Exposure vulnerability in multiple products
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil.
network
low complexity
torproject redhat debian CWE-200
6.5
2017-11-04 CVE-2017-16539 Information Exposure vulnerability in Mobyproject Moby
The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a "scsi remove-single-device" line to /proc/scsi/scsi, aka SCSI MICDROP.
network
high complexity
mobyproject CWE-200
5.9
2017-11-04 CVE-2017-16538 Improper Input Validation vulnerability in Linux Kernel
drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner).
low complexity
linux CWE-20
6.6
2017-11-04 CVE-2017-16537 NULL Pointer Dereference vulnerability in Linux Kernel
The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.
low complexity
linux CWE-476
6.6
2017-11-04 CVE-2017-16536 NULL Pointer Dereference vulnerability in Linux Kernel
The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.
low complexity
linux CWE-476
6.6
2017-11-04 CVE-2017-16535 Out-of-bounds Read vulnerability in Linux Kernel
The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.
low complexity
linux CWE-125
6.6
2017-11-04 CVE-2017-16534 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Linux Kernel
The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.
low complexity
linux CWE-119
6.8
2017-11-04 CVE-2017-16533 Out-of-bounds Read vulnerability in multiple products
The usbhid_parse function in drivers/hid/usbhid/hid-core.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.
low complexity
linux debian canonical CWE-125
6.6
2017-11-04 CVE-2017-16532 NULL Pointer Dereference vulnerability in multiple products
The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device.
low complexity
linux debian canonical CWE-476
6.6