Archive
January 2016
Vulnerabilities first published in this month (UTC), newest first.
669 results · Feed
-
Unscored —
Mozilla Firefox before 44.0 on Android allows remote attackers to spoof the address bar via the scrollTo method.
-
Unscored —
Buffer overflow in the BufferSubData function in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allows re…
-
Unscored —
Mozilla Firefox 43.x mishandles attempts to connect to the Application Reputation service, which makes it easier for re…
-
Unscored —
The nsZipArchive function in Mozilla Firefox before 44.0 might allow remote attackers to cause a denial of service or p…
-
Unscored —
The protocol-handler dialog in Mozilla Firefox before 44.0 allows remote attackers to conduct clickjacking attacks via …
-
Unscored —
Integer overflow in the image-deinterlacing functionality in Mozilla Firefox before 44.0 allows remote attackers to cau…
-
Unscored —
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 3…
-
Unscored —
The s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS) before 3.21, as used in Mozill…
-
Unscored —
The file-download dialog in Mozilla Firefox before 44.0 on OS X enables a certain button too quickly, which allows remo…
-
Unscored —
The MoofParser::Metadata function in binding/MoofParser.cpp in libstagefright in Mozilla Firefox before 44.0 does not l…
-
Unscored —
The Buffer11::NativeBuffer11::map function in ANGLE, as used in Mozilla Firefox before 44.0, might allow remote attacke…
-
Unscored —
Mozilla Firefox before 44.0 on Android does not ensure that HTTPS is used for a lightweight-theme installation, which a…
-
Unscored —
Mozilla Firefox before 44.0 stores cookies with names containing vertical tab characters, which allows remote attackers…
-
Unscored —
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 allow remote attackers to cau…
-
Unscored —
Mozilla Firefox before 44.0 on Android allows remote attackers to spoof the address bar via a data: URL that is mishand…
-
Unscored —
Mozilla Firefox before 44.0 allows user-assisted remote attackers to spoof a trailing substring in the address bar by l…
-
Unscored —
CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request.
-
Unscored —
HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted seria…
-
Unscored —
Cross-site scripting (XSS) vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote authenticated users to i…
-
Unscored —
KDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via unspecified vectors.
-
Unscored —
Cross-site request forgery (CSRF) vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to hija…
-
Unscored —
Directory traversal vulnerability in WebManager in NEC EXPRESSCLUSTER X through 3.3 11.31 on Windows and through 3.3 3.…
-
Unscored —
Cross-site scripting (XSS) vulnerability in main.rb in Vine MV before 2015-11-08 allows remote attackers to inject arbi…
-
Unscored —
KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified …
-
Unscored —
CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP h…
-
Unscored —
Cross-site scripting (XSS) vulnerability in JOB-CUBE -JOB WEB SYSTEM before 1.2.2 and -JOB WEB SYSTEM High Income 1.0.6…
-
Unscored —
Open redirect vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to redirect users to arbitr…
-
Unscored —
Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it eas…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Cisco Unity Connection 10.5(2.3009) allows remote attackers to inject arbit…
-
Unscored —
The web GUI on Cisco Small Business 500 devices 1.2.0.92 allows remote attackers to cause a denial of service via a cra…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the login form in the integrated web server on Siemens OZW OZW672 devices b…
-
High 8.3
High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operation…
-
Unscored —
Stack-based buffer overflow in McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows attacker…
-
Unscored —
McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows local users to obtain sensitive informa…
-
High 7.5
OpenStack Object Storage (Swift) allows remote attackers to cause a denial of service
OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.
-
Unscored —
The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy c…
-
Unscored —
The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields wh…
-
Unscored —
cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a differ…
-
High 7.5
OpenStack Object Storage (Swift) allows remote attackers to cause a denial of service
OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted …
-
Unscored —
Intel Driver Update Utility before 2.4 retrieves driver updates in cleartext, which makes it easier for man-in-the-midd…