Archive
April 2016
Vulnerabilities first published in this month (UTC), newest first.
653 results · Feed
-
Unscored —
tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allow…
-
Unscored —
tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and…
-
Unscored —
Buffer overflow in tibemsd in the server in TIBCO Enterprise Message Service (EMS) before 8.3.0 and EMS Appliance befor…
-
Unscored —
Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it …
-
Medium 6.2
Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop
Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive inform…
-
Unscored —
The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause…
-
Unscored —
Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows contex…
-
Unscored —
Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a de…
-
Unscored —
Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to…
-
Unscored —
Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent att…
-
Unscored —
slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote atta…
-
Unscored —CVE-2016-2390 EPSS 26%
The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly han…
-
Unscored —
The ff_h263_decode_mba function in libavcodec/ituh263dec.c in Libav before 11.5 allows remote attackers to cause a deni…
-
Unscored —
SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbit…
-
Unscored —
Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host…
-
Unscored —
Buffer overflow in the readextension function in gif2tiff.c in LibTIFF 4.0.6 allows remote attackers to cause a denial …
-
Unscored —
SQL injection vulnerability in dotCMS before 3.5 allows remote administrators to execute arbitrary SQL commands via the…
-
Unscored —CVE-2015-7378 Public exploit
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and instal…
-
Unscored —
Cross-site scripting (XSS) vulnerability in lucene_search.jsp in dotCMS before 3.5.1 allows remote attackers to inject …
-
Unscored —CVE-2016-3943 Public exploit
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a…
-
Unscored —
Buffer overflow in the AStreamPeekStream function in input/stream.c in VideoLAN VLC media player before 2.2.0 allows re…
-
Unscored —
Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administr…
-
Unscored —
Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote att…
-
Unscored —
Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers …
-
Unscored —
The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for …
-
Unscored —
Huawei AR3200 routers with software before V200R006C10SPC300 allow remote authenticated users to cause a denial of serv…
-
Unscored —
Libreswan 3.16 might allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transfo…
-
Unscored —
Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during callback execution, wh…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/module_…
-
Unscored —
The LoadBuffer implementation in Google V8, as used in Google Chrome before 50.0.2661.75, mishandles data types, which …
-
Unscored —
The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended …
-
Unscored —
fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome before 50.0.2661.75, does not properly implement…
-
Unscored —
Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attackers to cause a denial of service …
-
Unscored —
The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin c…
-
Unscored —
The media subsystem in Google Chrome before 50.0.2661.75 does not initialize an unspecified data structure, which allow…
-
Unscored —
The WebContentsImpl::FocusLocationBarByDefault function in content/browser/web_contents/web_contents_impl.cc in Google …
-
Unscored —
Stack-based buffer overflow in decoder/impeg2d_vld.c in mediaserver in Android 6.x before 2016-04-01 allows remote atta…
-
Unscored —
Multiple integer overflows in minzip/SysUtil.c in the Recovery Procedure in Android 5.0.x before 5.0.2, 5.1.x before 5.…
-
Unscored —
post_proc/volume_listener.c in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, which al…
-
Unscored —
media/libmedia/mediametadataretriever.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before …