Archive
November 2016
Vulnerabilities first published in this month (UTC), newest first.
386 results · Feed
-
Unscored —
libdwarf 2016-10-21 allows context-dependent attackers to obtain sensitive information or cause a denial of service by …
-
Unscored —
In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content_id input is passed into s…
-
Unscored —
There is a vulnerability of type use-after-free affecting DBD::mysql (aka DBD-mysql or the Database Interface (DBI) MyS…
-
Unscored —
A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrati…
-
Unscored —
During an internal security review, Lenovo identified a local privilege escalation vulnerability in Lenovo System Inter…
-
Unscored —CVE-2016-1247 Public exploit
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LT…
-
Unscored —
Dell iDRAC7 and iDRAC8 devices with firmware before 2.40.40.40 allow authenticated users to gain Bash shell access thro…
-
Unscored —
Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb)…
-
High 8.8
Improper Access Control in Apache Hadoop
In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.
-
Unscored —
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does n…
-
Unscored —
crypto/algif_skcipher.c in the Linux kernel before 4.4.2 does not verify that a setkey operation has been performed on …
-
Unscored —
The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the relationship bet…
-
Unscored —
The hash_accept function in crypto/algif_hash.c in the Linux kernel before 4.3.6 allows local users to cause a denial o…
-
Unscored —
The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is enabled, allows lo…
-
Unscored —
drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allows remote atta…
-
Unscored —
The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to cause a denial o…
-
Unscored —
The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated …
-
Unscored —CVE-2016-9555 EPSS 10%
The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for t…
-
Unscored —
The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extend…
-
Unscored —
The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows …
-
Unscored —
The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not initialize a ce…
-
Unscored —
drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11 misuses the kzalloc function, which allows local u…
-
Unscored —
drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local users to bypass integer overflow checks, an…
-
Unscored —
security/keys/big_key.c in the Linux kernel before 4.8.7 mishandles unsuccessful crypto registration in conjunction wit…
-
Unscored —
Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote attackers t…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 be…
-
Unscored —
The XML parser in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows …
-
Unscored —
Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 does not destroy a Sessio…
-
Unscored —
IBM BigFix Remote Control before 9.1.3 does not properly restrict the set of available encryption algorithms, which mak…
-
Unscored —
IBM BigFix Remote Control before 9.1.3 allows remote authenticated users to obtain sensitive information by reading err…
-
Unscored —
Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11, 5.…
-
Unscored —
IBM BigFix Remote Control before 9.1.3 does not properly restrict password choices, which makes it easier for remote at…
-
High 7.5
Drupal Incorrect cache context on password reset page
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.
-
Medium 6.8
Drupal Open Redirect
Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.
-
Medium 6.5
Drupal Denial of service via transliterate mechanism
The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL.
-
Medium 4.3
Drupal sensitive information disclosure
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
-
Unscored —
A denial of service vulnerability in Mediaserver in Android before 2016-11-05 could enable an attacker to use a special…
-
Unscored —
An elevation of privilege vulnerability in the NVIDIA GPU driver in Android before 2016-11-05 could enable a local mali…
-
Unscored —
An elevation of privilege vulnerability in Mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 20…
-
Unscored —
A remote code execution vulnerability in libskia in Android 7.0 before 2016-11-01 could enable an attacker using a spec…