Archive
13 January 2017
Vulnerabilities first published on this day (UTC), newest first.
41 results · Feed
-
High 8.8
Shell command injection in Liferay Portal
Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.
-
Unscored —CVE-2016-7426 EPSS 12%
NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations i…
-
Unscored —
NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecifie…
-
Unscored —
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a cra…
-
Unscored —
The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a den…
-
Unscored —
NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows rem…
-
Unscored —
NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp …
-
Unscored —
ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via the…
-
Unscored —
The pstm_exptmod function in MatrixSSL 3.8.6 and earlier does not properly perform modular exponentiation, which might …
-
Unscored —
The pstm_reverse function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid memor…
-
Unscored —
The pstm_exptmod function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid free …
-
Unscored —
Off-by-one vulnerability in the fgetwln function in libbsd before 0.8.2 allows attackers to have unspecified impact via…
-
Unscored —
The jpc_dec_tilefini function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a de…
-
Unscored —CVE-2016-8467 Public exploit
An elevation of privilege vulnerability in the bootloader could enable a local attacker to execute arbitrary modem comm…
-
Unscored —
The pstm_exptmod function in MatrixSSL 3.8.6 and earlier does not properly perform modular exponentiation, which might …
-
Unscored —
The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of serv…
-
Unscored —CVE-2016-9310 EPSS 11%
The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via…
-
Unscored —
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write a…
-
Unscored —
The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc…
-
Unscored —
Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have uns…
-
Unscored —CVE-2016-9312 EPSS 32%
ntpd in NTP before 4.2.8p9, when running on Windows, allows remote attackers to cause a denial of service via a large U…
-
Unscored —
The gst_mpegts_section_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a…
-
Unscored —CVE-2016-9813 Public exploit
The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of se…
-
Unscored —CVE-2016-9311 EPSS 11%
ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NUL…
-
Unscored —
The flx_decode_chunks function in gst/flx/gstflxdec.c in GStreamer before 1.10.2 allows remote attackers to cause a den…
-
Unscored —
The OTR plugin for Gajim sends information in cleartext when using XHTML, which allows remote attackers to obtain sensi…
-
Unscored —
The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows…
-
Unscored —
An information disclosure vulnerability in Audioserver could enable a local malicious application to access data outsid…
-
Critical 9.8CVE-2015-3188 EPSS 14%
Apache Storm remote code execution vulnerability
The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.
-
Unscored —
A spoofing vulnerability in the Core of BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to…
-
Unscored —
An information disclosure vulnerability in the Core and Management Console in BlackBerry Enterprise Server (BES) 12 thr…
-
Unscored —
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior t…
-
Unscored —
An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The two package names involved in the exfilt…
-
Unscored —
An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sy…
-
Unscored —
An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sy…
-
Unscored —CVE-2016-10140 Public exploit
Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled w…
-
Unscored —
An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. The com.adups.fota.sysop…
-
Unscored —
An issue was discovered on LG devices using the MTK chipset with L(5.0/5.1), M(6.0/6.0.1), and N(7.0) software, and RCA…
-
Unscored —
An integer overflow vulnerability was observed in the regemit function in regexp.c in Artifex Software, Inc. MuJS befor…
-
Unscored —
A reflected cross-site scripting vulnerability in the BlackBerry WatchDox Server components Appliance-X, version 1.8.1 …