23 January 2017

97 results · Feed

• Unscored —
  CVE-2015-7743

  XML external entity vulnerability in PRTG Network Monitor before 16.2.23.3077/3078 allows remote authenticated users to…

  Jan 23, 2017
• Unscored —
  CVE-2015-4626

  B.A.S C2Box before 4.0.0 (r19171) relies on client-side validation, which allows remote attackers to "corrupt the busin…

  Jan 23, 2017
• Unscored —
  CVE-2015-8972

  Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess (aka gnuchess) before 6.2.4 m…

  gnuchess gnuchess Debian Ubuntu
  Jan 23, 2017
• Medium 6.1
  CVE-2015-8856

  Cross-Site Scripting in serve-index

  Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via a crafted file or directory name.

  serve-index node-serve-index node-serve-index Debian Ubuntu npm
  Jan 23, 2017
• Medium 6.1
  CVE-2015-8861

  Cross-Site Scripting in handlebars

  The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.

  handlebars mustache.js Debian npm
  Jan 23, 2017
• Medium 5.3
  CVE-2015-8859

  Root Path Disclosure in send

  The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

  nodejs-nodemon send node-send node-send Debian Ubuntu Azure Linux npm
  Jan 23, 2017
• Unscored —
  CVE-2015-8971

  Terminology 0.7.0 allows remote attackers to execute arbitrary commands via escape sequences that modify the window tit…

  terminology terminology Debian Ubuntu
  Jan 23, 2017
• Medium 6.1
  CVE-2015-8862

  Cross-Site Scripting in mustache

  mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.

  mustache.js mustache Debian npm
  Jan 23, 2017
• High 7.5
  CVE-2015-8854

  Regular Expression Denial of Service in marked

  The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."

  marked node-marked node-marked Debian Ubuntu npm
  Jan 23, 2017
• Critical 9.8
  CVE-2015-8857

  Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js

  The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly r…

  uglifyjs uglifyjs uglify-js uglifier Debian Ubuntu npm RubyGems
  Jan 23, 2017
• High 7.5
  CVE-2015-8855

  Regular Expression Denial of Service in semver

  The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."

  semver node-semver node-semver Debian Ubuntu npm
  Jan 23, 2017
• High 7.5
  CVE-2015-8858

  Regular Expression Denial of Service in uglify-js

  The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."

  uglifyjs uglify-js uglifyjs Debian Ubuntu npm
  Jan 23, 2017
• High 7.5
  CVE-2015-8860

  Symlink Arbitrary File Overwrite in tar

  The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.

  tar node-tar node-tar Debian Ubuntu npm
  Jan 23, 2017
• High 7.5
  CVE-2015-8315

  Regular Expression Denial of Service in ms

  The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."

  ms npm
  Jan 23, 2017
• Medium 6.1
  CVE-2013-7454

  Multiple XSS Filter Bypasses in validator

  The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden strings.

  validator npm
  Jan 23, 2017
• Medium 6.1
  CVE-2013-7451

  Moderate severity vulnerability that affects validator

  The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag.

  validator npm
  Jan 23, 2017
• Medium 6.1
  CVE-2013-7453

  Moderate severity vulnerability that affects validator

  The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related to UI redressing.

  validator npm
  Jan 23, 2017
• Medium 6.1
  CVE-2013-7452

  Moderate severity vulnerability that affects validator

  The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted javascript URI.

  validator npm
  Jan 23, 2017
• Unscored —
  CVE-2014-8362

  Vivint Sky Control Panel 1.1.1.9926 allows remote attackers to enable and disable the alarm system and modify other sec…

  Jan 23, 2017
• Medium 6.1
  CVE-2014-9772

  XSS Filter Bypass via Encoded URL in validator

  The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded characters.

  validator npm
  Jan 23, 2017
• Unscored —
  CVE-2016-0765

  Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow …

  Jan 23, 2017
• Unscored —
  CVE-2016-0769

  Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote ad…

  Jan 23, 2017
• Unscored —
  CVE-2016-7567 Public exploit EPSS 12%

  Buffer overflow in the SLPFoldWhiteSpace function in common/slp_compare.c in OpenSLP 2.0 allows remote attackers to hav…

  openslp Azure Linux
  Jan 23, 2017
• Unscored —
  CVE-2016-7037

  The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function fo…

  Jan 23, 2017
• Unscored —
  CVE-2016-7792

  Ubiquiti Networks UniFi 5.2.7 does not restrict access to the database, which allows remote attackers to modify the dat…

  Jan 23, 2017
• Unscored —
  CVE-2016-7102

  ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan li…

  owncloud-client Ubuntu
  Jan 23, 2017
• Unscored —
  CVE-2016-7410

  The _dwarf_read_loc_section function in dwarf_loc.c in libdwarf 20160613 allows attackers to cause a denial of service …

  dwarfutils Debian
  Jan 23, 2017
• Critical 9.8
  CVE-2016-7036

  python-jose failure to use a constant time comparison for HMAC keys

  python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.

  python-jose PyPI
  Jan 23, 2017
• Unscored —
  CVE-2016-1417

  Untrusted search path vulnerability in Snort 2.9.7.0-WIN32 allows remote attackers to execute arbitrary code and conduc…

  Jan 23, 2017
• Unscored —
  CVE-2016-1281

  Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before 1.17-BETA, and possib…

  Jan 23, 2017
• Unscored —
  CVE-2016-1925

  Integer underflow in header.c in lha allows remote attackers to have unspecified impact via a large header size value f…

  Jan 23, 2017
• High 7.5
  CVE-2016-4793 Public exploit

  CakePHP allows remote attackers to spoof their IP

  The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.

  cakephp/cakephp cakephp cakephp Debian Ubuntu Packagist
  Jan 23, 2017
• Medium 6.1
  CVE-2016-4056

  TYPO3 Backend component Cross-site scripting (XSS) vulnerability

  Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark.

  typo3/cms Packagist
  Jan 23, 2017
• Unscored —
  CVE-2016-4340 Public exploit EPSS 10%

  The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through …

  gitlab Ubuntu
  Jan 23, 2017
• Medium 6.5
  CVE-2016-4055

  Regular Expression Denial of Service in moment

  The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."

  moment node-moment node-moment Debian Ubuntu npm
  Jan 23, 2017
• Unscored —
  CVE-2016-4484

  The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain…

  cryptsetup cryptsetup Debian Ubuntu
  Jan 23, 2017
• Unscored —
  CVE-2016-4338 Public exploit EPSS 25%

  The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x be…

  zabbix zabbix Debian Ubuntu
  Jan 23, 2017
• Unscored —
  CVE-2016-4010 Public exploit EPSS 93%

  Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary…

  Jan 23, 2017
• Unscored —
  CVE-2016-6600 Public exploit EPSS 91%

  Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remo…

  Jan 23, 2017
• Unscored —
  CVE-2016-6164

  Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before 3.0.3 and 3.…

  ffmpeg ffmpeg ffmpeg Debian Ubuntu Alpine
  Jan 23, 2017