Archive
23 January 2017
Vulnerabilities first published on this day (UTC), newest first.
97 results · Feed
-
Unscored —
The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in tif_read.c in libtiff before 4.0.7 allows remote attackers to c…
-
Unscored —
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows re…
-
Unscored —
Directory traversal vulnerability in Liferay 5.1.0 allows remote attackers to have unspecified impact via a %2E%2E (enc…
-
Unscored —
CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbit…
-
Critical 9.1
Doorkeeper is vulnerable to replay attacks
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
-
Unscored —
The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 befo…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0…
-
Unscored —
ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-depende…
-
Unscored —
Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3 allows remote attack…
-
Unscored —
tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service (segmentation fault) via a la…
-
Unscored —
ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users …
-
Unscored —
Buffer overflow in the collector.exe listener of the Landesk Management Suite 10.0.0.271 and earlier allows remote atta…
-
Unscored —
Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attac…
-
Unscored —CVE-2016-2783 Public exploit
Avaya Fabric Connect Virtual Services Platform (VSP) Operating System Software (VOSS) before 4.2.3.0 and 5.x before 5.0…
-
Unscored —
Exponent CMS 2.x before 2.3.7 Patch 3 allows remote attackers to execute arbitrary code via the sc parameter to install…
-
Unscored —
Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perfo…
-
Unscored —
Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to g…
-
Unscored —
The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrato…
-
Unscored —
The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow …
-
Unscored —
The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bou…
-
Unscored —
Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data …
-
Unscored —
Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently o…
-
Medium 6.2
popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.
-
Unscored —
Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via …
-
Unscored —
The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest O…
-
Unscored —
The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensit…
-
Unscored —
CloudVision Portal (CVP) before 2016.1.2.1 allows remote authenticated users to gain access to the internal configurati…
-
Unscored —
The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest …
-
Unscored —
ownCloud server before 8.2.6 and 9.x before 9.0.3, when the gallery app is enabled, allows remote attackers to download…
-
Unscored —CVE-2016-5237 Public exploit
Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to …
-
Unscored —
The automatic update feature in KeePass 2.33 and earlier allows man-in-the-middle attackers to execute arbitrary code b…
-
High 8.1
Extbase for TYPO3 allows RCE
Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.
-
Unscored —
SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before…
-
High 7.5
Ruby-saml allows attackers to perform XML signature wrapping attacks
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
-
Unscored —
Multiple untrusted search path vulnerabilities in Microsoft Skype allow local users to execute arbitrary code and condu…
-
Unscored —
Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arb…
-
Unscored —
The function msp (aka MSPRuntimeInterface) in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obt…
-
Unscored —
Odata Server in SAP Adaptive Server Enterprise (ASE) 16 allows remote attackers to cause a denial of service (process c…
-
Unscored —
An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the templat…
-
Unscored —
An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the message…