Skip to content
OpenAdvisories

Archive

January 2017

Vulnerabilities first published in this month (UTC), newest first.

← December 2016 2017 / January February 2017 →
  1. 11
  2. 24
  3. 35
  4. 419
  5. 514
  6. 653
  7. 7 
  8. 8 
  9. 95
  10. 1016
  11. 1152
  12. 12159
  13. 1341
  14. 1410
  15. 1510
  16. 162
  17. 177
  18. 1861
  19. 1939
  20. 2025
  21. 211
  22. 22 
  23. 2397
  24. 2410
  25. 2510
  26. 2631
  27. 27261
  28. 2845
  29. 29 
  30. 3057
  31. 3148
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Critical 9.8
    CVE-2016-10174 Exploited Public exploit EPSS 83%

    The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.c…

    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2016-9052

    An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Ser…

  • Critical 9.8
    CVE-2016-9054

    An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Ser…

    Aerospike Database Server
  • Critical 9.8
    CVE-2015-8857

    Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js

    The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly r…

    uglifyjs uglifyjs uglify-js uglifier Debian Ubuntu npm RubyGems
  • Critical 9.8
    CVE-2016-7036

    python-jose failure to use a constant time comparison for HMAC keys

    python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.

    python-jose PyPI
  • Critical 9.1
    CVE-2016-6582

    Doorkeeper is vulnerable to replay attacks

    The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.

    doorkeeper ruby-doorkeeper ruby-doorkeeper Debian Ubuntu RubyGems
  • Critical 9.8
    CVE-2017-5543

    Subrion CMS PHP Object Injection

    includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.

    intelliants/subrion Packagist
  • Critical 9.8
    CVE-2015-3188 EPSS 14%

    Apache Storm remote code execution vulnerability

    The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.

    org.apache.storm:storm Maven
  • Critical 9.8
    CVE-2016-9299 Public exploit EPSS 97%

    Improper Neutralization of Special Elements used in an LDAP Query in Jenkins

    The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.

    org.jenkins-ci.main:jenkins-core Maven
  • Critical 9.8
    CVE-2016-10131

    CodeIgniter arbitrary code execution

    system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insert sendmail command-line arguments.

    bcit-ci/codeigniter Packagist
  • Critical 9.8
    CVE-2016-8704 EPSS 23%

    An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multip…

    memcached memcached memcached memcached Debian Ubuntu Alpine
  • Critical 9.8
    CVE-2016-8705 EPSS 20%

    Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple co…

    memcached memcached memcached memcached Debian Ubuntu Alpine