Archive
January 2017
Vulnerabilities first published in this month (UTC), newest first.
1,083 results · Feed
-
Unscored —
The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow …
-
Unscored —
The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bou…
-
Unscored —
Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data …
-
Unscored —
Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently o…
-
Medium 6.2
popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.
-
Unscored —
Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via …
-
Unscored —
The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest O…
-
Unscored —
The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensit…
-
Unscored —
CloudVision Portal (CVP) before 2016.1.2.1 allows remote authenticated users to gain access to the internal configurati…
-
Unscored —
The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest …
-
Unscored —
ownCloud server before 8.2.6 and 9.x before 9.0.3, when the gallery app is enabled, allows remote attackers to download…
-
Unscored —CVE-2016-5237 Public exploit
Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to …
-
Unscored —
The automatic update feature in KeePass 2.33 and earlier allows man-in-the-middle attackers to execute arbitrary code b…
-
High 8.1
Extbase for TYPO3 allows RCE
Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.
-
Unscored —
SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before…
-
High 7.5
Ruby-saml allows attackers to perform XML signature wrapping attacks
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
-
Unscored —
Multiple untrusted search path vulnerabilities in Microsoft Skype allow local users to execute arbitrary code and condu…
-
Unscored —
Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arb…
-
Unscored —
The function msp (aka MSPRuntimeInterface) in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obt…
-
Unscored —
Odata Server in SAP Adaptive Server Enterprise (ASE) 16 allows remote attackers to cause a denial of service (process c…
-
Unscored —
An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the templat…
-
Unscored —
An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the message…
-
Unscored —
Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via …
-
Unscored —
EMC Documentum WebTop Version 6.8, prior to P18 and Version 6.8.1, prior to P06; and EMC Documentum TaskSpace version 6…
-
Unscored —
EMC Isilon OneFS 8.0.0.0, EMC Isilon OneFS 7.2.1.0 - 7.2.1.2, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.…
-
Unscored —CVE-2016-10156 Public exploit
A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd ti…
-
Unscored —
Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete …
-
Unscored —
Information Disclosure can occur in encryptionProfiles.jsd in Hitek Software's Automize because of the Read attribute b…
-
Unscored —
Information Disclosure can occur in Hitek Software's Automize 10.x and 11.x passManager.jsd. Users have the Read attrib…
-
Unscored —
Information Disclosure can occur in sshProfiles.jsd in Hitek Software's Automize because of the Read attribute being se…
-
Unscored —
hitek.jar in Hitek Software's Automize uses weak encryption when encrypting SSH/SFTP and Encryption profile passwords. …
-
Unscored —
Cross-site scripting (XSS) vulnerability in plugins/markdown_plugin/_markdown.plugin.php in b2evolution before 6.8.5 al…
-
Unscored —
An issue was discovered on FiberHome Fengine S5800 switches V210R240. An unauthorized attacker can access the device's …
-
Unscored —
SQL injection vulnerability in inc/lib/Options.class.php in GeniXCMS before 1.0.0 allows remote attackers to execute ar…
-
Unscored —
The ConvertToPDF plugin in Foxit Reader before 8.2 and PhantomPDF before 8.2 on Windows, when the gflags app is enabled…
-
Unscored —
SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows unauthenticated users to execute arbitrary …
-
Unscored —
An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the…
-
Unscored —
LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution vi…
-
Unscored —
The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An at…
-
Unscored —
The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive informa…