Archive
January 2017
Vulnerabilities first published in this month (UTC), newest first.
1,083 results · Feed
-
Unscored —
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript…
-
Unscored —
Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitab…
-
Unscored —
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurr…
-
Unscored —
Adobe Flash Player versions 24.0.0.186 and earlier have a security bypass vulnerability related to handling TCP connect…
-
Unscored —
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to setti…
-
Unscored —
Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitab…
-
Unscored —CVE-2017-0002 EPSS 17%
Microsoft Edge allows remote attackers to bypass the Same Origin Policy via vectors involving the about:blank URL and d…
-
Unscored —CVE-2017-0004 EPSS 89%
The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 S…
-
Unscored —CVE-2017-0003 EPSS 25%
Microsoft Word 2016 and SharePoint Enterprise Server 2016 allow remote attackers to execute arbitrary code via a crafte…
-
Unscored —
Under certain conditions for BIG-IP systems using a virtual server with an associated FastL4 profile and TCP analytics …
-
Unscored —CVE-2015-4592 Public exploit
eClinicalWorks Population Health (CCMR) suffers from an SQL injection vulnerability in portalUserService.jsp which allo…
-
Unscored —CVE-2015-4593 Public exploit
eClinicalWorks Population Health (CCMR) suffers from a cross-site request forgery (CSRF) vulnerability in portalUserSer…
-
Unscored —CVE-2015-4591 Public exploit
eClinicalWorks Population Health (CCMR) suffers from a cross site scripting vulnerability in login.jsp which allows rem…
-
Unscored —CVE-2015-4594 Public exploit
eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the …
-
Unscored —
The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size buffers for holding the argument…
-
High 7.5
priority vulnerable to denial of service
A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer by having that peer assign priority information for every possible HTTP/2 stream ID. The priority tree would happily co…
-
Unscored —
The "http-client" egg always used a HTTP_PROXY environment variable to determine whether HTTP traffic should be routed …
-
Unscored —
The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resul…
-
Unscored —
Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versions 2.0.0-…
-
High 7.5
HPACK Denial of Service vulnerability (HPACK Bomb)
A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This attack occurs when an attacker inserts a header field th…
-
Unscored —
The "spiffy-cgi-handlers" egg would convert a nonexistent "Proxy" header to the HTTP_PROXY environment variable, which …
-
Unscored —
Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3…
-
Unscored —
A Denial of Service in Intel Ethernet Controller's X710/XL710 with Non-Volatile Memory Images before version 5.05 allow…
-
Unscored —
D-Link DGS-1100 devices with Rev.B firmware 1.01.018 have a hardcoded SSL private key, which allows man-in-the-middle a…
-
Unscored —
An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpr…
-
Unscored —
Installing a zero-permission Android application on certain Samsung Android devices with KK(4.4), L(5.0/5.1), and M(6.0…
-
Unscored —
Stack-based buffer overflow vulnerability in Netop Remote Control versions 11.53, 12.21 and prior. The affected module …
-
High 7.5
Security Constraint Bypass in Spring Security
An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a r…
-
Unscored —
An issue was discovered in Pivotal GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1. The…
-
Unscored —
An issue was discovered in EMC ScaleIO versions before 2.0.1.1. A low-privileged local attacker may be able to modify t…
-
Unscored —
An issue was discovered in EMC ScaleIO versions before 2.0.1.1. Incorrect permissions on the SCINI driver may allow a l…
-
Unscored —
An issue was discovered in EMC ScaleIO versions before 2.0.1.1. A low-privileged local attacker may cause a denial-of-s…
-
Unscored —
An integer overflow can occur in NTP-dev.4.3.70 leading to an out-of-bounds memory copy operation when processing a spe…
-
Unscored —
A design flaw in the Trane ComfortLink II SCC firmware version 2.0.2 service allows remote attackers to take complete c…
-
Unscored —
An exploitable remote code execution vulnerability exists in the Trane ComfortLink II firmware version 2.0.2 in DSS ser…
-
Unscored —
An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timest…
-
Unscored —
An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec…
-
Unscored —
An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5f…
-
Unscored —
A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection a…
-
Unscored —
When opening a Hangul Hcell Document (.cell) and processing a property record within the Workbook stream, Hancom Office…