Archive
January 2017
Vulnerabilities first published in this month (UTC), newest first.
1,083 results · Feed
-
Unscored —
The Parental Control panel in Genexis devices with DRGOS before 1.14.1 allows remote authenticated users to execute arb…
-
Unscored —
The x509FreeExtensions function in MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (free of…
-
Unscored —
Heap-based buffer overflow in MatrixSSL before 3.8.6 allows remote attackers to execute arbitrary code via a crafted Su…
-
Unscored —
MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ASN.1 Bi…
-
Unscored —
Authentication bypass vulnerability in Enterprise Security Manager (ESM) and License Manager (LM) in Intel Security McA…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9.3 allows remote authenticated users to inject arb…
-
Unscored —
The ring_buffer_resize function in kernel/trace/ring_buffer.c in the profiling subsystem in the Linux kernel before 4.6…
-
Unscored —
The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 …
-
Unscored —
Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPres…
-
High 7.8
The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensur…
-
Medium 6.2
authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which mi…
-
High 7.3
Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execut…
-
High 7.0CVE-2016-10010 Public exploit
sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which…
-
Unscored —
scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3…
-
Unscored —
Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear before 2.10.3 allows remote authentic…
-
Unscored —
Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to …
-
Unscored —
Arista EOS 4.15 before 4.15.8M, 4.16 before 4.16.7M, and 4.17 before 4.17.0F on DCS-7050 series devices allow remote at…
-
Unscored —
The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, …
-
Unscored —
Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Component…
-
Unscored —
The SwarmKit toolkit 1.12.0 for Docker allows remote authenticated users to cause a denial of service (prevention of cl…
-
Unscored —
Integer signedness error in the dynamicGetbuf function in gd_io_dp.c in the GD Graphics Library (aka libgd) through 2.2…
-
Unscored —
Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf_t data…
-
Unscored —
Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) befo…
-
Unscored —
ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL p…
-
Unscored —
The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial…
-
Unscored —
The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attacker…
-
Unscored —
PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during __wakeup processing, which allows rem…
-
Unscored —
Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 and 7.x before…
-
Unscored —
NETGEAR Arlo base stations with firmware 1.7.5_6178 and earlier, Arlo Q devices with firmware 1.8.0_5551 and earlier, a…
-
Unscored —
NETGEAR Arlo base stations with firmware 1.7.5_6178 and earlier, Arlo Q devices with firmware 1.8.0_5551 and earlier, a…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticat…
-
Unscored —
SQL injection vulnerability in the "aWeb Cart Watching System for Virtuemart" extension before 2.6.1 for Joomla! allows…
-
Unscored —
Virtual servers in F5 BIG-IP systems 11.6.1 before 11.6.1 HF1 and 12.1.x before 12.1.2, when configured to parse RADIUS…
-
Unscored —CVE-2016-10107 EPSS 11%
Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 index.php page via …
-
Unscored —
admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This c…
-
Unscored —
Directory traversal vulnerability in scgi-bin/platform.cgi on NETGEAR FVS336Gv3, FVS318N, FVS318Gv2, and SRX5308 device…
-
Unscored —
Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analyti…
-
Unscored —CVE-2017-5005 Public exploit
Stack-based buffer overflow in Quick Heal Internet Security 10.1.0.316 and earlier, Total Security 10.1.0.316 and earli…
-
Unscored —
Borg (aka BorgBackup) before 1.0.9 has a flaw in the way duplicate archive names were processed during manifest recover…