Archive
7 February 2017
Vulnerabilities first published on this day (UTC), newest first.
34 results · Feed
-
Unscored —
Integer overflow in the _authenticate function in svc_auth.c in Wind River VxWorks 5.5 through 6.9.4.1, when the Remote…
-
Unscored —
NetApp SnapDrive for Windows before 7.0.2P4, 7.0.3, and 7.1 before 7.1.3P1 allows remote attackers to obtain sensitive …
-
Unscored —
NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbitrary code via unsp…
-
Unscored —
NetApp OnCommand Workflow Automation before 3.1P2 allows remote attackers to bypass authentication via unspecified vect…
-
Unscored —
NetApp SnapCenter Server 1.0 and 1.0P1 allows remote attackers to partially bypass authentication and then list and del…
-
Unscored —
NetApp Clustered Data ONTAP before 8.3.2P7 allows remote attackers to obtain SMB share information via unspecified vect…
-
Unscored —
NetApp Data ONTAP before 8.2.4P5, when operating in 7-Mode, allows remote attackers to obtain information about the vol…
-
Unscored —
NetApp OnCommand Unified Manager for Clustered Data ONTAP 6.3 through 6.4P1 contain a default privileged account, which…
-
Unscored —
Tor Browser Launcher (aka torbrowser-launcher) before 0.2.4, during the initial run, allows man-in-the-middle attackers…
-
Unscored —
Multiple functions in NetApp OnCommand System Manager before 8.3.2 do not properly escape special characters, which all…
-
Medium 5.3
SimpleSAMLphp Information leakage issue in the sanitycheck module
The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.
-
Critical 9.8
Symfony Authentication Bypass
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
-
Critical 9.1
Salt allows deleted minions to read or write to minions with the same id
Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.
-
Unscored —
NetApp Virtual Storage Console for VMware vSphere before 6.2.1 uses a non-unique certificate, which allows remote attac…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in NetApp Snap Creator Framework before 4.3.0P1 allows remote attackers…
-
Unscored —
IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the im…
-
Unscored —
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting. This vulnerability allows u…
-
Unscored —
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 allows web pages to be stored locally which can be read by another…
-
Unscored —
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 generates an error message that includes sensitive information abo…
-
Unscored —
IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read b…
-
Unscored —
IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 could allow a remote attacker to bypass security restrictio…
-
Unscored —
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-o…
-
Unscored —
bsnmpd, as used in FreeBSD 9.3, 10.1, and 10.2, uses world-readable permissions on the snmpd.config file, which allows …
-
Unscored —
The construct function in puff.cpp in Libtorrent 1.1.0 allows remote torrent trackers to cause a denial of service (seg…
-
Unscored —CVE-2016-7400 Public exploit
Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL com…
-
Unscored —
dhcpcd before 6.10.0 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related …
-
Unscored —
The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and…
-
Unscored —
Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code vi…
-
Unscored —
ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized obje…
-
Unscored —
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes…
-
Medium 4.6
chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TI…
-
Unscored —CVE-2016-2539 Public exploit
Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers t…
-
Unscored —
Race condition in the ip4_datagram_release_cb function in net/ipv4/datagram.c in the Linux kernel before 3.15.2 allows …
-
Unscored —
The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which ma…