9 February 2017

52 results · Feed

• Unscored —
  CVE-2017-5590

  An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…

  Feb 9, 2017
• Unscored —
  CVE-2017-5602

  An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…

  Feb 9, 2017
• Medium 5.9
  CVE-2017-5591

  SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons

  An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. Thi…

  slixmpp slixmpp sleekxmpp sleekxmpp Debian Ubuntu PyPI
  Feb 9, 2017
• Medium 5.9
  CVE-2017-5605

  XMPP Clients User Impersonation Vulnerability in Movim Moxl

  An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. Thi…

  movim/moxl Packagist
  Feb 9, 2017
• Unscored —
  CVE-2017-5604

  An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…

  mcabber Debian
  Feb 9, 2017
• Unscored —
  CVE-2017-5589

  An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…

  Feb 9, 2017
• Unscored —
  CVE-2017-5593

  An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…

  Feb 9, 2017
• Unscored —
  CVE-2017-5603

  An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…

  Feb 9, 2017
• Unscored —
  CVE-2017-5606

  An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…

  Feb 9, 2017
• Unscored —
  CVE-2017-5592

  An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…

  profanity profanity Debian Ubuntu
  Feb 9, 2017
• Medium 5.9
  CVE-2017-5858

  User Impersonation in converse.js

  An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. Thi…

  converse.js npm
  Feb 9, 2017
• Critical 9.8
  CVE-2017-5941 Public exploit EPSS 61%

  Code Execution through IIFE in node-serialize

  An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression …

  node-serialize npm
  Feb 9, 2017
• Unscored —
  CVE-2017-5180 Public exploit

  Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt…

  firejail firejail Debian Ubuntu
  Feb 9, 2017
• Unscored —
  CVE-2017-5940

  Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during it…

  firejail Debian
  Feb 9, 2017
• Unscored —
  CVE-2017-3813 Public exploit

  A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows …

  Windows
  Feb 9, 2017
• Unscored —
  CVE-2017-3807 Public exploit EPSS 15%

  A vulnerability in Common Internet Filesystem (CIFS) code in the Clientless SSL VPN functionality of Cisco ASA Software…

  Feb 9, 2017
• Unscored —
  CVE-2017-5634

  The Norwegian Air Shuttle (aka norwegian.com) airline kiosk allows physically proximate attackers to bypass the intende…

  Feb 9, 2017
• Unscored —
  CVE-2015-6023 Public exploit EPSS 11%

  ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remo…

  Feb 9, 2017
• Unscored —
  CVE-2015-6024 Public exploit EPSS 26%

  ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remo…

  Feb 9, 2017
• Unscored —
  CVE-2015-8936

  Cross-site scripting (XSS) vulnerability in squidGuard.cgi in squidGuard before 1.5 allows remote attackers to inject a…

  squidguard Debian
  Feb 9, 2017
• Unscored —
  CVE-2015-8831

  Cross-site scripting (XSS) vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inje…

  dotclear Ubuntu
  Feb 9, 2017
• Unscored —
  CVE-2015-8832

  Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authe…

  dotclear Ubuntu
  Feb 9, 2017
• Medium 6.5
  CVE-2016-4987

  Jenkins Image Gallery Plugin allows Path Traversal

  Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories and read arbitrary files via unspecified form fields.

  com.tupilabs.image_gallery:image-gallery Maven
  Feb 9, 2017
• High 7.5
  CVE-2016-4986

  Jenkins TAP Plugin allows Path Traversal

  Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecified parameter.

  org.tap4j:tap Maven
  Feb 9, 2017
• Medium 6.1
  CVE-2016-4988

  Cross-site Scripting in Jenkins Build Failure Analyzer plugin

  Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.

  com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer Maven
  Feb 9, 2017
• Unscored —
  CVE-2016-6171

  Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service (memory exhaustion and slave server crash)…

  knot knot Debian Ubuntu
  Feb 9, 2017
• Unscored —
  CVE-2016-6173

  NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server…

  nsd nsd Debian Ubuntu
  Feb 9, 2017
• Medium 5.4
  CVE-2016-3101

  Jenkins Extra Columns Plugin allows Cross-Site Scripting (XSS)

  Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web script or HTML by leveraging failure to filter tool tips through the configured markup formatter.

  org.jenkins-ci.plugins:extra-columns Maven
  Feb 9, 2017
• High 7.3
  CVE-2016-3102

  Jenkins Script Security Plugin allows for Bypass of Groovy Sandbox Protection

  The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1) direct field access or (2) get/set array operations.

  org.jenkins-ci.plugins:script-security Maven
  Feb 9, 2017
• Unscored —
  CVE-2016-2147

  Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of serv…

  busybox busybox busybox Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2016-2148 EPSS 27%

  Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspeci…

  busybox busybox busybox Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2016-8494

  Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary …

  Fortinet Fortinet Connect Network devices
  Feb 9, 2017
• Unscored —
  CVE-2016-9244 Public exploit EPSS 74%

  A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled ma…

  F5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, PEM, PSM Network devices
  Feb 9, 2017
• Unscored —
  CVE-2016-10199

  The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows rem…

  gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good gst-plugins-good0.10 Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2016-10191 Public exploit

  Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, an…

  ffmpeg ffmpeg libav ffmpeg Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2016-10190 Public exploit

  Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3…

  ffmpeg ffmpeg libav ffmpeg Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2016-10198

  The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.…

  gst-plugins-good1.0 gst-plugins-good1.0 gst-plugins-good gst-plugins-good0.10 Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2016-10192

  Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x bef…

  ffmpeg ffmpeg libav ffmpeg Debian Ubuntu Alpine
  Feb 9, 2017
• Unscored —
  CVE-2016-5727

  LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and exe…

  Feb 9, 2017
• Unscored —
  CVE-2016-5726

  Packages.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and exe…

  Feb 9, 2017