Archive
16 February 2017
Vulnerabilities first published on this day (UTC), newest first.
28 results · Feed
-
Unscored —
IBM Resilient v26.0, v26.1, and v26.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed a…
-
Unscored —
IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 uses weaker than expected cryptographic algorithms that cou…
-
Unscored —
The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cau…
-
Unscored —
Cross-site scripting (XSS) vulnerability in WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 and ear…
-
Unscored —CVE-2016-4311 Public exploit
Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote a…
-
Unscored —CVE-2016-4312 Public exploit
XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATC…
-
Medium 4.9
WSO2 Carbon directory traversal vulnerability
Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to downloadgz-ajaxprocessor.jsp.
-
Unscored —CVE-2016-4315 Public exploit
Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authenticati…
-
Medium 6.1CVE-2016-4316 Public exploit
WSO2 Carbon vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType or (3) httpPort parameter to webapp-lis…
-
Critical 9.8CVE-2016-4861 Public exploit
Zend Framework Allows SQL Injection
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.
-
Critical 9.8
Zend Framework Allows SQL Injection
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression.
-
Unscored —CVE-2016-8652 EPSS 48%
The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denia…
-
Unscored —
Heap-based buffer overflow in the IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.8 allows rem…
-
Unscored —
Heap-based buffer overflow in the parseSWF_DEFINEFONT function in parser.c in the listswf tool in libming 0.4.7 allows …
-
Medium 6.3
Incorrect signature verification in SimpleSAMLphp
The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values t…
-
Unscored —
The _iprintf function in outputtxt.c in the listswf tool in libming 0.4.7 allows remote attackers to cause a denial of …
-
Unscored —
The dumpBuffer function in read.c in the listswf tool in libming 0.4.7 allows remote attackers to cause a denial of ser…
-
Unscored —
Heap-based buffer overflow in the parseSWF_RGBA function in parser.c in the listswf tool in libming 0.4.7 allows remote…
-
Unscored —
The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow …
-
Unscored —
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19,…
-
Critical 9.1
SimpleSAMLphp SAML2 spoof SAML responses
The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of servic…
-
Unscored —
SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary S…
-
Unscored —
Memory leak in the __res_vinit function in the IPv6 name server management code in libresolv in GNU C Library (aka glib…
-
Unscored —
regex.c in GNU ed before 1.14.1 allows attackers to cause a denial of service (crash) via a malformed command, which tr…
-
Unscored —
The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP…
-
Unscored —
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extr…
-
Unscored —
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "decode_ne_resource_id" function in t…
-
Unscored —
An issue was discovered in icoutils 0.31.1. An out-of-bounds read leading to a buffer overflow was observed in the "sim…