Archive
February 2017
Vulnerabilities first published in this month (UTC), newest first.
95 results · Clear filters · Feed
-
Unscored —CVE-2017-2364 Public exploit
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. The…
-
Unscored —CVE-2017-2371 Public exploit
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WebKit" compo…
-
Unscored —
An issue was discovered in certain Apple products. macOS before 10.12.3 is affected. The issue involves the "Help Viewe…
-
Unscored —CVE-2017-2365 Public exploit
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvO…
-
Unscored —CVE-2017-6074 Public exploit
The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST …
-
Unscored —CVE-2017-5007 Public exploit
Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly hand…
-
Unscored —CVE-2017-5344 Public exploit
An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter() function which is called by the web accessi…
-
Unscored —CVE-2016-4311 Public exploit
Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote a…
-
Unscored —CVE-2016-4312 Public exploit
XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATC…
-
Medium 4.9
WSO2 Carbon directory traversal vulnerability
Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to downloadgz-ajaxprocessor.jsp.
-
Unscored —CVE-2016-4315 Public exploit
Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authenticati…
-
Medium 6.1CVE-2016-4316 Public exploit
WSO2 Carbon vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType or (3) httpPort parameter to webapp-lis…
-
Critical 9.8CVE-2016-4861 Public exploit
Zend Framework Allows SQL Injection
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.
-
Unscored —
SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary S…
-
Unscored —CVE-2017-0313 Public exploit
All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) imple…
-
Unscored —CVE-2017-0312 Public exploit
All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handl…
-
Unscored —CVE-2016-6079 Public exploit
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to o…
-
Unscored —CVE-2016-3694 Public exploit
Multiple SQL injection vulnerabilities in modified eCommerce Shopsoftware 2.0.0.0 revision 9678, when the easybill-modu…
-
Unscored —CVE-2016-8972 Public exploit
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the…
-
Unscored —
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in the ActionScript…
-
Unscored —
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability when performing …
-
Unscored —
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability when parsing an MP4 …
-
Unscored —
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the Flash Video (…
-
Unscored —
An issue was discovered in Artifex MuPDF before 1912de5f08e90af1d9d0a9791f58ba3afdb9d465. The pdf_run_xobject function …
-
Unscored —
The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a f…
-
Unscored —CVE-2016-9355 Public exploit
An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prio…
-
Unscored —CVE-2016-8367 Public exploit
An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GT…
-
Unscored —CVE-2016-8377 Public exploit
An issue was discovered in Fatek Automation PLC WinProladder Version 3.11 Build 14701. A stack-based buffer overflow vu…
-
Unscored —CVE-2016-9332 Public exploit
An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. Moxa SoftCMS Webserver does not properly validat…
-
Critical 9.8
An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5…
-
Unscored —CVE-2016-9349 Public exploit
An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. An attacker could traverse the file syste…
-
Unscored —CVE-2016-9351 Public exploit
An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The directory traversal/file upload error…
-
Unscored —CVE-2016-5809 Public exploit
An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX serie…
-
Unscored —CVE-2017-5146 Public exploit
An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Ver…
-
Unscored —
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Lack of authentication for re…
-
Medium 5.9
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static…
-
Critical 9.8
Code Execution through IIFE in node-serialize
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression …
-
Unscored —CVE-2017-5180 Public exploit
Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt…
-
Unscored —CVE-2017-3813 Public exploit
A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows …
-
Unscored —
A vulnerability in Common Internet Filesystem (CIFS) code in the Clientless SSL VPN functionality of Cisco ASA Software…