Archive
February 2017
Vulnerabilities first published in this month (UTC), newest first.
1,041 results · Feed
-
Unscored —
The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate …
-
Unscored —
The timing attack protection in Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock in Crypto++ (ak…
-
Unscored —
The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and applica…
-
Unscored —
pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl c…
-
Unscored —
MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary co…
-
Unscored —
The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificate…
-
Unscored —
Multiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large numb…
-
Unscored —
Bubblewrap before 0.1.3 sets the PR_SET_DUMPABLE flag, which might allow local users to gain privileges by attaching to…
-
Unscored —
ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the gi…
-
Critical 9.8
Froxlor guessable password reset token
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.
-
Unscored —
Unvalidated parameter vulnerability in the remote log viewing capability in Intel Security McAfee Agent 5.0.x versions …
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Web user interface (UI) in Intel Security ePO 5.1.3, 5.1.2, 5.1.1, and …
-
Unscored —
An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 a…
-
Medium 5.9
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static…
-
Unscored —
Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x thro…
-
Unscored —
An issue was discovered in Phalcon Eye through 0.4.1. The vulnerability exists due to insufficient filtration of user-s…
-
Unscored —
An issue was discovered in ionize through 1.0.8. The vulnerability exists due to insufficient filtration of user-suppli…
-
Unscored —CVE-2017-5963 Scanner template
An issue was discovered in caddy (for TYPO3) before 7.2.10. The vulnerability exists due to insufficient filtration of …
-
Unscored —
An issue was discovered in contexts_wurfl (for TYPO3) before 0.4.2. The vulnerability exists due to insufficient filtra…
-
Unscored —
An issue was discovered in Emoncms through 9.8.0. The vulnerability exists due to insufficient filtration of user-suppl…
-
High 8.8
A remote out of bound write / memory corruption vulnerability exists in the PDF parsing functionality of Nitro Pro 10. …
-
High 8.8
A potential remote code execution vulnerability exists in the PDF parsing functionality of Nitro Pro 10. A specially cr…
-
High 8.8
A remote out of bound write / memory corruption vulnerability exists in the PDF parsing functionality of Nitro Pro 10.5…
-
Unscored —
An issue was discovered in IT ITems DataBase (ITDB) through 1.23. The vulnerability exists due to insufficient filtrati…
-
Unscored —
An issue was discovered in Fastspot BigTree bigtree-form-builder before 1.2. The vulnerability exists due to insufficie…
-
Unscored —
An issue was discovered in the WP Mail plugin before 1.2 for WordPress. The replyto parameter when composing a mail all…
-
Unscored —
vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may resul…
-
Unscored —
An issue was discovered in the PoodLL Filter plugin through 3.0.20 for Moodle. The vulnerability exists due to insuffic…
-
Critical 9.8
Code Execution Through IIFE in serialize-to-js
An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize() function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression…
-
Unscored —
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…
-
Unscored —
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…
-
Medium 5.9
SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. Thi…
-
Medium 5.9
XMPP Clients User Impersonation Vulnerability in Movim Moxl
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. Thi…
-
Unscored —
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…
-
Unscored —
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…
-
Unscored —
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…
-
Unscored —
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…
-
Unscored —
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…
-
Unscored —
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperso…
-
Medium 5.9
User Impersonation in converse.js
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. Thi…