Archive
February 2017
Vulnerabilities first published in this month (UTC), newest first.
1,041 results · Feed
-
Unscored —
Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level ca…
-
Critical 9.8
Directory traversal vulnerability in RubyZip
The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the fil…
-
High 8.1
Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuild…
KEV Mar 28, 2022 -
High 7.5
JustSystems Ichitaro 2016 Trial contains a vulnerability that exists when trying to open a specially crafted PowerPoint…
-
High 8.8
When processing a record type of 0x3c from a Workbook stream from an Excel file (.xls), JustSystems Ichitaro Office tru…
-
High 8.8
When copying filedata into a buffer, JustSystems Ichitaro Office 2016 Trial will calculate two values to determine how …
-
Unscored —
Integer overflow in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault…
-
Unscored —
Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segment…
-
Unscored —
Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and …
-
Unscored —
Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of servic…
-
Medium 4.9
Chameleon in Plone allows Authentication Bypass
Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.
-
Unscored —
Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and …
-
Unscored —
The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attac…
-
High 7.3
Plone vulnerable to privilege escalation in WebDAV
Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors.
-
Medium 5.3
Plone vulnerable to unauthorized disclosure of site content
Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors.
-
Unscored —
The d_print_comp function in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentat…
-
Unscored —CVE-2016-2226 Public exploit
Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrar…
-
Unscored —
dwarf_form.c in libdwarf 20160115 allows remote attackers to cause a denial of service (crash) via a crafted elf file.
-
Unscored —
IBM Tivoli Storage Manager Server 7.1 could allow an authenticated user with TSM administrator privileges to cause a bu…
-
Unscored —
IBM WebSphere MQ 8.0 could allow an authenticated user with authority to create a cluster object to cause a denial of s…
-
Unscored —
IBM Jazz for Service Management 1.1.2.1 and 1.1.3 is vulnerable to cross-site request forgery which could allow an atta…
-
Unscored —
The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a cer…
-
Unscored —
An issue was discovered in tnef before 1.4.13. Four type confusions have been identified in the file_add_mapi_attrs() f…
-
Unscored —
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. T…
-
Unscored —
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "5 of 9. Integer Overflow."
-
Unscored —
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "9 of 9. Directory Traversal usi…
-
Unscored —
The r_read_* functions in libr/include/r_endian.h in radare2 1.2.1 allow remote attackers to cause a denial of service …
-
Unscored —
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "6 of 9. Invalid Write and Integ…
-
Unscored —
An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been i…
-
Unscored —
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "4 of 9. Out of Bounds Reads."
-
Unscored —
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "2 of 9. Infinite Loop / DoS in …
-
Unscored —
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "3 of 9. Buffer Overflow in vers…
-
Unscored —
Multiple use-after-free vulnerabilities in the gx_image_enum_begin function in base/gxipixel.c in Ghostscript before ec…
-
Unscored —
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read().…
-
Unscored —
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "1 of 9. Null Pointer Deref / ca…
-
Unscored —
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "8 of 9. Out of Bounds read and …
-
Unscored —
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "7 of 9. Out of Bounds read."
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Bilboplanet 2.0 allow remote attackers to inject arbitrary web s…
-
Medium 6.1
PayPal PHP Merchant SDK Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.
-
Unscored —
In versions of wolfSSL before 3.10.2 the function fp_mul_comba makes it easier to extract RSA key information for a mal…