Archive
3 March 2017
Vulnerabilities first published on this day (UTC), newest first.
50 results · Feed
-
Unscored —
An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlie…
-
Unscored —
Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broa…
-
Unscored —
Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attac…
-
Unscored —
Buffer overflow in the ReadVIFFImage function in coders/viff.c in ImageMagick before 6.9.4-5 allows remote attackers to…
-
Unscored —
The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fpu…
-
Unscored —
The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Umbraco before 7.4.0 allow remote attackers to inject arbitrary …
-
High 8.2
Umbraco CMS vulnerable to CSRF
The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.
-
High 8.8
Umbraco CMS vulnerable to CSRF
Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by editing user account information in the templates.asmx.cs file.
-
Unscored —
The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read proc…
-
Unscored —
Buffer overflow in the calc_coeff function in libass/ass_blur.c in libass before 0.13.4 allows remote attackers to caus…
-
Unscored —
The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted Ope…
-
Unscored —
The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of serv…
-
Unscored —
The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial…
-
Unscored —
The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (…
-
Unscored —CVE-2016-7406 EPSS 10%
Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format…
-
Unscored —
TLS cipher suites with CBC mode in TLS 1.1 and 1.2 in MatrixSSL before 3.8.3 allow remote attackers to cause a denial o…
-
Unscored —
MatrixSSL before 3.8.7, when the DHE_RSA based cipher suite is supported, makes it easier for remote attackers to obtai…
-
Unscored —
MatrixSSL before 3.8.3 configured with RSA Cipher Suites allows remote attackers to obtain sensitive information via a …
-
Unscored —
Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the au…
-
Critical 9.8
espeak-ruby allows arbitrary command execution
The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or bytes_wav method in lib/espeak/speech.rb.
-
Critical 9.8
festivaltts4r allows arbitrary command execution
The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to_speech or (2) to_mp3 method in lib/festivaltts4r/festival4r.rb.
-
Unscored —
Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZM…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web…
-
Critical 9.0
PySAML2 XML external entity attack
PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.
-
Unscored —CVE-2016-10204 Public exploit
SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands vi…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web…
-
Unscored —
On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an…
-
Unscored —
The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before …
-
Unscored —
The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors i…
-
Unscored —
Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a cr…
-
Unscored —
cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location.
-
Unscored —
Use-after-free vulnerability in Irssi before 0.8.21 allows remote attackers to cause a denial of service (crash) via an…
-
Unscored —
The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x be…
-
Unscored —
libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an off…
-
Unscored —
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string…
-
Unscored —
Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new pas…
-
Unscored —
Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites an…
-
Unscored —
ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticat…