Archive
16 March 2017
Vulnerabilities first published on this day (UTC), newest first.
6 results · Clear filters · Feed
-
High 8.8
Capstone Integer overflow
Integer overflow in the cs_winkernel_malloc function in winkernel_mm.c in Capstone 3.0.4 and earlier allows attackers to cause a denial of service (heap-based buffer overflow in a kernel driver) or possibly have unspecified other impact via a large value.
-
High 7.4
Server Side Request Forgery in svgSalamander
The SVG Salamander (aka svgSalamander) library, when used in a web application, allows remote attackers to conduct server-side request forgery (SSRF) attacks via an xlink:href attribute in an SVG file.
-
High 7.4
Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
-
High 7.5
Drupal editor module incorrectly checks access to inline private files
When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.
-
High 7.5
Drupal Cross-Site Request Forgery (CSRF)
Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.
-
High 8.1
Drupal Remote code execution
A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't no…
