Archive
March 2017
Vulnerabilities first published in this month (UTC), newest first.
1,302 results · Feed
-
Unscored —
A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or…
-
Unscored —
CSRF exists on D-Link DIR-600M Rev. Cx devices before v3.05ENB01_beta_20170306. This can be used to bypass authenticati…
-
Unscored —
Cross site scripting in some view elements in the index filter tool in app/webroot/js/misp2.4.68.js and the organisatio…
-
Critical 9.8
OpenStack Nova logs sensitive context from notification exceptions
An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwor…
-
Unscored —
A Cross-Site Request Forgery issue was discovered in Meteocontrol WEB'log Basic 100 all versions, Light all versions, P…
-
Unscored —
EMC RecoverPoint versions prior to 5.0 and EMC RecoverPoint for Virtual Machines versions prior to 5.0 have an SSL Stri…
-
Unscored —
Code injection vulnerability in Bitdefender Total Security 12.0 (and earlier), Internet Security 12.0 (and earlier), an…
-
Unscored —
Code injection vulnerability in Avira Total Security Suite 15.0 (and earlier), Optimization Suite 15.0 (and earlier), I…
-
Unscored —
A vulnerability in the Autonomic Networking Infrastructure (ANI) registrar feature of Cisco IOS Software (possibly 15.2…
-
Unscored —
A vulnerability in the Autonomic Networking Infrastructure (ANI) feature of Cisco IOS Software (15.4 through 15.6) and …
-
Unscored —
Code injection vulnerability in AVG Ultimate 17.1 (and earlier), AVG Internet Security 17.1 (and earlier), and AVG Anti…
-
Unscored —
Code injection vulnerability in Avast Premier 12.3 (and earlier), Internet Security 12.3 (and earlier), Pro Antivirus 1…
-
Unscored —
Code injection vulnerability in Trend Micro Maximum Security 11.0 (and earlier), Internet Security 11.0 (and earlier), …
-
Unscored —
ihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects.
-
Medium 5.8
OpenStack Glance Server-Side Request Forgery (SSRF)
An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. Th…
-
Unscored —
The decode_residual function in libavcodec in libav 9.21 allows remote attackers to cause a denial of service (buffer o…
-
Medium 6.1
imdbphp Cross-Site Scripting (XSS)
A Cross-Site Scripting (XSS) was discovered in imdbphp 5.1.1. The vulnerability exists due to insufficient filtration of user-supplied data (name) passed to the "imdbphp-master/demo/search.php" URL. An attacker could execute arbitrary HTML and script code in …
-
Unscored —
The dump_section_as_bytes function in readelf in GNU Binutils 2.28 accesses a NULL pointer while reading section conten…
-
Unscored —
The ff_h2645_extract_rbsp function in libavcodec in libav 9.21 allows remote attackers to cause a denial of service (he…
-
Unscored —
A Cross-Site Scripting (XSS) was discovered in ZoneMinder before 1.30.2. The vulnerability exists due to insufficient f…
-
Unscored —
The mem_get_bits_rectangle function in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denia…
-
Unscored —
Multiple Cross-Site Scripting (XSS) were discovered in SLiMS 7 Cendana before 2017-03-16. The vulnerabilities exist due…
-
Unscored —
objdump in GNU Binutils 2.28 is vulnerable to multiple heap-based buffer over-reads (of size 1 and size 8) while handli…
-
Unscored —
A Cross-Site Scripting (XSS) was discovered in GamePanelX-V3 3.0.12. The vulnerability exists due to insufficient filtr…
-
Unscored —
XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service.
-
Unscored —
Insufficient authentication vulnerability in Junos Space before 15.2R2 allows remote network based users with access to…
-
Unscored —
Cross site request forgery vulnerability in Junos Space before 15.2R2 allows remote attackers to perform certain admini…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Junos Space before 15.2R2 allows remote attackers to steal sensitive inform…
-
Unscored —
Command injection vulnerability in Junos Space before 15.2R2 allows attackers to execute arbitrary code as a root user.
-
Unscored —
Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle (MITM) type of attacks while …
-
High 7.1
Improper Input Validation in Apache Tomcat
The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted…
-
Unscored —
hosttracker in OpenDaylight l2switch allows remote attackers to change the host location information by spoofing the MA…
-
Unscored —
The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to c…
-
Unscored —
Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before …
-
Unscored —
The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might …
-
Unscored —
The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a den…
-
Unscored —
Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted WMV file.
-
Unscored —
Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have uns…
-
Unscored —
ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (application crash).
-
Unscored —
Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to cause a den…