Archive
March 2017
Vulnerabilities first published in this month (UTC), newest first.
1,302 results · Feed
-
Unscored —
The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (…
-
Unscored —CVE-2016-7406 EPSS 10%
Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format…
-
Unscored —
TLS cipher suites with CBC mode in TLS 1.1 and 1.2 in MatrixSSL before 3.8.3 allow remote attackers to cause a denial o…
-
Unscored —
MatrixSSL before 3.8.7, when the DHE_RSA based cipher suite is supported, makes it easier for remote attackers to obtai…
-
Unscored —
MatrixSSL before 3.8.3 configured with RSA Cipher Suites allows remote attackers to obtain sensitive information via a …
-
Unscored —
Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the au…
-
Critical 9.8
espeak-ruby allows arbitrary command execution
The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or bytes_wav method in lib/espeak/speech.rb.
-
Critical 9.8
festivaltts4r allows arbitrary command execution
The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to_speech or (2) to_mp3 method in lib/festivaltts4r/festival4r.rb.
-
Unscored —
Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZM…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web…
-
Critical 9.0
PySAML2 XML external entity attack
PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.
-
Unscored —CVE-2016-10204 Public exploit
SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands vi…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web…
-
Unscored —
On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an…
-
Unscored —
The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before …
-
Unscored —
The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors i…
-
Unscored —
Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a cr…
-
Unscored —
cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location.
-
Unscored —
Use-after-free vulnerability in Irssi before 0.8.21 allows remote attackers to cause a denial of service (crash) via an…
-
Unscored —
The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x be…
-
Unscored —
libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an off…
-
Unscored —
Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string…
-
Unscored —
Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new pas…
-
Unscored —
Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites an…
-
Unscored —
ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticat…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the invocation code generation for interstitial zones in Revive Adserver be…
-
Unscored —
Irssi 0.8.18 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via vect…
-
Unscored —
Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies relat…
-
Unscored —
Cross-site scripting (XSS) vulnerability in cgiemail and cgiecho allows remote attackers to inject arbitrary web script…
-
Unscored —
Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string co…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject ar…
-
Unscored —
Open redirect vulnerability in the lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) 11.14.1 an…
-
Unscored —
The nickcmp function in Irssi before 0.8.21 allows remote attackers to cause a denial of service (NULL pointer derefere…
-
Unscored —
The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap …
-
Unscored —
Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channe…
-
Unscored —
The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6…
-
Unscored —
Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1.1.
-
Unscored —CVE-2017-6104 Public exploit
Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.
-
Unscored —
Persistent XSS in wordpress plugin rockhoist-badges v1.2.2.