Archive
March 2017
Vulnerabilities first published in this month (UTC), newest first.
1,302 results · Feed
-
Unscored —
regexp.c in Artifex Software, Inc. MuJS allows attackers to cause a denial of service (NULL pointer dereference and cra…
-
Unscored —
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the…
-
Unscored —
Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgi…
-
Unscored —
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter. Some…
-
Unscored —
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter. So…
-
Unscored —
An issue was discovered on Miele Professional PST10 devices. The corresponding embedded webserver "PST10 WebServer" typ…
-
Unscored —
Eclipse tinydtls 0.8.2 for Eclipse IoT allows remote attackers to cause a denial of service (DTLS peer crash) by sendin…
-
Unscored —
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter. So…
-
Unscored —
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers a…
-
Unscored —
The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote a…
-
Unscored —
Heap-based buffer overflow in the PushQuantumPixel function in ImageMagick before 6.9.7-3 and 7.x before 7.0.4-3 allows…
-
Unscored —
Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a den…
-
Unscored —
Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x …
-
Unscored —
Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a c…
-
Unscored —
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allo…
-
Unscored —
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers a…
-
Unscored —CVE-2017-5334 EPSS 33%
Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 a…
-
Unscored —
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which tr…
-
Unscored —
Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.
-
Unscored —
The ION driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230,…
-
High 7.5
Pysaml2 does not sanitize XML responses
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
-
Unscored —CVE-2017-6087 Public exploit
EyesOfNetwork ("EON") 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharact…
-
Unscored —
Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote aut…
-
Medium 5.5
Improper Restriction of Recursive Entity References in DTDs in Apache POI
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
-
Unscored —
Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticat…
-
Unscored —
An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scrip…
-
Unscored —
The editbanner feature in SolarWinds LEM (aka SIEM) through 6.3.1 allows remote authenticated users to execute arbitrar…
-
Unscored —
SolarWinds LEM (aka SIEM) before 6.3.1 has an incorrect sudo configuration, which allows local users to obtain root acc…
-
Medium 6.1
Pi Cross-site Scripting vulnerability
A Cross-Site Scripting (XSS) was discovered in pi-engine/pi 2.5.0. The vulnerability exists due to insufficient filtration of user-supplied data (preview) passed to the "pi-develop/www/script/editor/markitup/preview/markdown.php" URL. An attacker could execut…
-
Unscored —
Multiple Cross-Site Scripting (XSS) were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insu…
-
Unscored —
Multiple Cross-Site Scripting (XSS) were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insu…
-
Unscored —
A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient …
-
Unscored —
A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient …
-
Unscored —
Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote …
-
Unscored —
Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote …
-
Unscored —
The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of serv…
-
Unscored —
The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via …
-
Unscored —
Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspeci…
-
Unscored —
Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, …
-
Unscored —
Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global re…