Archive
June 2017
Vulnerabilities first published in this month (UTC), newest first.
1,033 results · Feed
-
Unscored —
AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exist…
-
Unscored —
The IPTables-Parse module before 1.6 for Perl allows local users to write to arbitrary files owned by the current user.
-
Unscored —
In ImageMagick 7.0.5-8 Q16, an assertion failure was found in the function ResetImageProfileIterator, which allows atta…
-
Unscored —
In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function SetPixelChannelAttributes, which allows atta…
-
Unscored —
In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function LockSemaphoreInfo, which allows attackers to…
-
Unscored —CVE-2017-7312 Public exploit
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can ad…
-
Unscored —
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possibl…
-
Unscored —CVE-2017-7314 Public exploit
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creatin…
-
Unscored —CVE-2016-9834 Public exploit
An XSS vulnerability allows remote attackers to execute arbitrary client side script on vulnerable installations of Sop…
-
Unscored —
In ytnef 1.9.2, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based b…
-
Unscored —
In ytnef 1.9.2, the TNEFFillMapi function in lib/ytnef.c allows remote attackers to cause a denial of service (memory c…
-
Unscored —
In ytnef 1.9.2, the DecompressRTF function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-ba…
-
Unscored —
In ytnef 1.9.2, the MAPIPrint function in lib/ytnef.c allows remote attackers to cause a denial of service (NULL pointe…
-
Unscored —
In ytnef 1.9.2, the SwapDWord function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based …
-
Unscored —
In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer…
-
Unscored —
In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one …
-
Unscored —
smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop …
-
High 8.8
Mercurial has Incorrect Permission Assignment for Critical Resource
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.
-
Unscored —
The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read a…
-
Unscored —
Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause …
-
Unscored —
The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows …
-
Unscored —
MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and del…
-
Unscored —
PostgreSQL PL/Java after 9.0 does not honor access controls on large objects.
-
Unscored —
The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which…
-
Medium 6.5
PostgreSQL PL/Java Improper Privilege Management
PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath.
-
Unscored —
The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard.
-
Unscored —
The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of…
-
Unscored —
PostgreSQL PL/Java before 1.5.0 allows remote authenticated users to alter type mappings for types they do not own.
-
Unscored —
game-music-emu before 0.6.1 mishandles unspecified integer values.
-
Unscored —
game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash).
-
Medium 6.5
ws-xmlrpc DoS Vulnerability
The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.
-
Unscored —
irc.cgi in CGI:IRC before 0.5.12 reflects user-supplied input from the R parameter without proper output encoding, aka …
-
Unscored —
Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arb…
-
Unscored —
Cross-site scripting (XSS) vulnerability in admin.php in Piwigo 2.9.0 and earlier allows remote attackers to inject arb…
-
Unscored —
The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired a…
-
Unscored —
Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arb…
-
Unscored —
SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL co…
-
Unscored —
In TrustZone in all Android releases from CAF using the Linux kernel, a Double Free vulnerability could potentially exi…
-
Unscored —
In TrustZone in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerabil…
-
Unscored —
In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vul…