Archive
June 2017
Vulnerabilities first published in this month (UTC), newest first.
1,033 results · Feed
-
Unscored —
The snd_msnd_interrupt function in sound/isa/msnd/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users…
-
Unscored —CVE-2017-9445 EPSS 59%
In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer th…
-
Unscored —
Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8,…
-
Unscored —
The snd_msndmidi_input_read function in sound/isa/msnd/msnd_midi.c in the Linux kernel through 4.11.7 allows local user…
-
Unscored —
Stack-based buffer overflow in the color_string_to_rgba function in libavcodec/xpmdec.c in FFmpeg 3.3 before 3.3.1 allo…
-
Unscored —
libavcodec/scpr.c in FFmpeg 3.3 before 3.3.1 does not properly validate height and width data, which allows remote atta…
-
Unscored —
libavcodec/webp.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before…
-
Unscored —
There is a heap-based buffer overflow in the function hpel_motion in mpegvideo_motion.c in libav 12.1. A crafted input …
-
Unscored —
The readEncUInt30 function in util/read.c in libming 0.4.8 mishandles memory allocation. A crafted input will lead to a…
-
Unscored —
util/outputtxt.c in libming 0.4.8 mishandles memory allocation. A crafted input will lead to a remote denial of service…
-
Unscored —
Heap-based buffer overflow in the xwd_decode_frame function in libavcodec/xwddec.c in FFmpeg before 2.8.12, 3.0.x befor…
-
Unscored —CVE-2015-7898 Public exploit
Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).
-
Unscored —CVE-2015-7895 Public exploit
Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).
-
Unscored —
ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions.
-
Unscored —
Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.
-
Critical 9.8
Opendaylight will authenticate any username and password combination
The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username and password combination.
-
Unscored —
Red Hat Gluster Storage RPM Package 3.2 allows local users to gain privileges and execute arbitrary code as root.
-
Unscored —
The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges.
-
Unscored —
The MessageStatusReceiver service in the AndroidManifest.XML in Android 5.1.1 and earlier allows local users to alter s…
-
Unscored —
Huawei Ascend P7 allows remote attackers to cause a denial of service (phone process crash).
-
Unscored —
stalin 0.11-5 allows local users to write to arbitrary files.
-
Unscored —
res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer derefere…
-
Unscored —
Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read communications between Logstash Forw…
-
Unscored —
Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows l…
-
Unscored —
ASA 5515-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.4.x before 9.4.1 Interim, 9.2.x bef…
-
Unscored —CVE-2014-6354 EPSS 13%
Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet …
-
Unscored —
OpenDaylight defense4all 1.1.0 and earlier allows remote authenticated users to write report data to arbitrary files.
-
Unscored —
Use after free vulnerability in Adobe Flash Player Desktop Runtime before 20.0.0.267, Adobe Flash Player Extended Suppo…
-
Unscored —
rhscon-ceph in Red Hat Storage Console 2 x86_64 and Red Hat Storage Console Node 2 x86_64 allows local users to obtain …
-
Unscored —
The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which al…
-
Unscored —
elog 3.1.1 allows remote attackers to post data as any username in the logbook.
-
Unscored —
FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services.
-
High 8.8CVE-2017-6086 Public exploit
ViMbAdmin CSRF Vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to (1) add an administrator user via a crafted POST request …
-
Unscored —CVE-2017-2491 Public exploit
Use after free vulnerability in the String.replace method JavaScriptCore in Apple Safari in iOS before 10.3 allows remo…
-
Unscored —CVE-2017-9830 Public exploit
Remote Code Execution is possible in Code42 CrashPlan 5.4.x via the org.apache.commons.ssl.rmi.DateRMI Java class, beca…
-
Critical 9.8
Code Injection in PHPUnit
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., ex…
KEV Feb 15, 2022 -
Unscored —
IBM Tivoli Monitoring V6 could allow an unauthenticated user to access SOAP queries that could contain sensitive inform…
-
Unscored —
IBM QRadar 7.2 and 7.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly…
-
Unscored —
IBM QRadar 7.2 and 7.3 does not require that users should have strong passwords by default, which makes it easier for a…
-
Unscored —
IBM QRadar 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaSc…