Archive
August 2017
Vulnerabilities first published in this month (UTC), newest first.
1,540 results · Feed
-
Unscored —
The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to …
-
High 7.5
The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote at…
-
Unscored —
The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary…
-
High 7.5
PyJWT vulnerable to key confusion attacks
In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY…
-
Unscored —
The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt blo…
-
Unscored —
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code …
-
Unscored —
Race condition in the grant table code in Xen 4.6.x through 4.9.x allows local guest OS administrators to cause a denia…
-
Unscored —
arch/x86/mm.c in Xen allows local PV guest OS users to gain host OS privileges via vectors related to map_grant_ref.
-
Unscored —
Xen allows local OS guest users to cause a denial of service (crash) or possibly obtain sensitive information or gain p…
-
Unscored —
In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missing NULL check in the ReadMATImage function in cod…
-
Unscored —
An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare …
-
Unscored —
A elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4…
-
Unscored —
UnrealIRCd 4.0.13 and earlier creates a PID file after dropping privileges to a non-root account, which might allow loc…
-
Unscored —
In GraphicsMagick 1.3.26, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c.
-
Unscored —
Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might al…
-
Unscored —
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before…
-
Critical 9.8
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUploa…
KEV Apr 11, 2022 -
Critical 9.8
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which …
KEV Jan 26, 2023 -
Unscored —
In GraphicsMagick 1.3.26, an allocation failure vulnerability was found in the function ReadMNGImage in coders/png.c wh…
-
Unscored —CVE-2017-12971 Public exploit
Cross-site scripting (XSS) vulnerability in Apache2Triad 1.5.4 allows remote attackers to inject arbitrary web script o…
-
Unscored —
QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileg…
-
Unscored —CVE-2017-12970 Public exploit
Cross-site request forgery (CSRF) vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authenticat…
-
Unscored —
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID p…
-
Critical 9.8
The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name col…
-
Unscored —
Multiple untrusted search path vulnerabilities in installer in Synology Photo Station Uploader before 1.4.2-084 on Wind…
-
High 8.8
Incorrect Default Permissions in Supervisor
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
-
Unscored —
DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attacker…
-
Unscored —
The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php.
-
Unscored —
Cross-site scripting (XSS) vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated d…
-
Unscored —
Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 th…
-
Unscored —
Double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to have unspecifi…
-
Critical 9.8
SaltStack Salt Directory traversal vulnerability in minion id validation
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.
-
Unscored —
In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the ReadJP2Image function in coders/jp2.c does not properly valid…
-
Unscored —
In ImageMagick before 6.9.9-4 and 7.x before 7.0.6-4, a crafted file could trigger a memory leak in ReadOnePNGImage in …
-
Unscored —
In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an out-of-bounds…
-
Unscored —
In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or height exceeds limit" error report) if the im…
-
Unscored —
In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, a crafted PNG file could trigger a crash because there was an ins…
-
Unscored —
In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data…
-
Unscored —
In ImageMagick before 6.9.8-5 and 7.x before 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat…
-
Unscored —
In ImageMagick before 6.9.9-1 and 7.x before 7.0.6-2, the ReadOnePNGImage function in coders/png.c allows remote attack…