Archive
1 September 2017
Vulnerabilities first published on this day (UTC), newest first.
30 results · Feed
-
Unscored —
NetApp Data ONTAP before 8.2.5 and 8.3.x before 8.3.2P12 allow remote authenticated users to cause a denial of service …
-
Medium 5.9
SimpleSAMLphp allows timing side-channel attacks
The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare…
-
Unscored —
The ReadBMPImage function in coders/bmp.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (…
-
Unscored —
NetApp Clustered Data ONTAP 8.3.x before 8.3.2P12 allows remote authenticated users to execute arbitrary code on the st…
-
Unscored —
NetApp Clustered Data ONTAP 8.3.x before 8.3.2P12 allows remote authenticated users to read data on other Storage Virtu…
-
Unscored —
The ReadVIFFImage function in coders/viff.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service…
-
High 7.5
SimpleSAMLphp InfoCard module Incorrect signature verification
The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.
-
Medium 5.9
SimpleSAMLphp Incorrect IV generation for encryption
The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the ini…
-
Critical 9.8
Incorrect persistent NameID generation in SimpleSAMLphp
SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.
-
Unscored —
The ReadOneLayer function in coders/xcf.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (…
-
Unscored —
NetApp OnCommand Unified Manager for Clustered Data ONTAP before 7.2P1 does not set the secure flag for an unspecified …
-
Unscored —
The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attacke…
-
Unscored —CVE-2017-14105 Public exploit
HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, b…
-
Unscored —
The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel before 4.12 allows local users to cause a denial of s…
-
Unscored —
Untrusted search path vulnerability in Installer for ContentsBridge Utility for Windows 7.4.0 and earlier allows an att…
-
Unscored —
Untrusted search path vulnerability in Installers for DocuWorks 8.0.7 and earlier and DocuWorks Viewer Light published …
-
Unscored —
Untrusted search path vulnerability in Remote Support Tool (Enkaku Support Tool) All versions distributed through the w…
-
Unscored —
Untrusted search path vulnerability in Self-extracting document generated by DocuWorks 8.0.7 and earlier allows an atta…
-
Unscored —
Untrusted search path vulnerability in Installers of ART EX Driver for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271…
-
Unscored —
NetApp Data ONTAP before 8.2.4, when operating in 7-Mode, allows remote attackers to bypass authentication and (1) obta…
-
Unscored —CVE-2017-13672 Public exploit
QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to …
-
Unscored —
Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to …
-
Unscored —
Symantec ProxyClient 3.4 for Windows is susceptible to a privilege escalation vulnerability. A malicious local Windows …
-
High 7.5
SimpleSAMLphp Authentication context bypass in the multiauth module
The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input.
-
Critical 9.8
SimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt module
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions…
-
Medium 5.9
SimpleSAMLphp Unauthenticated encryption in CBC mode
SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect session identifiers in replies to non-H…
-
Unscored —
A Code Injection vulnerability in the non-certificate-based authentication mechanism in McAfee Live Safe versions prior…
-
Unscored —CVE-2017-3898 Public exploit
A man-in-the-middle attack vulnerability in the non-certificate-based authentication mechanism in McAfee LiveSafe (MLS)…
-
Unscored —CVE-2017-14103 EPSS 30%
The ReadJNGImage and ReadOneJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 do not properly manage image po…
-
Unscored —
MIMEDefang 2.80 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local…