The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.
| ID | Description | Priority | Modified date | Fixed Release |
|---|---|---|---|---|
| CVE-2017-6299 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as 2 of 9. Infinite Loop / DoS in the TNEFFillMapi function in lib/ytnef.c.<a href=http://cwe.mitre.org/data/definitions/835.html>CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')</a> | MEDIUM | Feb 24, 2017 | n/a |
| CVE-2017-6300 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as 3 of 9. Buffer Overflow in version field in lib/tnef-types.h. | MEDIUM | Feb 24, 2017 | n/a |
| CVE-2017-6301 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as 4 of 9. Out of Bounds Reads. | MEDIUM | Feb 24, 2017 | n/a |
| CVE-2017-6302 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as 5 of 9. Integer Overflow. | MEDIUM | Feb 24, 2017 | n/a |
| CVE-2017-6303 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as 6 of 9. Invalid Write and Integer Overflow. | MEDIUM | Feb 24, 2017 | n/a |
| CVE-2017-6304 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as 7 of 9. Out of Bounds read. | MEDIUM | Feb 24, 2017 | n/a |
| CVE-2017-6305 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as 8 of 9. Out of Bounds read and write. | MEDIUM | Feb 24, 2017 | n/a |
| CVE-2017-6306 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as 9 of 9. Directory Traversal using the filename; SanitizeFilename function in settings.c. | MEDIUM | Feb 24, 2017 | n/a |
| CVE-2017-6307 | An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker. | MEDIUM | Feb 24, 2017 | n/a |
| CVE-2017-6308 | An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been identified in the functions that wrap memory allocation. | MEDIUM | Feb 24, 2017 | n/a |
| CVE-2017-6309 | An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker. | MEDIUM | Feb 24, 2017 | n/a |
| CVE-2017-6310 | An issue was discovered in tnef before 1.4.13. Four type confusions have been identified in the file_add_mapi_attrs() function. These might lead to invalid read and write operations, controlled by an attacker. | MEDIUM | Feb 24, 2017 | n/a |
| CVE-2013-7459 | Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py. | High | Feb 23, 2017 | n/a |
| CVE-2014-9916 | Multiple cross-site scripting (XSS) vulnerabilities in Bilboplanet 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) tribe_name or (2) tags parameter in a tribes page request to user/ or the (3) user_id or (4) fullname parameter to signup.php. | -- | Feb 23, 2017 | n/a |
| CVE-2015-4056 | The System Library in VCE Vision Intelligent Operations before 2.6.5 does not properly implement cryptography, which makes it easier for local users to discover credentials by leveraging administrative access. | Low | Feb 23, 2017 | n/a |
| CVE-2015-8979 | Stack-based buffer overflow in the parsePresentationContext function in storescp in DICOM dcmtk-3.6.0 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a long string sent to TCP port 4242. | Medium | Feb 23, 2017 | n/a |
| CVE-2016-10227 | Zyxel USG50 Security Appliance and NWA3560-N Access Point allow remote attackers to cause a denial of service (CPU consumption) via a flood of ICMPv4 Port Unreachable packets. | HIGH | Feb 23, 2017 | n/a |
| CVE-2016-1245 | It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ to be compatible with a message size; however, BUFSIZ is system-dependent. | HIGH | Feb 23, 2017 | n/a |
| CVE-2016-3013 | IBM WebSphere MQ 8.0 could allow an authenticated user to crash the MQ channel due to improper data conversion handling. IBM Reference #: 1998661. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-3052 | IBM WebSphere MQ 8.0, under nonstandard configurations, sends password data in cleartext over the network that could be intercepted using main in the middle techniques. IBM Reference #: 1998660. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-3694 | Multiple SQL injection vulnerabilities in modified eCommerce Shopsoftware 2.0.0.0 revision 9678, when the easybill-module is not installed, allow remote attackers to execute arbitrary SQL commands via the (1) orders_status or (2) customers_status parameter to api/easybill/easybillcsv.php. | HIGH | Feb 23, 2017 | n/a |
| CVE-2016-5726 | Packages.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the themechanges array parameter. | HIGH | Feb 23, 2017 | n/a |
| CVE-2016-5727 | LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via vectors related to variables derived from user input in a foreach loop. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-6249 | F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files. | LOW | Feb 23, 2017 | n/a |
| CVE-2016-8346 | An issue was discovered in Moxa EDR-810 Industrial Secure Router. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access configuration and log files (PRIVILEGE ESCALATION). | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-8636 | Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the RDMA protocol over infiniband (aka Soft RoCE) technology. | HIGH | Feb 23, 2017 | n/a |
| CVE-2016-8690 | The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-8915 | IBM WebSphere MQ 8.0 could allow an authenticated user with access to the queue manager and queue, to deny service to other channels running under the same process. IBM Reference #: 1998649. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-8974 | IBM Rhapsody DM 4.0, 5.0 and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1997798. | HIGH | Feb 23, 2017 | n/a |
| CVE-2016-8986 | IBM WebSphere MQ 8.0 could allow an authenticated user with access to the queue manager to bring down MQ channels using specially crafted HTTP requests. IBM Reference #: 1998648. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-9244 | A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-9269 | Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to run arbitrary commands on the system as root via Patch Update functionality. This was resolved in Version 6.5 CP 1737. | HIGH | Feb 23, 2017 | n/a |
| CVE-2016-9314 | Sensitive Information Disclosure in com.trend.iwss.gui.servlet.ConfigBackup in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to backup the system configuration and download it onto their local machine. This backup file contains sensitive information like passwd/shadow files, RSA certificates, Private Keys and Default Passphrase, etc. This was resolved in Version 6.5 CP 1737. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-9316 | Multiple stored Cross-Site-Scripting (XSS) vulnerabilities in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allow authenticated, remote users with least privileges to inject arbitrary HTML/JavaScript code into web pages. This was resolved in Version 6.5 CP 1737. | LOW | Feb 23, 2017 | n/a |
| CVE-2016-9344 | An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-9346 | An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. Configuration data are stored in a file that is not encrypted. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-9364 | An issue was discovered in Fidelix FX-20 series controllers, versions prior to 11.50.19. Arbitrary file reading via path traversal allows an attacker to access arbitrary files and directories on the server. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-9377 | Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation. | LOW | Feb 23, 2017 | n/a |
| CVE-2016-9378 | Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery. | LOW | Feb 23, 2017 | n/a |
| CVE-2016-9384 | Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table. | LOW | Feb 23, 2017 | n/a |
| CVE-2016-9560 | Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-9637 | The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access. | LOW | Feb 23, 2017 | n/a |
| CVE-2016-9682 | The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabilities in its web administrative interface. These vulnerabilities occur in the diagnostics CGI (/cgi-bin/diagnostics) component responsible for emailing out information about the state of the system. The application doesn't properly escape the information passed in the 'tsrDeleteRestartedFile' or 'currentTSREmailTo' variables before making a call to system(), allowing for remote command injection. Exploitation of this vulnerability yields shell access to the remote machine under the nobody user account. | HIGH | Feb 23, 2017 | n/a |
| CVE-2016-9683 | The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. This vulnerability occurs in the 'extensionsettings' CGI (/cgi-bin/extensionsettings) component responsible for handling some of the server's internal configurations. The CGI application doesn't properly escape the information it's passed when processing a particular multi-part form request involving scripts. The filename of the 'scriptname' variable is read in unsanitized before a call to system() is performed - allowing for remote command injection. Exploitation of this vulnerability yields shell access to the remote machine under the nobody user account. This is SonicWall Issue ID 181195. | HIGH | Feb 23, 2017 | n/a |
| CVE-2016-9684 | The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. This vulnerability occurs in the 'viewcert' CGI (/cgi-bin/viewcert) component responsible for processing SSL certificate information. The CGI application doesn't properly escape the information it's passed in the 'CERT' variable before a call to system() is performed - allowing for remote command injection. Exploitation of this vulnerability yields shell access to the remote machine under the nobody user account. | HIGH | Feb 23, 2017 | n/a |
| CVE-2016-9773 | Heap-based buffer overflow in the IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9556. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-9909 | The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of the < (less than) character in attribute values. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-9910 | The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of special characters in attribute values, a different vulnerability than CVE-2016-9909. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2016-9955 | The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 responses or possibly cause a denial of service (memory consumption) by leveraging improper conversion of return values to boolean. | MEDIUM | Feb 23, 2017 | n/a |
| CVE-2017-0308 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where untrusted input is used for buffer size calculation leading to denial of service or escalation of privileges. | HIGH | Feb 23, 2017 | n/a |
