Total
9398 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2016-8275 | 1 Huawei | 1 Anyoffice | 2017-04-05 | 3.5 LOW | 6.5 MEDIUM |
| Huawei AnyOffice V200R006C00 could allow an authenticated, remote attacker to cause the software to deny services by uploading an XML bomb. | |||||
| CVE-2015-7844 | 1 Huawei | 1 Fusionaccess | 2017-04-05 | 7.8 HIGH | 7.5 HIGH |
| Huawei FusionAccess with software V100R005C10,V100R005C20 could allow attackers to craft and send a malformed HDP protocol packet to cause the virtual cloud desktop to be displaying an error and not usable. | |||||
| CVE-2015-8670 | 1 Huawei | 1 Logcenter | 2017-04-05 | 4.0 MEDIUM | 6.5 MEDIUM |
| Huawei LogCenter V100R001C10 could allow an authenticated attacker to add abnormal device information to the log collection module, causing denial of service. | |||||
| CVE-2017-7301 | 1 Gnu | 1 Binutils | 2017-03-31 | 5.0 MEDIUM | 7.5 HIGH |
| The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that has an off-by-one vulnerability because it does not carefully check the string offset. The vulnerability could lead to a GNU linker (ld) program crash. | |||||
| CVE-2017-5932 | 1 Gnu | 1 Bash | 2017-03-31 | 4.6 MEDIUM | 7.8 HIGH |
| The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a command substitution metacharacter. | |||||
| CVE-2017-7262 | 1 Amd | 1 Ryzen | 2017-03-29 | 4.9 MEDIUM | 5.5 MEDIUM |
| The AMD Ryzen processor with AGESA microcode through 2017-01-27 allows local users to cause a denial of service (system hang) via an application that makes a long series of FMA3 instructions, as demonstrated by the Flops test suite. | |||||
| CVE-2015-1000002 | 1 Filedownload Project | 1 Filedownload | 2017-03-29 | 5.8 MEDIUM | 8.2 HIGH |
| Open Proxy in filedownload v1.4 wordpress plugin | |||||
| CVE-2010-5328 | 1 Linux | 1 Linux Kernel | 2017-03-29 | 4.9 MEDIUM | 5.5 MEDIUM |
| include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group ID of zero from reaching the swapper process, which allows local users to cause a denial of service (system crash) by leveraging access to this process group. | |||||
| CVE-2017-7261 | 1 Linux | 1 Linux Kernel | 2017-03-29 | 4.9 MEDIUM | 5.5 MEDIUM |
| The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.5 does not check for a zero value of certain levels data, which allows local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device. | |||||
| CVE-2015-8678 | 1 Huawei | 4 Mate S, Mate S Firmware, P8 and 1 more | 2017-03-27 | 7.1 HIGH | 5.5 MEDIUM |
| The ION driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows remote attackers to cause a denial of service (crash) via a crafted application. | |||||
| CVE-2016-6206 | 1 Huawei | 2 Ar3200, Ar3200 Firmware | 2017-03-27 | 10.0 HIGH | 9.8 CRITICAL |
| Huawei AR3200 routers with software before V200R007C00SPC600 allow remote attackers to cause a denial of service or execute arbitrary code via a crafted packet. | |||||
| CVE-2016-9395 | 1 Jasper Project | 1 Jasper | 2017-03-27 | 4.3 MEDIUM | 5.5 MEDIUM |
| The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. | |||||
| CVE-2016-4927 | 1 Juniper | 1 Junos Space | 2017-03-22 | 6.8 MEDIUM | 8.1 HIGH |
| Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle (MITM) type of attacks while a Space device is communicating with managed devices. | |||||
| CVE-2017-6961 | 1 Apng2gif Project | 1 Apng2gif | 2017-03-20 | 4.3 MEDIUM | 5.5 MEDIUM |
| An issue was discovered in apng2gif 1.7. There is improper sanitization of user input causing huge memory allocations, resulting in a crash. This is related to the read_chunk function using the pChunk->size value (within the PNG file) to determine the amount of memory to allocate. | |||||
| CVE-2014-8705 | 1 Wondercms | 1 Wondercms | 2017-03-20 | 7.5 HIGH | 9.8 CRITICAL |
| PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter. | |||||
| CVE-2017-6367 | 1 Cerberusftp | 1 Ftp Server | 2017-03-17 | 5.0 MEDIUM | 7.5 HIGH |
| In Cerberus FTP Server 8.0.10.1, a crafted HTTP request causes the Windows service to crash. The attack methodology involves a long Host header and an invalid Content-Length header. | |||||
| CVE-2017-5872 | 1 Unisys | 1 Clearpath Mcp | 2017-03-16 | 5.0 MEDIUM | 7.5 HIGH |
| The TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 57.1 before 57.152, 58.1 before 58.142, or 59.1 before 59.172, when running a TLS 1.2 service, allows remote attackers to cause a denial of service (network connectivity disruption) via a client hello with a signature_algorithms extension above those defined in RFC 5246, which triggers a full memory dump. | |||||
| CVE-2017-6466 | 1 F-secure | 1 Software Updater | 2017-03-14 | 9.3 HIGH | 8.1 HIGH |
| F-Secure Software Updater 2.20, as distributed in several F-Secure products, downloads installation packages over plain http and does not perform file integrity validation after download. Man-in-the-middle attackers can replace the file with their own executable which will be executed under the SYSTEM account. Note that when Software Updater is configured to install updates automatically, it checks if the downloaded file is digitally signed by default, but does not check the author of the signature. When running in manual mode (default), no signature check is performed. | |||||
| CVE-2016-5782 | 1 Locusenergy | 6 Lgate 100, Lgate 101, Lgate 120 and 3 more | 2017-03-14 | 7.5 HIGH | 8.6 HIGH |
| An issue was discovered in Locus Energy LGate prior to 1.05H, LGate 50, LGate 100, LGate 101, LGate 120, and LGate 320. Locus Energy meters use a PHP script to manage the energy meter parameters for voltage monitoring and network configuration. The PHP code does not properly validate information that is sent in the POST request. | |||||
| CVE-2016-6129 | 2 Libtom, Op-tee | 2 Libtomcrypt, Op-tee Os | 2017-03-13 | 5.0 MEDIUM | 7.5 HIGH |
| The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack. | |||||