CVEs published in January 2017
1,024 vulnerabilities, 167 critical, 2 exploited.
- joomla joomla\!Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group...9.8 Critical
- arista cloudvision portalCloudVision Portal (CVP) before 2016.1.2.1 allows remote authenticated users to gain access to...8.8 High
- ubiquiti networks unifi ap ac lite firmwareUbiquiti Networks UniFi 5.2.7 does not restrict access to the database, which allows remote...8.8 High
- libdwarf project libdwarfThe _dwarf_read_loc_section function in dwarf_loc.c in libdwarf 20160613 allows attackers to...5.5 Medium
- owncloud desktop clientownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain...8.4 High
- emarref jwtThe verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a...7.5 High
- python-jose project python-josepython-jose failure to use a constant time comparison for HMAC keys9.8 Critical
- ffmpegHeap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1...7.5 High
- atlassian confluence server, jira integration for hipchat +1 moreThe Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before...7.5 High
- zohocorp webnms frameworkZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and...9.8 Critical
- zohocorp webnms frameworkZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which...9.8 Critical
- zohocorp webnms frameworkDirectory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2...7.5 High
- zohocorp webnms frameworkDirectory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2...9.8 Critical
- doorkeeper project doorkeeperDoorkeeper is vulnerable to replay attacks9.1 Critical
- gopivotal grailsCross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and...8.8 High
- liferayDirectory traversal vulnerability in Liferay 5.1.0 allows remote attackers to have unspecified...9.8 Critical
- infoblox netmriCRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote...6.1 Medium
- ffmpegInteger overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0...9.8 Critical
- owncloudownCloud server before 8.2.6 and 9.x before 9.0.3, when the gallery app is enabled, allows remote...5.9 Medium
- php pecl httpBuffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote...9.8 Critical
- microsoft skypeMultiple untrusted search path vulnerabilities in Microsoft Skype allow local users to execute...7.8 High
- onelogin ruby-samlRuby-saml allows attackers to perform XML signature wrapping attacks7.5 High
- valvesoftware steamosValve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which...4.8 Medium
- keepassThe automatic update feature in KeePass 2.33 and earlier allows man-in-the-middle attackers to...7.5 High
- typo3Extbase for TYPO3 allows RCE8.1 High
- cakephpCakePHP allows remote attackers to spoof their IP7.5 High
- cryptsetup project cryptsetupThe Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically...6.8 Medium
- gitlabThe impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through...8.8 High
- zabbixThe mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix...8.1 High
- typo3TYPO3 Backend component Cross-site scripting (XSS) vulnerability6.1 Medium
- momentjs moment, oracle primavera unifier, tenable nessus +2 moreRegular Expression Denial of Service in moment6.5 Medium
- magentoMagento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks...9.8 Critical
- giflib project giflibMultiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have...9.8 Critical
- ivanti landesk management suiteBuffer overflow in the collector.exe listener of the Landesk Management Suite 10.0.0.271 and...9.8 Critical
- avaya vsp operating system softwareAvaya Fabric Connect Virtual Services Platform (VSP) Operating System Software (VOSS) before 4.2...9.8 Critical
- exponentcms exponent cmsExponent CMS 2.x before 2.3.7 Patch 3 allows remote attackers to execute arbitrary code via the...9.8 Critical
- snortUntrusted search path vulnerability in Snort 2.9.7.0-WIN32 allows remote attackers to execute...8.8 High
- idrix truecrypt, veracrypt +1 moreUntrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before...7.8 High
- elfden eshop pluginMultiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for...8.8 High
- elfden eshop pluginMultiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3...6.1 Medium
- mustache.js project mustache.jsCross-Site Scripting in mustache6.1 Medium
- handlebars.js project handlebars.jsArbitrary Code Execution in handlebars6.1 Medium
- nodejs node.jsSymlink Arbitrary File Overwrite in tar7.5 High
- send project sendRoot Path Disclosure in send5.3 Medium
- uglifyjs project uglifyjsRegular Expression Denial of Service in uglify-js7.5 High
- uglifyjs project uglifyjsIncorrect Handling of Non-Boolean Comparisons During Minification in uglify-js9.8 Critical
- openjsf serve-indexCross-Site Scripting in serve-index6.1 Medium
- nodejs node.jsRegular Expression Denial of Service in semver7.5 High
- marked project marked, fedoraproject fedora +1 moreRegular Expression Denial of Service in marked7.5 High
- vercel msRegular Expression Denial of Service in ms7.5 High
- Show moreLoading…