CVE & Exploit Intelligence Database

CVE-2017-6832 5.5 MEDIUM EPSS 0.05

Heap-based buffer overflow in the decodeBlock in MSADPCM.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0, 0.2.7 allows remote attackers to cause a denial of service (crash) via a crafted file.

CWE-119 Mar 20, 2017

CVE-2017-6831 5.5 MEDIUM 2 Writeups EPSS 0.05

Heap-based buffer overflow in the decodeBlockWAVE function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6, 0.3.5, 0.3.4, 0.3.3, 0.3.2, 0.3.1, 0.3.0 and 0.2.7 allows remote attackers to cause a denial of service (crash) via a crafted file.

CWE-119 Mar 20, 2017

CVE-2017-6830 5.5 MEDIUM EPSS 0.07

Heap-based buffer overflow in the alaw2linear_buf function in G711.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.

CWE-119 Mar 20, 2017

CVE-2017-6829 5.5 MEDIUM 1 Writeup EPSS 0.05

The decodeSample function in IMA.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.

CWE-125 Mar 20, 2017

CVE-2017-6805 5.3 MEDIUM 1 PoC Analysis EPSS 0.17

Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read arbitrary files via a .. (dot dot) in a GET command.

CWE-22 Mar 20, 2017

CVE-2017-6356 5.3 MEDIUM EPSS 0.00

Palo Alto Networks Terminal Services (aka TS) Agent 6.0, 7.0, and 8.0 before 8.0.1 uses weak permissions for unspecified resources, which allows attackers to obtain sensitive session information via unknown vectors.

CWE-732 Mar 20, 2017

CVE-2017-5987 5.5 MEDIUM EPSS 0.00

The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local OS guest privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors involving the transfer mode register during multi block transfer.

CWE-835 Mar 20, 2017

CVE-2017-5956 5.5 MEDIUM EPSS 0.00

The vrend_draw_vbo function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors involving vertext_buffer_index.

CWE-125 Mar 20, 2017

CVE-2017-1155 4.3 MEDIUM EPSS 0.01

IBM Algorithmics One-Algo Risk Application 4.9.1, 5.0, and 5.1.0 could allow a user to gain access to another user's reports using a specially crafted HTTP request. IBM Reference #: 1999754.

CWE-200 Mar 20, 2017

CVE-2017-1146 5.4 MEDIUM EPSS 0.00

IBM Content Navigator 2.0.3 and 3.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999736.

CWE-79 Mar 20, 2017

CVE-2016-9696 5.4 MEDIUM EPSS 0.00

IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM Reference #: 1999960.

CWE-79 Mar 20, 2017

CVE-2016-9694 5.4 MEDIUM EPSS 0.00

IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999960.

CWE-79 Mar 20, 2017

CVE-2016-8973 4.3 MEDIUM EPSS 0.00

IBM Rhapsody DM 4.0, 5.0 and 6.0 contains an undisclosed vulnerability that may allow an authenticated user to upload infected malicious files to the server. IBM Reference #: 1999960.

CWE-434 Mar 20, 2017

CVE-2016-2981 6.8 MEDIUM EPSS 0.00

An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. IBM Reference #: 1999965.

CWE-200 Mar 20, 2017

CVE-2016-2406 4.3 MEDIUM EPSS 0.00

The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users to obtain sensitive information from encrypted documents by leveraging incorrect control of permissions on the PrintScreen button.

CWE-275 Mar 20, 2017

CVE-2016-10214 6.5 MEDIUM EPSS 0.00

Memory leak in the virgl_resource_attach_backing function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.

CWE-399 Mar 20, 2017

CVE-2015-8985 5.9 MEDIUM EPSS 0.00

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

CWE-19 Mar 20, 2017

CVE-2015-8984 5.9 MEDIUM EPSS 0.01

The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern, which triggers an out-of-bounds read.

CWE-125 Mar 20, 2017

CVE-2015-1610 5.3 MEDIUM EPSS 0.00

hosttracker in OpenDaylight l2switch allows remote attackers to change the host location information by spoofing the MAC address, aka "topology spoofing."

CWE-264 Mar 20, 2017

CVE-2014-9845 5.5 MEDIUM EPSS 0.00

The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib file.

CWE-119 Mar 20, 2017