2017

Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read communications between Logstash Forwa

ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions.

FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services.

elog 3.1.1 allows remote attackers to post data as any username in the logbook.

In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer tha

There is a heap-based buffer overflow in the function hpel_motion in mpegvideo_motion.c in libav 12.1. A crafted input c

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that inc

Authorization Bypass in the Web interface of Arcadyan SLT-00 Star* (aka Swisscom Internet-Box) devices before R7.7 allow

Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink b

In mpg123 1.25.0, there is a heap-based buffer over-read in the convert_latin1 function in libmpg123/id3.c. A crafted in

In LibSass 3.4.5, there is a heap-based buffer over-read in the function json_mkstream() in sass_context.cpp. A crafted

In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. A

A Resource Exhaustion issue was discovered in Schneider Electric Modicon M340 PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BM

An Insufficiently Protected Credentials issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to

The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when readin

Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family

The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4

AeroAdmin 4.1 uses a function to copy data between two pointers where the size of the data copied is taken directly from

NetApp Data ONTAP 8.1 and 8.2, when operating in 7-Mode, allows man-in-the-middle attackers to obtain sensitive informat

NetApp Clustered Data ONTAP allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or caus

Memory leak in the virtio_gpu_object_create function in drivers/gpu/drm/virtio/virtgpu_object.c in the Linux kernel thro

The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (

The grant-table feature in Xen through 4.8.x mishandles MMIO region grant references, which allows guest OS users to cau

Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive

IBM Security Guardium 10.0 does not prove or insufficiently proves that the actors identity is correct which can lead to

The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and

When SWFTools 0.9.2 processes a crafted file in ttftool, it can lead to a heap-based buffer over-read in the readBlock()

A potential Buffer Overflow Vulnerability (from a BB Code handling issue) has been identified in TeamSpeak Server versio

The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows

Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: th

Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to rea

The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read me

A Null Pointer Dereference issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.230

The ReadOneJNGImage function in coders/png.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of servi

Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to cr

tcpdump 4.9.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) v

In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It co

In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lea

In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used

In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial o

In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able

In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check th

In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_meridian parsi

The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial

During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent

A vulnerability in the Border Gateway Protocol (BGP) processing functionality of the Cisco StarOS operating system for C

A vulnerability in Multicast Source Discovery Protocol (MSDP) ingress packet processing for Cisco IOS XR Software could

In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursio

iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability.