Max CVSS 7.5 Min CVSS 2.1 Total Count68
IDCVSSSummaryLast (major) updatePublished
CVE-2016-9651 6.8
A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
09-01-2019 - 14:29 09-01-2019 - 14:29
CVE-2017-0361 2.1
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext.
16-04-2018 - 05:58 13-04-2018 - 12:29
CVE-2017-0372 7.5
Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities.
13-04-2018 - 12:29 13-04-2018 - 12:29
CVE-2017-0370 5.0
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter.
13-04-2018 - 12:29 13-04-2018 - 12:29
CVE-2017-0369 4.0
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it.
13-04-2018 - 12:29 13-04-2018 - 12:29
CVE-2017-0368 5.0
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages.
13-04-2018 - 12:29 13-04-2018 - 12:29
CVE-2017-0367 6.5
Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure.
13-04-2018 - 12:29 13-04-2018 - 12:29
CVE-2017-0366 4.0
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration.
13-04-2018 - 12:29 13-04-2018 - 12:29
CVE-2017-0365 2.6
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations.
13-04-2018 - 12:29 13-04-2018 - 12:29
CVE-2017-0364 5.8
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link.
13-04-2018 - 12:29 13-04-2018 - 12:29
CVE-2017-0363 5.8
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites.
13-04-2018 - 12:29 13-04-2018 - 12:29
CVE-2017-0362 6.8
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token.
13-04-2018 - 12:29 13-04-2018 - 12:29
CVE-2017-2619 6.0
Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition.
12-03-2018 - 11:29 12-03-2018 - 11:29
CVE-2017-7853 5.0
In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS.
07-05-2017 - 21:29 13-04-2017 - 12:59
CVE-2017-7595 4.3
The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.
05-05-2017 - 21:29 09-04-2017 - 10:59
CVE-2016-10326 5.0
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_body_to_str() function defined in osipparser2/osip_body.c, resulting in a remote DoS.
19-04-2017 - 15:44 13-04-2017 - 12:59
CVE-2016-10325 5.0
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the _osip_message_to_str() function defined in osipparser2/osip_message_to_str.c, resulting in a remote DoS.
19-04-2017 - 15:44 13-04-2017 - 12:59
CVE-2016-10324 7.5
In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_clrncpy() function defined in osipparser2/osip_port.c.
19-04-2017 - 15:44 13-04-2017 - 12:59
CVE-2017-7377 2.1
The (1) v9fs_create and (2) v9fs_lcreate functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS privileged users to cause a denial of service (file descriptor or memory consumption) via vectors related to an already in-use fid.
17-04-2017 - 09:28 10-04-2017 - 11:59
CVE-2017-7601 6.8
LibTIFF 4.0.7 has a "shift exponent too large for 64-bit type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
13-04-2017 - 10:17 09-04-2017 - 10:59
CVE-2017-7600 6.8
LibTIFF 4.0.7 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a craft
13-04-2017 - 10:15 09-04-2017 - 10:59
CVE-2017-7602 6.8
LibTIFF 4.0.7 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
13-04-2017 - 10:15 09-04-2017 - 10:59
CVE-2017-7594 4.3
The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (memory leak) via a crafted image.
13-04-2017 - 10:15 09-04-2017 - 10:59
CVE-2017-7597 6.8
tif_dirread.c in LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact vi
13-04-2017 - 10:14 09-04-2017 - 10:59
CVE-2017-7596 6.8
LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image
13-04-2017 - 10:13 09-04-2017 - 10:59
CVE-2017-7599 6.8
LibTIFF 4.0.7 has an "outside the range of representable values of type short" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image
13-04-2017 - 10:01 09-04-2017 - 10:59
CVE-2017-7593 4.3
tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly initialized, which might allow remote attackers to obtain sensitive information from process memory via a crafted image.
13-04-2017 - 10:00 09-04-2017 - 10:59
CVE-2017-7598 4.3
tif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.
13-04-2017 - 09:51 09-04-2017 - 10:59
CVE-2017-7592 6.8
The putagreytile function in tif_getimage.c in LibTIFF 4.0.7 has a left-shift undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
13-04-2017 - 09:50 09-04-2017 - 10:59
CVE-2017-7586 4.3
In libsndfile before 1.0.28, an error in the "header_read()" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
11-04-2017 - 21:59 07-04-2017 - 16:59
CVE-2017-7228 7.2
An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory access
11-04-2017 - 21:59 04-04-2017 - 10:59
CVE-2017-2671 4.9
The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local users to cause a denial of service (pani
11-04-2017 - 15:05 05-04-2017 - 02:59
CVE-2017-7585 4.3
In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
10-04-2017 - 18:36 07-04-2017 - 16:59
CVE-2016-10221 4.3
The count_entries function in pdf-layer.c in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted PDF document.
10-04-2017 - 12:10 03-04-2017 - 01:59
CVE-2017-7187 7.2
The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl
23-03-2017 - 13:51 20-03-2017 - 10:59
CVE-2017-6967 7.5
xrdp 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pam_limits.so b
21-03-2017 - 14:48 17-03-2017 - 05:59
CVE-2017-6503 4.3
WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS.
13-03-2017 - 21:59 05-03-2017 - 21:59
CVE-2017-6504 4.3
WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking.
07-03-2017 - 07:39 05-03-2017 - 21:59
CVE-2016-10087 5.0
The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text c
28-02-2017 - 10:06 30-01-2017 - 17:59
CVE-2016-5212 4.3
Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android insufficiently sanitized DevTools URLs, which allowed a remote attacker to read local files via a crafted HTML page.
23-01-2017 - 10:12 19-01-2017 - 00:59
CVE-2016-5213 6.8
A use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
23-01-2017 - 10:12 19-01-2017 - 00:59
CVE-2016-5214 4.3
Google Chrome prior to 55.0.2883.75 for Windows mishandled downloaded files, which allowed a remote attacker to prevent the downloaded file from receiving the Mark of the Web via a crafted HTML page.
23-01-2017 - 10:12 19-01-2017 - 00:59
CVE-2016-5211 6.8
A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
23-01-2017 - 10:10 19-01-2017 - 00:59
CVE-2016-5215 6.8
A use after free in webaudio in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
23-01-2017 - 09:57 19-01-2017 - 00:59
CVE-2016-5224 4.3
A timing attack on denormalized floating point arithmetic in SVG filters in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to bypass the Same Origin Policy via a crafted
23-01-2017 - 09:55 19-01-2017 - 00:59
CVE-2016-5223 4.3
Integer overflow in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption or DoS via a crafted PDF file.
23-01-2017 - 09:48 19-01-2017 - 00:59
CVE-2016-5216 6.8
A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.
23-01-2017 - 09:47 19-01-2017 - 00:59
CVE-2016-5221 6.8
Type confusion in libGLESv2 in ANGLE in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android possibly allowed a remote attacker to bypass buffer validation via a crafted HTML page.
23-01-2017 - 09:47 19-01-2017 - 00:59
CVE-2016-5207 4.3
In Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android, corruption of the DOM tree could occur during the removal of a full screen element, which allowed a remote attacker to achieve arbitrary code ex
23-01-2017 - 09:42 19-01-2017 - 00:59
CVE-2016-5205 4.3
Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
23-01-2017 - 09:42 19-01-2017 - 00:59
CVE-2016-5204 4.3
Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a cr
23-01-2017 - 09:42 19-01-2017 - 00:59
CVE-2016-5203 6.8
A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
23-01-2017 - 09:41 19-01-2017 - 00:59
CVE-2016-5201 4.3
A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed a remote attacker to access privileged JavaScript code via a crafted HTML page.
20-01-2017 - 10:22 19-01-2017 - 00:59
CVE-2016-5206 6.8
The PDF plugin in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly followed redirects, which allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page.
20-01-2017 - 10:22 19-01-2017 - 00:59
CVE-2016-5208 4.3
Blink in Google Chrome prior to 55.0.2883.75 for Linux and Windows, and 55.0.2883.84 for Android allowed possible corruption of the DOM tree during synchronous event handling, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS)
20-01-2017 - 10:12 19-01-2017 - 00:59
CVE-2016-5210 6.8
Heap buffer overflow during TIFF image parsing in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
20-01-2017 - 10:00 19-01-2017 - 00:59
CVE-2016-5217 4.3
The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly permitted access to privileged plugins, which allowed a remote attacker to bypass site isolation via a crafted HTML page.
20-01-2017 - 09:58 19-01-2017 - 00:59
CVE-2016-5218 4.3
The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowed a remote attacker to temporarily spoof the contents of the Omnibox (URL bar)
20-01-2017 - 09:58 19-01-2017 - 00:59
CVE-2016-5219 6.8
A heap use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
20-01-2017 - 09:58 19-01-2017 - 00:59
CVE-2016-5222 4.3
Incorrect handling of invalid URLs in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
20-01-2017 - 09:50 19-01-2017 - 00:59
CVE-2016-5199 6.8
An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exp
20-01-2017 - 09:37 19-01-2017 - 00:59
CVE-2016-5225 4.3
Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled form actions, which allowed a remote attacker to bypass Content Security Policy via a crafted HTML page.
20-01-2017 - 09:07 19-01-2017 - 00:59
CVE-2016-9650 4.3
Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled iframes, which allowed a remote attacker to bypass a no-referrer policy via a crafted HTML page.
20-01-2017 - 08:15 19-01-2017 - 00:59
CVE-2016-5183 6.8
A heap use after free in PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android allows a remote attacker to potentially exploit heap corruption via crafted PDF files.
22-12-2016 - 11:04 17-12-2016 - 22:59
CVE-2016-5189 4.3
Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted navigation to blob URLs with non-canonical origins, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pa
20-12-2016 - 07:50 17-12-2016 - 22:59
CVE-2016-5182 6.8
Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation in bitmap handling, which allowed a remote attacker to potentially exploit heap corruption via crafted HTML pages.
20-12-2016 - 07:09 17-12-2016 - 22:59
CVE-2016-5423 6.5
PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), obtain sensitive memory informat
14-12-2016 - 12:59 09-12-2016 - 18:59
CVE-2016-5424 4.6
PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \
14-12-2016 - 12:59 09-12-2016 - 18:59
Back to Top Mark selected
Back to Top