WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product opensuse✕
Overview 1,470 matches · 12 in Waratek scope · 3 protected · 60 exploited · 45 CISA KEV · 111 public PoC · 62 EPSS ≥ 0.5
1,470matches 12in Waratek scope0.8% 3protected0.2% 60exploited4.1% 45CISA KEV3.1% 111public PoC7.6% 62EPSS ≥ 0.54.2%
Protected by Waratek 3 0.2% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 9 0.6% Outside Waratek scope 34 2.3% Not applicable 1,424 96.9% Withdrawn CVE 0 0.0%
Critical 87 5.9% High 617 42.0% Medium 641 43.6% Low 125 8.5% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 0.2% partly blocked 0 0.0% not blocked 1,467 99.8% not established 0 0.0% unrecorded 0 0.0%
Exploited 60 4.1% Working exploit published 64 4.4% Proof of concept only 6 0.4% Forecast only 7 0.5% No public exploit 1,333 90.7%
split by peak 316 / year
Not applicable: 1,424Outside Waratek scope: 34No exploit published: 9Protected by Waratek: 3 Low: 125Medium: 641High: 617Critical: 87 not blocked: 1,467blocked by ARMR today: 3 No public exploit: 1,333Forecast only: 7Proof of concept only: 6Working exploit published: 64Exploited: 60
20077 Not applicable7 High2 Medium3 Low2 not blocked7 No public exploit7 200819 Not applicable19 High10 Medium7 Low2 not blocked19 Working exploit published1 No public exploit18 200938 No exploit published1 Not applicable37 High14 Medium20 Low4 not blocked38 Exploited2 Working exploit published5 No public exploit31 201073 Outside Waratek scope2 Not applicable71 Critical7 High28 Medium24 Low14 not blocked73 Exploited8 Working exploit published12 No public exploit53 201118 Not applicable18 High6 Medium11 Low1 not blocked18 Exploited4 Working exploit published1 No public exploit13 2012151 No exploit published1 Outside Waratek scope2 Not applicable148 Critical1 High77 Medium64 Low9 not blocked151 Exploited3 Working exploit published4 Proof of concept only2 No public exploit142 2013235 Protected by Waratek1 Outside Waratek scope3 Not applicable231 Critical7 High104 Medium102 Low22 blocked by ARMR today1 not blocked234 Exploited9 Working exploit published15 No public exploit211 2014211 Protected by Waratek1 Outside Waratek scope4 Not applicable206 Critical13 High56 Medium110 Low32 blocked by ARMR today1 not blocked210 Exploited12 Working exploit published7 Proof of concept only1 Forecast only3 No public exploit188 2015316 No exploit published4 Outside Waratek scope19 Not applicable293 Critical6 High110 Medium174 Low26 not blocked316 Exploited13 Working exploit published6 Proof of concept only1 Forecast only1 No public exploit295 2016303 Protected by Waratek1 No exploit published3 Outside Waratek scope2 Not applicable297 Critical41 High159 Medium92 Low11 blocked by ARMR today1 not blocked302 Exploited9 Working exploit published11 Forecast only3 No public exploit280 201762 Outside Waratek scope2 Not applicable60 Critical11 High32 Medium19 not blocked62 Proof of concept only1 No public exploit61 20184 Not applicable4 High4 not blocked4 No public exploit4 201921 Not applicable21 High9 Medium10 Low2 not blocked21 No public exploit21 202010 Not applicable10 Critical1 High5 Medium4 not blocked10 Working exploit published2 No public exploit8 20211 Not applicable1 High1 not blocked1 No public exploit1 20220 20231 Not applicable1 Medium1 not blocked1 Proof of concept only1
200720092011201320152017201920212023
1,470 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 15 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2022-45155 Medium 2023-03-15 Not applicable Proof of concept only An Improper Handling of Exceptional Conditions vulnerability in obs-service-go_modules of openSUSE Factory allows attackers that can influence the call to the service to delete files and directories on the system of the victim. This issue affects: SUSE openSUSE Factory obs-service-go_modules versions prior to 0.6.1.
CVE-2021-32000 High 2021-07-28 Not applicable No public exploit A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allows local attackers to delete arbitrary files. This issue affects: SUSE Linux Enterprise Server 12 SP3 clone-master-clean-up version 1.6-4.6.1 and prior versions. SUSE Linux Enterprise Server 15 SP1 clone-master-clean-up version 1.6-3.9.1 and prior versions. openSUSE Factory clone-master-clean-up version 1.6-1.4 and prior versions.
CVE-2013-2637 Medium 2020-02-12 Not applicable Working exploit published A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.
CVE-2014-2030 High 2020-02-06 Not applicable Working exploit published Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-1947.
CVE-2014-1958 High 2020-02-06 Not applicable No public exploit Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-2030.
CVE-2013-3565 Medium 2020-01-31 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) command parameter to requests/vlm_cmd.xml, (2) dir parameter to requests/browse.xml, or (3) URI in a request, which is returned in an error message through share/lua/intf/http.lua.
CVE-2006-7246 Medium 2020-01-27 Not applicable No public exploit NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used.
CVE-2015-5334 Critical 2020-01-23 Not applicable No public exploit Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute arbitrary code via a crafted X.509 certificate, which triggers a stack-based buffer overflow. Note: this vulnerability exists because of an incorrect fix for CVE-2014-3508.
CVE-2015-5333 High 2020-01-23 Not applicable No public exploit Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (memory consumption) via a large number of ASN.1 object identifiers in X.509 certificates.
CVE-2015-2326 Medium 2020-01-14 Not applicable No public exploit The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".
CVE-2015-2325 High 2020-01-14 Not applicable No public exploit The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.
CVE-2012-2142 High 2020-01-09 Not applicable No public exploit The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a terminal emulator.
CVE-2012-2736 Medium 2019-12-26 Not applicable No public exploit In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network.
CVE-2014-8179 High 2019-12-17 Not applicable No public exploit Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.
CVE-2014-8178 Medium 2019-12-17 Not applicable No public exploit Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.
CVE-2014-3495 High 2019-12-13 Not applicable No public exploit duplicity 0.6.24 has improper verification of SSL certificates
CVE-2014-2387 Medium 2019-12-13 Not applicable No public exploit Pen 0.18.0 has Insecure Temporary File Creation vulnerabilities
CVE-2013-7370 Medium 2019-12-11 Not applicable No public exploit node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
CVE-2016-1000104 High 2019-12-03 Not applicable No public exploit A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.
CVE-2013-2625 Medium 2019-11-27 Not applicable No public exploit An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8. Access rights by the object linking mechanism is not verified
CVE-2012-6655 Low 2019-11-27 Not applicable No public exploit An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain encrypted passwords.
CVE-2011-1588 High 2019-11-14 Not applicable No public exploit Thunar before 1.3.1 could crash when copy and pasting a file name with % format characters due to a format string error.
CVE-2011-1490 Medium 2019-11-14 Not applicable No public exploit A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset
CVE-2011-1489 Medium 2019-11-14 Not applicable No public exploit A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages were logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset.
CVE-2011-1488 Medium 2019-11-14 Not applicable No public exploit A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled. A local attacker could use this flaw to cause a denial of the rsyslogd daemon service by crashing the service via a sequence of repeated log messages sent within short periods of time.
CVE-2011-1145 High 2019-11-14 Not applicable No public exploit The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string.
CVE-2010-4661 High 2019-11-13 Not applicable No public exploit udisks before 1.0.3 allows a local user to load arbitrary Linux kernel modules.
CVE-2016-4983 Low 2019-11-05 Not applicable No public exploit A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.
CVE-2013-6365 Medium 2019-11-05 Not applicable No public exploit Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions
CVE-2017-5333 High 2019-11-04 Not applicable No public exploit Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) or execute arbitrary code via a crafted executable file.
CVE-2017-5332 High 2019-11-04 Not applicable No public exploit The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
CVE-2017-5331 High 2019-11-04 Not applicable No public exploit Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.
CVE-2013-3718 Medium 2019-11-01 Not applicable No public exploit evince is missing a check on number of pages which can lead to a segmentation fault
CVE-2017-3224 High 2018-07-24 Not applicable No public exploit Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement (LSA) recency for LSAs with MaxSequenceNumber. According to RFC 2328 section 13.1, for two instances of the same LSA, recency is determined by first comparing sequence numbers, then checksums, and finally MaxAge. In a case where the sequence numbers are the same, the LSA with the larger checksum is considered more recent, and will not be flushed from the Link State Database (LSDB). Since the RFC does not explicitly state that the values of links carried by a LSA must be the same when prematurely aging a self-originating LSA with MaxSequenceNumber, it is possible in vulnerable OSPF implementations for an attacker to craft a LSA with MaxSequenceNumber and invalid links that will result in a larger checksum and thus a 'newer' LSA that will not be flushed from the LSDB. Propagation of the crafted LSA can result in the erasure or alteration of the routing tables of routers within the routing domain, creating a denial of service condition or the re-routing of traffic on the network. CVE-2017-3224 has been reserved for Quagga and downstream implementations (SUSE, openSUSE, and Red Hat packages).
CVE-2014-5220 High 2018-06-08 Not applicable No public exploit The mdcheck script of the mdadm package for openSUSE 13.2 prior to version 3.3.1-5.14.1 does not properly sanitize device names, which allows local attackers to execute arbitrary commands as root.
CVE-2014-0158 High 2018-04-10 Not applicable No public exploit Heap-based buffer overflow in the JPEG2000 image tile decoder in OpenJPEG before 1.5.2 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file because of incorrect j2k_decode, j2k_read_eoc, and tcd_decode_tile interaction, a related issue to CVE-2013-6045. NOTE: this is not a duplicate of CVE-2013-1447, because the scope of CVE-2013-1447 was specifically defined in http://openwall.com/lists/oss-security/2013/12/04/6 as only "null pointer dereferences, division by zero, and anything that would just fit as DoS."
CVE-2016-5314 High 2018-03-12 Not applicable No public exploit Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by overwriting the vgetparent function pointer with rgb2ycbcr.
CVE-2016-1254 High 2017-12-05 Not applicable No public exploit Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.
CVE-2014-4616 Medium 2017-08-24 Not applicable No public exploit Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.
CVE-2011-0469 Critical 2017-08-17 Not applicable No public exploit Code injection in openSUSE when running some source services used in the open build service 2.1 before March 11 2011.
CVE-2014-3462 High 2017-08-07 Not applicable No public exploit The ".encfs6.xml" configuration file in encfs before 1.7.5 allows remote attackers to access sensitive data by setting "blockMACBytes" to 0 and adding 8 to "blockMACRandBytes".
CVE-2015-5203 Medium 2017-08-02 Not applicable No public exploit Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
CVE-2015-5221 Medium 2017-07-25 Not applicable No public exploit Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
CVE-2015-5300 High 2017-07-21 Not applicable No public exploit The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).
CVE-2014-8127 Medium 2017-06-26 Not applicable No public exploit LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted TIFF image to the (1) checkInkNamesString function in tif_dir.c in the thumbnail tool, (2) compresscontig function in tiff2bw.c in the tiff2bw tool, (3) putcontig8bitCIELab function in tif_getimage.c in the tiff2rgba tool, LZWPreDecode function in tif_lzw.c in the (4) tiff2ps or (5) tiffdither tool, (6) NeXTDecode function in tif_next.c in the tiffmedian tool, or (7) TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool.
CVE-2016-9843 Critical 2017-05-23 Outside Waratek scope No public exploit The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
CVE-2016-9842 High 2017-05-23 Not applicable No public exploit The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
CVE-2016-9841 Critical 2017-05-23 Not applicable No public exploit inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
CVE-2016-9840 High 2017-05-23 Outside Waratek scope No public exploit inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
CVE-2016-5178 Critical 2017-05-23 Not applicable No public exploit Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.143 allow remote attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVE-2016-5177 High 2017-05-23 Not applicable No public exploit Use-after-free vulnerability in V8 in Google Chrome before 53.0.2785.143 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via unknown vectors.
CVE-2016-2347 High 2017-04-21 Not applicable No public exploit Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a crafted archive.
CVE-2016-4068 Medium 2017-04-13 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.
CVE-2015-8864 Medium 2017-04-13 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.
CVE-2015-8567 High 2017-04-13 Not applicable No public exploit Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).
CVE-2016-9959 High 2017-04-12 Not applicable No public exploit game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.
CVE-2016-9958 High 2017-04-12 Not applicable No public exploit game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations.
CVE-2016-9957 High 2017-04-12 Not applicable No public exploit Stack-based buffer overflow in game-music-emu before 0.6.1.
CVE-2014-9114 High 2017-03-31 Not applicable Proof of concept only Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.
CVE-2014-9851 High 2017-03-20 Not applicable No public exploit ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (application crash).
CVE-2014-9850 High 2017-03-20 Not applicable No public exploit Logic error in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (resource consumption).
CVE-2014-9849 High 2017-03-20 Not applicable No public exploit The png coder in ImageMagick allows remote attackers to cause a denial of service (crash).
CVE-2014-9848 High 2017-03-20 Not applicable No public exploit Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption).
CVE-2014-9847 Critical 2017-03-20 Not applicable No public exploit The jng decoder in ImageMagick 6.8.9.9 allows remote attackers to have an unspecified impact.
CVE-2014-9846 Critical 2017-03-20 Not applicable No public exploit Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact.
CVE-2014-9845 Medium 2017-03-20 Not applicable No public exploit The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib file.
CVE-2014-9844 Medium 2017-03-20 Not applicable No public exploit The ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image file.
CVE-2014-9843 Critical 2017-03-20 Not applicable No public exploit The DecodePSDPixels function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors.
CVE-2014-9842 High 2017-03-20 Not applicable No public exploit Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVE-2014-9841 Critical 2017-03-20 Not applicable No public exploit The ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors, related to "throwing of exceptions."
CVE-2014-9854 High 2017-03-17 Not applicable No public exploit coders/tiff.c in ImageMagick allows remote attackers to cause a denial of service (application crash) via vectors related to the "identification of image."
CVE-2014-9853 Medium 2017-03-17 Not applicable No public exploit Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file.
CVE-2014-9852 Critical 2017-03-17 Not applicable No public exploit distribute-cache.c in ImageMagick re-uses objects after they have been destroyed, which allows remote attackers to have unspecified impact via unspecified vectors.
CVE-2016-7972 High 2017-03-03 Not applicable No public exploit The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory allocation failure) via unspecified vectors.
CVE-2016-7969 High 2017-03-03 Not applicable No public exploit The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to "0/3 line wrapping equalization."
CVE-2016-9830 Medium 2017-03-01 Not applicable No public exploit The MagickRealloc function in memory.c in Graphicsmagick 1.3.25 allows remote attackers to cause a denial of service (crash) via large dimensions in a jpeg image.
CVE-2016-8866 High 2017-02-15 Not applicable No public exploit The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick 7.0.3.3 before 7.0.3.8 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862.
CVE-2016-8693 High 2017-02-15 Not applicable No public exploit Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.
CVE-2016-8684 High 2017-02-15 Not applicable No public exploit The MagickMalloc function in magick/memory.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file."
CVE-2016-8683 High 2017-02-15 Not applicable No public exploit The ReadPCXImage function in coders/pcx.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file."
CVE-2016-8682 High 2017-02-15 Not applicable No public exploit The ReadSCTImage function in coders/sct.c in GraphicsMagick 1.3.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SCT header.
CVE-2016-8677 High 2017-02-15 Not applicable No public exploit The AcquireQuantumPixels function in MagickCore/quantum.c in ImageMagick before 7.0.3-1 allows remote attackers to have unspecified impact via a crafted image file, which triggers a memory allocation failure.
CVE-2016-7800 High 2017-02-06 Not applicable No public exploit Integer underflow in the parse8BIM function in coders/meta.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted 8BIM chunk, which triggers a heap-based buffer overflow.
CVE-2016-7449 High 2017-02-06 Not applicable No public exploit The TIFFGetField function in coders/tiff.c in GraphicsMagick 1.3.24 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a file containing an "unterminated" string.
CVE-2016-7448 High 2017-02-06 Not applicable No public exploit The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vectors involving the header information and the file size.
CVE-2016-7447 Critical 2017-02-06 Not applicable No public exploit Heap-based buffer overflow in the EscapeParenthesis function in GraphicsMagick before 1.3.25 allows remote attackers to have unspecified impact via unknown vectors.
CVE-2016-7446 Critical 2017-02-06 Not applicable No public exploit Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This vulnerability exists due to an incomplete patch for CVE-2016-2317.
CVE-2016-8569 Medium 2017-02-03 Not applicable No public exploit The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
CVE-2016-8568 Medium 2017-02-03 Not applicable No public exploit The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.
CVE-2016-5241 Medium 2017-02-03 Not applicable No public exploit magick/render.c in GraphicsMagick before 1.3.24 allows remote attackers to cause a denial of service (arithmetic exception and application crash) via a crafted svg file.
CVE-2016-2318 Medium 2017-02-03 Not applicable No public exploit GraphicsMagick 1.3.23 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted SVG file, related to the (1) DrawImage function in magick/render.c, (2) SVGStartElement function in coders/svg.c, and (3) TraceArcPath function in magick/render.c.
CVE-2016-2317 Medium 2017-02-03 Not applicable No public exploit Multiple buffer overflows in GraphicsMagick 1.3.23 allow remote attackers to cause a denial of service (crash) via a crafted SVG file, related to the (1) TracePoint function in magick/render.c, (2) GetToken function in magick/utility.c, and (3) GetTransformTokens function in coders/svg.c.
CVE-2015-7976 Medium 2017-01-30 Not applicable No public exploit The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.
CVE-2016-9453 High 2017-01-27 Not applicable No public exploit The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES of length one.
CVE-2016-9448 High 2017-01-27 Not applicable No public exploit The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by setting the tags TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII to values that access 0-byte arrays. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9297.
CVE-2016-5323 High 2017-01-20 Not applicable No public exploit The _TIFFFax3fillruns function in libtiff before 4.0.6 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted Tiff image.
CVE-2016-5321 Medium 2017-01-20 Not applicable No public exploit The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service (invalid read and crash) via a crafted tiff image.
CVE-2016-5317 Medium 2017-01-20 Not applicable No public exploit Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlier, as used in GNOME nautilus, allows attackers to cause a denial of service attack (crash) via a crafted TIFF file.
CVE-2016-5316 Medium 2017-01-20 Not applicable No public exploit Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application by sending a crafted TIFF image to the rgb2ycbcr tool.
CVE-2016-7787 Medium 2016-12-23 Not applicable No public exploit A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user.
‹ prev page 1 of 15 next ›