CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In March 2017

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1201 CVE-2015-8010 79 XSS 2017-03-27 2018-10-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.
1202 CVE-2015-7313 399 DoS 2017-03-17 2017-03-20
4.3
 None Remote Medium Not required None None Partial
LibTIFF allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted tiff file.
1203 CVE-2015-6671 200 +Info 2017-03-13 2020-01-07
4.3
 None Remote Medium Not required Partial None None
Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup.
1204 CVE-2015-5729 200 Bypass +Info 2017-03-23 2017-04-04
5.0
 None Remote Low Not required Partial None None
The Soft Access Point (AP) feature in Samsung Smart TVs X10P, X12, X14H, X14J, and NT14U and Xpress M288OFW printers generate weak WPA2 PSK keys, which makes it easier for remote attackers to obtain sensitive information or bypass authentication via a brute-force attack.
1205 CVE-2015-4645 190 DoS Overflow 2017-03-17 2019-10-24
4.3
 None Remote Medium Not required None None Partial
Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.
1206 CVE-2015-4624 284 CSRF 2017-03-31 2018-10-09
4.3
 None Local Network High Not required Partial Partial Partial
Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.
1207 CVE-2015-4556 20 DoS 2017-03-29 2017-07-01
5.0
 None Remote Low Not required None None Partial
The string-translate* procedure in the data-structures unit in CHICKEN before 4.10.0 allows remote attackers to cause a denial of service (crash).
1208 CVE-2015-4409 119 DoS Overflow 2017-03-13 2017-03-14
6.8
 None Remote Low ??? None None Complete
Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service interruption) via a crafted HTTP request, aka the SDK issue.
1209 CVE-2015-4408 119 DoS Overflow 2017-03-13 2017-03-14
6.8
 None Remote Low ??? None None Complete
Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service interruption) via a crafted HTTP request, aka the ISAPI issue.
1210 CVE-2015-4407 119 DoS Overflow 2017-03-13 2017-03-14
6.8
 None Remote Low ??? None None Complete
Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service interruption) via a crafted HTTP request, aka the PSIA issue.
1211 CVE-2015-4166 320 2017-03-23 2017-03-27
7.5
 None Remote Low Not required Partial Partial Partial
Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vectors related to loss of an encryption key.
1212 CVE-2015-4078 200 +Info 2017-03-23 2017-03-28
3.5
 None Remote Medium ??? Partial None None
Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
1213 CVE-2015-3884 434 Exec Code 2017-03-17 2017-03-20
7.5
 None Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/attachments/ or uploads/users/.
1214 CVE-2015-3883 79 XSS 2017-03-17 2017-03-20
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) search[keywords] parameter to index.php/users page; the (2) "Name of application" on index.php/configuration; (3) a new project name on index.php/projects; (4) the task name on index.php/tasks; (5) ticket name on index.php/tickets; (6) discussion name on index.php/discussions; (7) report name on index.php/projectReports; or (8) event name on index.php/scheduler/personal.
1215 CVE-2015-3882 200 +Info 2017-03-17 2017-03-20
5.0
 None Remote Low Not required Partial None None
qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in an error message.
1216 CVE-2015-3881 200 +Info 2017-03-17 2017-03-20
5.0
 None Remote Low Not required Partial None None
Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) core/log/qdPM_prod.log, or (3) core/apps/qdPM/config/settings.yml.
1217 CVE-2015-2877 200 +Info 2017-03-03 2020-06-04
2.1
 None Local Low Not required Partial None None
** DISPUTED ** Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection mechanism on other guest OS instances via a Cross-VM ASL INtrospection (CAIN) attack. NOTE: the vendor states "Basically if you care about this attack vector, disable deduplication." Share-until-written approaches for memory conservation among mutually untrusting tenants are inherently detectable for information disclosure, and can be classified as potentially misunderstood behaviors rather than vulnerabilities.
1218 CVE-2015-2330 295 2017-03-10 2017-07-01
5.0
 None Remote Low Not required Partial None None
Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
1219 CVE-2015-2263 264 +Info 2017-03-23 2017-03-29
2.1
 None Local Low Not required Partial None None
Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager, which allows local users to obtain sensitive information by reading the files, as demonstrated by yarn.keytab or ssl-server.xml in /var/run/cloudera-scm-agent/process.
1220 CVE-2015-1610 264 2017-03-20 2017-03-23
5.0
 None Remote Low Not required None Partial None
hosttracker in OpenDaylight l2switch allows remote attackers to change the host location information by spoofing the MAC address, aka "topology spoofing."
1221 CVE-2015-0864 264 Exec Code +Info 2017-03-27 2017-04-04
7.9
 None Local Network Medium Not required Complete Complete Complete
Samsung Account (AKA com.osp.app.signin) before 1.6.0069 and 2.x before 2.1.0069 allows man-in-the-middle attackers to obtain sensitive information and execute arbitrary code.
1222 CVE-2015-0863 264 Exec Code +Info 2017-03-27 2017-04-04
7.9
 None Local Network Medium Not required Complete Complete Complete
GALAXY Apps (aka Samsung Apps, Samsung Updates, or com.sec.android.app.samsungapps) before 14120405.03.012 allows man-in-the-middle attackers to obtain sensitive information and execute arbitrary code.
1223 CVE-2015-0855 94 Exec Code 2017-03-23 2017-04-04
10.0
 None Remote Low Not required Complete Complete Complete
The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters in a file path.
1224 CVE-2014-9939 119 Overflow 2017-03-21 2017-03-22
7.5
 None Remote Low Not required Partial Partial Partial
ihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects.
1225 CVE-2014-9938 116 Exec Code 2017-03-20 2020-04-29
6.8
 None Remote Medium Not required Partial Partial Partial
contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code execution.
1226 CVE-2014-9921 264 2017-03-14 2017-03-23
9.7
 None Remote Low Not required Complete Complete Partial
Information disclosure vulnerability in McAfee (now Intel Security) Cloud Analysis and Deconstructive Services (CADS) 1.0.0.3x, 1.0.0.4d and earlier allows remote unauthenticated users to view, add, and remove users via a configuration error.
1227 CVE-2014-9920 284 2017-03-14 2017-03-29
4.3
 None Remote Medium Not required None Partial None
Unauthorized execution of binary vulnerability in McAfee (now Intel Security) McAfee Application Control (MAC) 6.0.0 before hotfix 9726, 6.0.1 before hotfix 9068, 6.1.0 before hotfix 692, 6.1.1 before hotfix 399, 6.1.2 before hotfix 426, and 6.1.3 before hotfix 357 and earlier allows attackers to create a malformed Windows binary that is considered non-executable and is not protected through the whitelisting protection feature via a specific set of circumstances.
1228 CVE-2014-9915 189 DoS 2017-03-23 2017-03-24
4.3
 None Remote Medium Not required None None Partial
Off-by-one error in ImageMagick before 6.6.0-4 allows remote attackers to cause a denial of service (application crash) via a crafted 8BIM profile.
1229 CVE-2014-9854 399 DoS 2017-03-17 2018-10-30
5.0
 None Remote Low Not required None None Partial
coders/tiff.c in ImageMagick allows remote attackers to cause a denial of service (application crash) via vectors related to the "identification of image."
1230 CVE-2014-9853 399 DoS 2017-03-17 2018-10-30
4.3
 None Remote Medium Not required None None Partial
Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file.
1231 CVE-2014-9852 913 2017-03-17 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
distribute-cache.c in ImageMagick re-uses objects after they have been destroyed, which allows remote attackers to have unspecified impact via unspecified vectors.
1232 CVE-2014-9851 20 DoS 2017-03-20 2018-10-30
5.0
 None Remote Low Not required None None Partial
ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (application crash).
1233 CVE-2014-9850 399 DoS 2017-03-20 2018-10-30
5.0
 None Remote Low Not required None None Partial
Logic error in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (resource consumption).
1234 CVE-2014-9849 400 DoS 2017-03-20 2018-10-30
5.0
 None Remote Low Not required None None Partial
The png coder in ImageMagick allows remote attackers to cause a denial of service (crash).
1235 CVE-2014-9848 399 DoS 2017-03-20 2018-10-30
5.0
 None Remote Low Not required None None Partial
Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption).
1236 CVE-2014-9847 119 Overflow 2017-03-20 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
The jng decoder in ImageMagick 6.8.9.9 allows remote attackers to have an unspecified impact.
1237 CVE-2014-9846 119 Overflow 2017-03-20 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact.
1238 CVE-2014-9845 119 DoS Overflow 2017-03-20 2018-10-30
4.3
 None Remote Medium Not required None None Partial
The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib file.
1239 CVE-2014-9844 125 DoS 2017-03-20 2018-10-30
4.3
 None Remote Medium Not required None None Partial
The ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image file.
1240 CVE-2014-9843 119 Overflow 2017-03-20 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
The DecodePSDPixels function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors.
1241 CVE-2014-9842 400 DoS 2017-03-20 2018-10-30
5.0
 None Remote Low Not required None None Partial
Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
1242 CVE-2014-9841 388 2017-03-20 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
The ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors, related to "throwing of exceptions."
1243 CVE-2014-9840 119 DoS Overflow 2017-03-22 2017-03-24
4.3
 None Remote Medium Not required None None Partial
ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted palm file.
1244 CVE-2014-9839 119 DoS Overflow 2017-03-22 2017-03-24
5.0
 None Remote Low Not required None None Partial
magick/colormap-private.h in ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (out-of-bounds access).
1245 CVE-2014-9838 DoS 2017-03-22 2017-03-24
4.3
 None Remote Medium Not required None None Partial
magick/cache.c in ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service (crash).
1246 CVE-2014-9836 119 DoS Overflow 2017-03-22 2017-03-24
4.3
 None Remote Medium Not required None None Partial
ImageMagick 6.8.9-9 allows remote attackers to cause a denial of service via a crafted xpm file.
1247 CVE-2014-9835 119 Overflow 2017-03-22 2017-03-24
6.8
 None Remote Medium Not required Partial Partial Partial
Heap overflow in ImageMagick 6.8.9-9 via a crafted wpf file.
1248 CVE-2014-9834 119 Overflow 2017-03-22 2017-03-24
6.8
 None Remote Medium Not required Partial Partial Partial
Heap overflow in ImageMagick 6.8.9-9 via a crafted pict file.
1249 CVE-2014-9833 119 Overflow 2017-03-22 2017-03-24
6.8
 None Remote Medium Not required Partial Partial Partial
Heap overflow in ImageMagick 6.8.9-9 via a crafted psd file.
1250 CVE-2014-9832 119 Overflow 2017-03-22 2017-03-24
6.8
 None Remote Medium Not required Partial Partial Partial
Heap overflow in ImageMagick 6.8.9-9 via a crafted pcx file.
Total number of vulnerabilities : 1305   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 (This Page)26 27
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.