5520 matches found
Vulnerable Through Use Of C Library
Nokogiri is vulnerable to denial of service DoS attacks. These attacks are possible through the use and inclusion of the C library libxml2. This library is vulnerable to CVE-2016-4483. It might also be a duplicate of CVE-2016-3627...
CVE-2017-7469
This CVE entry is rejected and not used; reference CVE-2017-7466 instead.
Out-of-bounds
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service out-of-bounds read and application crash via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627...
CVE-2016-4483
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service out-of-bounds read and application crash via a non-UTF-8 attribute value, related to serialization. NOTE: this vulnerability may be a duplicate of CVE-2016-3627...
Code injection
PivotX 2.3.11 allows remote authenticated Advanced users to execute arbitrary PHP code by performing an upload with a safe file extension such as .jpg and then invoking the duplicate function to change to the .php extension...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10226. Reason: This candidate is a reservation duplicate of CVE-2016-10226. Notes: All CVE users should reference CVE-2016-10226 instead of this candidate. All references and descriptions in this candidate have been removed t...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-7510. Reason: This candidate is a reservation duplicate of CVE-2016-7510. Notes: All CVE users should reference CVE-2016-7510 instead of this candidate. All references and descriptions in this candidate have been removed to...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10209. Reason: This candidate is a reservation duplicate of CVE-2016-10209. Notes: All CVE users should reference CVE-2016-10209 instead of this candidate. All references and descriptions in this candidate have been removed t...
CVE-2016-1000268
This CVE-2016-1000268 entry is rejected/not used and does not represent an active vulnerability.
CVE-2016-1000349
CVE-2016-10209 affects libarchive (archive_wstring_append_from_mbs) with a NULL pointer dereference that can crash the application via specially crafted archives (DoS). Multiple advisories cite this issue within libarchive versions around 3.x. Debian DSA-4360-1 fixes the flaw in stretch, upgradin...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10222. Reason: This candidate is a reservation duplicate of CVE-2016-10222. Notes: All CVE users should reference CVE-2016-10222 instead of this candidate. All references and descriptions in this candidate have been removed t...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10211. Reason: This candidate is a reservation duplicate of CVE-2016-10211. Notes: All CVE users should reference CVE-2016-10211 instead of this candidate. All references and descriptions in this candidate have been removed t...
CVE-2016-1000348
CVE-2016-1000348 is rejected/not used and does not represent an active vulnerability entry; please reference CVE-2016-10211.
Gratipay: Content-Length restriction bypass to heap overflow in gip.rocks.
I started playing around with a0xnirudh's Content-Length restriction bypass and noticed that when combined with a different vulnerability this could be leveraged to do a bit more than DoS. We decided to open a new ticket to address this issue, since we were already aware of the bypass. a0xnirudh...
CVE-2017-2656
CVE-2016-6320 is a cross-site scripting (XSS) vulnerability in Foreman prior to 1.12.2, exploitable by remote authenticated users via the network interface device identifier in the host interface form (host_edit_interfaces.js). Affected product: Foreman before 1.12.2. Root cause: input handling i...
CVE-2016-9571
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9606. Reason: This candidate is a duplicate of CVE-2016-9606. Reason: this ID was intended for one issue, but was associated with two issues. Notes: All CVE users should reference CVE-2016-9606 instead of this candidate. All...
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9606. Reason: This candidate is a duplicate of CVE-2016-9606. Reason: this ID was intended for one issue, but was associated with two issues. Notes: All CVE users should reference CVE-2016-9606 instead of this candidate. All...
UBUNTU-CVE-2016-9571
REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9606. Reason: This candidate is a duplicate of CVE-2016-9606. Reason: this ID was intended for one issue, but was associated with two issues. Notes: All CVE users should reference CVE-2016-9606 instead of this candidate. All references...
CVE-2016-9571
CVE-2016-9571 is a duplicate of CVE-2016-9606 and does not describe a distinct vulnerability entry. The connected data confirms that CVE-2016-9606 affects JBoss RESTEasy prior to 3.1.2, where YamlProvider could force YAML unmarshalling via Yaml.load(), potentially allowing arbitrary code executio...