Low-severity CVEs (page 95)
Page 95 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2587 | Low | 3.3 | 2018-07-27 | A memory allocation vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the application to crash. |
CVE-2017-2586 | Low | 3.3 | 2018-07-27 | A null pointer dereference vulnerability was found in netpbm before 10.61. A maliciously crafted SVG file could cause the application to crash. |
CVE-2017-2579 | Low | 3.3 | 2018-07-27 | An out-of-bounds read vulnerability was found in netpbm before 10.61. The expandCodeOntoStack() function has an insufficient code value check, so that a malici… |
CVE-2017-12165 | Low | 2.6 | 2018-07-27 | It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request s… |
CVE-2017-7519 | Low | 2.3 | 2018-07-27 | In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstrip… |
CVE-2017-12175 | Low | 3.5 | 2018-07-26 | Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality. |
CVE-2017-7509 | Low | 3.5 | 2018-07-26 | An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1. If the certreq field is not prese… |
CVE-2017-7538 | Low | 3.5 | 2018-07-26 | A cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name c… |
CVE-2018-5538 | Low | 3.7 | 2018-07-25 | On F5 BIG-IP DNS 13.1.0-13.1.0.7, 12.1.3-12.1.3.5, DNS Express / DNS Zones accept NOTIFY messages on the management interface from source IP addresses not list… |
CVE-2017-1544 | Low | 2.4 | 2018-07-20 | IBM Sterling B2B Integrator Standard Edition (IBM Sterling File Gateway 2.2.0 through 2.2.6) caches usernames and passwords in browsers that could be used by a… |
CVE-2018-3084 | Low | 2.8 | 2018-07-18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Shell: Core / Client). Supported versions that are affected are 8.0.11 and prior. Ea… |
CVE-2018-3082 | Low | 2.7 | 2018-07-18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 8.0.11 and prior. Easily expl… |
CVE-2018-3076 | Low | 2.7 | 2018-07-18 | Vulnerability in the PeopleSoft Enterprise CS Financial Aid component of Oracle PeopleSoft Products (subcomponent: ISIR Processing). Supported versions that ar… |
CVE-2018-3069 | Low | 2.7 | 2018-07-18 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process component of Oracle Supply Chain Products Suite (subcomponent: Installation). The su… |
CVE-2018-3066 | Low | 3.3 | 2018-07-18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options). Supported versions that are affected are 5.5.60 and prior, 5.6.40… |
CVE-2018-2952 | Low | 3.7 | 2018-07-18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Supported versions that are affected are Java… |
CVE-2018-2923 | Low | 2.3 | 2018-07-18 | Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: Core Services). The supported version tha… |
CVE-2018-2916 | Low | 2.7 | 2018-07-18 | Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: API frameworks). The supported version th… |
CVE-2018-2906 | Low | 3.7 | 2018-07-18 | Vulnerability in the Hardware Management Pack component of Oracle Sun Systems Products Suite (subcomponent: Ipmitool). The supported version that is affected i… |
CVE-2018-2901 | Low | 3.7 | 2018-07-18 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11.2. Diffi… |
CVE-2018-2767 | Low | 3.1 | 2018-07-18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.5.60 and p… |
CVE-2018-2598 | Low | 3.7 | 2018-07-18 | Vulnerability in the MySQL Workbench component of Oracle MySQL (subcomponent: Workbench: Security: Encryption). Supported versions that are affected are 6.3.10… |
CVE-2018-10871 | Low | 3.8 | 2018-07-18 | 389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog… |
CVE-2018-0361 | Low | 3.3 | 2018-07-16 | ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file. |
CVE-2016-6542 | Low | 3.7 | 2018-07-13 | The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The tracker ID is the d… |
CVE-2017-1367 | Low | 3.7 | 2018-07-13 | IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in URL parameters. This may lead to inform… |
CVE-2018-12461 | Low | 3.5 | 2018-07-10 | Fixed issues with NetIQ eDirectory prior to 9.1.1 when checking certificate revocation. |
CVE-2016-6539 | Low | 3.5 | 2018-07-06 | The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by… |
CVE-2017-1559 | Low | 3.1 | 2018-07-06 | Multiple IBM Rational products could disclose sensitive information by an attacker that intercepts vulnerable requests. IBM X-Force ID: 131758. |
CVE-2017-1488 | Low | 3.7 | 2018-07-06 | An undisclosed vulnerability in Jazz common products exists with potential for information disclosure. IBM X-Force ID: 128627. |
CVE-2017-17317 | Low | 3.7 | 2018-07-02 | Common Open Policy Service Protocol (COPS) module in Huawei USG6300 V100R001C10; V100R001C20; V100R001C30; V500R001C00; V500R001C20; V500R001C30; V500R001C50… |
CVE-2018-13053 | Low | 3.3 | 2018-07-02 | The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because kti… |
CVE-2018-10852 | Low | 3.8 | 2018-06-26 | The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a mess… |
CVE-2017-2669 | Low | 3.7 | 2018-06-21 | Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the I… |
CVE-2018-1120 | Low | 2.8 | 2018-06-20 | A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or… |
CVE-2018-12446 | Low | 3.6 | 2018-06-20 | An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The Passcode feature allows authentication bypass via runtime manipulation t… |
CVE-2018-12445 | Low | 3.1 | 2018-06-20 | An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The FingerprintManager class for Biometric validation allows authentication… |
CVE-2018-1419 | Low | 3.7 | 2018-06-15 | IBM WebSphere MQ 8.0 and 9.0, when configured to use a PAM module for authentication, could allow a user to cause a deadlock in the IBM MQ PAM code which could… |
CVE-2018-1121 | Low | 3.9 | 2018-06-13 | procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric orde… |
CVE-2018-3759 | Low | 3.7 | 2018-06-13 | private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being c… |
CVE-2018-1393 | Low | 3.1 | 2018-06-13 | IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.6 could allow an authenticated user to execute a specially crafted command that could… |
CVE-2017-5387 | Low | 3.3 | 2018-06-11 | The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "source" attribute on a "<track>" tag refe… |
CVE-2016-9062 | Low | 3.3 | 2018-06-11 | Private browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db" and "browser.db-wal" files within the Firefox profile after… |
CVE-2018-4238 | Low | 2.4 | 2018-06-08 | An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Siri" component. It allows physically proximate attacke… |
CVE-2012-0433 | Low | 3.3 | 2018-06-08 | The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local… |
CVE-2016-1000346 | Low | 3.7 | 2018-06-04 | In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be u… |
CVE-2017-12092 | Low | 3.7 | 2018-06-04 | An exploitable file write vulnerability exists in the memory module functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially cr… |
CVE-2016-10538 | Low | 3.5 | 2018-05-31 | The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any f… |
CVE-2018-11567 | Low | 3.3 | 2018-05-30 | Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt feature is designed so that if Alexa do… |
CVE-2018-1369 | Low | 3.7 | 2018-05-29 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorize… |
CVE-2018-8864 | Low | 3.1 | 2018-05-25 | In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, a missing encryption of sensitive data vulnerability caused… |
CVE-2018-8862 | Low | 3.1 | 2018-05-25 | In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, an improper authentication vulnerability caused by specially… |
CVE-2017-3961 | Low | 3.5 | 2018-05-25 | Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to allow… |
CVE-2018-1123 | Low | 3.9 | 2018-05-23 | procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of t… |
CVE-2017-9635 | Low | 3.9 | 2018-05-18 | Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a wea… |
CVE-2017-2603 | Low | 2.6 | 2018-05-15 | Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API token… |
CVE-2017-2602 | Low | 3.1 | 2018-05-15 | jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This c… |
CVE-2018-1118 | Low | 2.3 | 2018-05-10 | Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/v… |
CVE-2018-6254 | Low | 3.3 | 2018-05-10 | In Android before the 2018-05-05 security patch level, NVIDIA Media Server contains an out-of-bounds read (due to improper input validation) vulnerability whic… |
CVE-2018-2419 | Low | 3.7 | 2018-05-09 | SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary autho… |
CVE-2013-4209 | Low | 3.3 | 2018-05-01 | Automatic Bug Reporting Tool (ABRT) before 2.1.6 allows local users to obtain sensitive information about arbitrary files via vectors related to sha1sums. |
CVE-2017-17314 | Low | 3.7 | 2018-04-30 | Huawei DP300 V500R002C00, RP200 V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V10… |
CVE-2017-2591 | Low | 3.7 | 2018-04-30 | 389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness… |
CVE-2018-10521 | Low | 2.7 | 2018-04-27 | In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS… |
CVE-2017-9275 | Low | 2.8 | 2018-04-26 | NetIQ Identity Reporting, in versions prior to 5.5 Service Pack 1, is susceptible to an XSS attack. |
CVE-2018-10424 | Low | 2.7 | 2018-04-26 | mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field. |
CVE-2018-10423 | Low | 2.7 | 2018-04-26 | mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes avai… |
CVE-2018-2831 | Low | 3.8 | 2018-04-19 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.36 and… |
CVE-2018-2792 | Low | 3.8 | 2018-04-19 | Vulnerability in the Hardware Management Pack component of Oracle Sun Systems Products Suite (subcomponent: Ipmitool). The supported version that is affected i… |
CVE-2018-2790 | Low | 3.1 | 2018-04-19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7… |
CVE-2018-2763 | Low | 3.3 | 2018-04-19 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: NTPD). The supported version that is affected is 11.3. Easily exploi… |
CVE-2018-0532 | Low | 2.7 | 2018-04-16 | Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of the Standard database via unspecified… |
CVE-2018-0966 | Low | 3.3 | 2018-04-12 | A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affe… |
CVE-2018-2412 | Low | 3.8 | 2018-04-10 | SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2017-2826 | Low | 3.7 | 2018-04-09 | An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. A specially crafted iConfig proxy request can cause the Zab… |
CVE-2018-1315 | Low | 3.7 | 2018-04-05 | In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to… |
CVE-2018-1284 | Low | 3.7 | 2018-04-05 | In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_float/xpath_long/xpath… |
CVE-2018-1000150 | Low | 3.3 | 2018-04-05 | An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#authContext that allo… |
CVE-2017-6426 | Low | 3.3 | 2018-04-04 | An information disclosure vulnerability in the Qualcomm SPMI driver. Product: Android. Versions: Android kernel. Android ID: A-33644474. References: QC-CR#1106… |
CVE-2017-6425 | Low | 3.3 | 2018-04-04 | An information disclosure vulnerability in the Qualcomm video driver. Product: Android. Versions: Android kernel. Android ID: A-32577085. References: QC-CR#110… |
CVE-2016-10236 | Low | 3.3 | 2018-04-04 | An information disclosure vulnerability in the Qualcomm USB driver. Product: Android. Versions: Android kernel. Android ID: A-33280689. References: QC-CR#11024… |
CVE-2017-3964 | Low | 3.5 | 2018-04-04 | Reflective Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to inje… |
CVE-2018-4123 | Low | 2.4 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves alarm and timer handling in the "Clock" component. It allows… |
CVE-2017-13877 | Low | 3.3 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Sandbox Profiles" component. It allows attackers to deter… |
CVE-2018-6659 | Low | 3.7 | 2018-04-02 | Reflected Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows remote authenticated users to exploit an… |
CVE-2017-1765 | Low | 3.1 | 2018-03-30 | IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the application server. IBM X-… |
CVE-2018-7676 | Low | 3.9 | 2018-03-28 | The NetIQ Identity Manager, in versions prior to 4.7, userapp with log / trace enabled may leak sensitive information. |
CVE-2018-7674 | Low | 2.1 | 2018-03-28 | The NetIQ Identity Manager user console, in versions prior to 4.7, is susceptible to URL redirection. |
CVE-2018-1350 | Low | 2.3 | 2018-03-26 | The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system enumeration. |
CVE-2018-1349 | Low | 2.3 | 2018-03-26 | The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system or configuration enumeration. |
CVE-2015-5045 | Low | 3.3 | 2018-03-26 | The Administration and Reporting tool in IBM Rational License Key Server (RLKS) before 8.1.4.9 iFix 04 allows local users to obtain sensitive information via u… |
CVE-2018-1346 | Low | 3.1 | 2018-03-21 | Addresses denial of service attack to eDirectory versions prior to 9.1. |
CVE-2018-1344 | Low | 3.1 | 2018-03-21 | Addresses potential communication downgrade attack in NetIQ iManager versions prior to 3.1 |
CVE-2015-7449 | Low | 3.3 | 2018-03-20 | IBM Rational Collaborative Lifecycle Management (CLM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; R… |
CVE-2014-2884 | Low | 3.3 | 2018-03-19 | The ProcessVolumeDeviceControlIrp function in Ntdriver.c in TrueCrypt 7.1a allows local users to bypass access restrictions and obtain sensitive information ab… |
CVE-2018-5552 | Low | 2.9 | 2018-03-19 | Versions of DocuTrac QuicDoc and Office Therapy that ship with DTISQLInstaller.exe version 1.6.4.0 and prior contains a hard-coded cryptographic salt, "S@l+&pe… |
CVE-2018-0942 | Low | 2.6 | 2018-03-14 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold… |
CVE-2018-0919 | Low | 3.3 | 2018-03-14 | Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2010 SP2, Microsoft… |
CVE-2018-0878 | Low | 3.1 | 2018-03-14 | Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold… |
CVE-2018-7678 | Low | 3.5 | 2018-03-14 | A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4. |