Low-severity CVEs (page 96)
Page 96 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-7677 | Low | 3.5 | 2018-03-14 | A CSRF exposure exists in NetIQ Access Manager (NAM) 4.4 Identity Server component. |
CVE-2017-17282 | Low | 3.1 | 2018-03-09 | SCCP (Signalling Connection Control Part) module in Huawei DP300 V500R002C00, RP200 V500R002C00, V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40… |
CVE-2016-0275 | Low | 3.3 | 2018-03-09 | IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Se… |
CVE-2017-17330 | Low | 3.3 | 2018-03-09 | Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V50… |
CVE-2017-17329 | Low | 3.3 | 2018-03-09 | Huawei ViewPoint 8660 V100R008C03 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML Schema data. An auth… |
CVE-2017-17325 | Low | 3.7 | 2018-03-09 | Huawei video applications HiCinema with software of 8.0.3.308; 8.0.4.300 have a permission control vulnerability. Due to improper verification of specific inte… |
CVE-2017-17321 | Low | 3.3 | 2018-03-09 | Huawei eNSP software with software of versions earlier than V100R002C00B510 has a buffer overflow vulnerability. Due to the improper validation of specific com… |
CVE-2017-17280 | Low | 3.5 | 2018-03-09 | NFC (Near Field Communication) module in Huawei mobile phones with software LON-AL00BC00 has an information leak vulnerability. The attacker has to trick a use… |
CVE-2017-17149 | Low | 3.9 | 2018-03-09 | Huawei HiWallet App with the versions before 8.0.4 has an arbitrary lock pattern change vulnerability. It needs to verify the user's Huawei ID during lock patt… |
CVE-2018-0218 | Low | 3.3 | 2018-03-08 | A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker… |
CVE-2018-0207 | Low | 3.3 | 2018-03-08 | A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker… |
CVE-2018-7675 | Low | 2.8 | 2018-03-07 | In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log ou… |
CVE-2018-5730 | Low | 3.8 | 2018-03-06 | MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by s… |
CVE-2017-8164 | Low | 3.3 | 2018-03-05 | Some Huawei smart phones with software EVA-L09C34B142; EVA-L09C40B196; EVA-L09C432B210; EVA-L09C440B138; EVA-L09C464B150; EVA-L09C530B127; EVA-L09C55B190; EVA-… |
CVE-2017-17141 | Low | 3.7 | 2018-03-05 | Huawei S12700 V200R005C00; V200R006C00; V200R007C00; V200R007C01; V200R007C20; V200R008C00; V200R009C00;S1700 V200R006C10; V200R009C00;S2700 V100R006C03; V200R… |
CVE-2017-9279 | Low | 2.0 | 2018-03-02 | NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes handling of the User Application Admini… |
CVE-2017-9278 | Low | 3.3 | 2018-03-02 | The NetIQ Identity Manager Oracle EBS driver before 4.0.2.0 sent EBS logs containing the driver authentication password, potentially disclosing this to attacke… |
CVE-2017-7434 | Low | 3.3 | 2018-03-02 | In the JDBC driver of NetIQ Identity Manager before 4.6 sending out incorrect XML configurations could result in passwords being logged into exception logfiles. |
CVE-2017-9271 | Low | 3.3 | 2018-03-01 | The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used. |
CVE-2017-15136 | Low | 2.7 | 2018-02-27 | When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the hostname of a previously registered syst… |
CVE-2017-18196 | Low | 3.3 | 2018-02-23 | Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow loca… |
CVE-2018-1392 | Low | 3.1 | 2018-02-22 | IBM Financial Transaction Manager 3.0.4 and 3.1.0 for ACH Services for Multi-Platform could allow an authenticated user to execute a specially crafted command… |
CVE-2018-7289 | Low | 3.3 | 2018-02-21 | An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames containing pure UTF-16 characters can bypas… |
CVE-2016-0369 | Low | 2.7 | 2018-02-21 | XML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6 allows remote authenticated users to obtain sensitive information v… |
CVE-2016-0366 | Low | 3.7 | 2018-02-21 | IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 might allow remote attackers to obtain sensitive information by leveraging… |
CVE-2016-0351 | Low | 3.7 | 2018-02-21 | IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 does not set the secure flag for the session cookie in an HTTPS session, wh… |
CVE-2016-8535 | Low | 3.5 | 2018-02-15 | A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found. |
CVE-2017-17302 | Low | 3.3 | 2018-02-15 | Huawei DP300 V500R002C00, RP200 V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V10… |
CVE-2017-17294 | Low | 3.3 | 2018-02-15 | Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R00… |
CVE-2017-17293 | Low | 3.3 | 2018-02-15 | Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R00… |
CVE-2017-17292 | Low | 3.3 | 2018-02-15 | Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R00… |
CVE-2017-17289 | Low | 3.3 | 2018-02-15 | Huawei DP300 V500R002C00, RP200 V500R002C00, V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006… |
CVE-2017-15353 | Low | 3.7 | 2018-02-15 | Huawei DP300, V500R002C00, RP200, V500R002C00, V600R006C00, RSE6500, V500R002C00, TE30, V100R001C02, V100R001C10, V500R002C00, V600R006C00, TE40, V500R002C00… |
CVE-2017-15352 | Low | 3.1 | 2018-02-15 | Huawei OceanStor 2800 V3, V300R003C00, V300R003C20, OceanStor 5300 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor 5500 V3, V300R003C00, V300R003C10, V300… |
CVE-2017-15339 | Low | 3.7 | 2018-02-15 | The SIP module in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW Module V… |
CVE-2017-15338 | Low | 3.7 | 2018-02-15 | The SIP module in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW Module V… |
CVE-2017-15337 | Low | 3.7 | 2018-02-15 | The SIP module in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW Module V… |
CVE-2017-12723 | Low | 3.7 | 2018-02-15 | A Password in Configuration File issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump stor… |
CVE-2018-0853 | Low | 3.3 | 2018-02-15 | Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow an information discl… |
CVE-2018-0763 | Low | 3.1 | 2018-02-15 | Microsoft Edge in Microsoft Windows 10 1703 and 1709 allows information disclosure, due to how Edge handles objects in memory, aka "Microsoft Edge Information… |
CVE-2017-15709 | Low | 3.7 | 2018-02-13 | When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed… |
CVE-2018-1000030 | Low | 3.6 | 2018-02-08 | Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears t… |
CVE-2018-6382 | Low | 3.3 | 2018-01-30 | MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP ad… |
CVE-2017-1000401 | Low | 2.2 | 2018-01-26 | The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API ke… |
CVE-2018-1000003 | Low | 3.7 | 2018-01-22 | Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some… |
CVE-2018-1000002 | Low | 3.7 | 2018-01-22 | Improper input validation bugs in DNSSEC validators components in Knot Resolver (prior version 1.5.2) allow attacker in man-in-the-middle position to deny exis… |
CVE-2018-0109 | Low | 2.7 | 2018-01-18 | A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access sensitive data about the application. An attacker could… |
CVE-2018-0106 | Low | 3.3 | 2018-01-18 | A vulnerability in the ConfD server of the Cisco Elastic Services Controller (ESC) could allow an unauthenticated, local attacker to access sensitive informati… |
CVE-2018-2675 | Low | 3.7 | 2018-01-18 | Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported version that is affected is Java Advanc… |
CVE-2018-2579 | Low | 3.7 | 2018-01-18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE… |
CVE-2018-2575 | Low | 2.0 | 2018-01-18 | Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, and 12.2.0.1. Difficult to ex… |
CVE-2018-5693 | Low | 3.3 | 2018-01-14 | The LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover mailbox names by reading /var/log/magicspam/mslog. |
CVE-2017-2158 | Low | 3.3 | 2018-01-12 | Improper verification when expanding ZIP64 archives in Lhaplus versions 1.73 and earlier may lead to unintended contents to be extracted from a specially craft… |
CVE-2017-1681 | Low | 3.3 | 2018-01-11 | IBM WebSphere Application Server (IBM Liberty for Java for Bluemix 3.15) could allow a local attacker to obtain sensitive information, caused by improper handl… |
CVE-2017-1478 | Low | 3.3 | 2018-01-11 | IBM Security Access Manager Appliance 9.0.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 128613. |
CVE-2018-5278 | Low | 3.3 | 2018-01-08 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2017-1699 | Low | 3.3 | 2018-01-04 | IBM MQ Managed File Transfer Agent 8.0 and 9.0 sets insecure permissions on certain files it creates. A local attacker could exploit this vulnerability to modi… |
CVE-2017-1669 | Low | 3.7 | 2018-01-04 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized part… |
CVE-2017-17864 | Low | 3.3 | 2017-12-27 | kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, whi… |
CVE-2017-15321 | Low | 3.7 | 2017-12-22 | Huawei FusionSphere OpenStack V100R006C000SPC102 (NFV) has an information leak vulnerability due to the use of a low version transmission protocol by default… |
CVE-2017-15307 | Low | 2.3 | 2017-12-22 | Huawei Honor 8 smartphone with software versions earlier than FRD-L04C567B389 and earlier than FRD-L14C567B389 have a permission control vulnerability due to i… |
CVE-2017-17807 | Low | 3.3 | 2017-12-20 | The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default request-key keyring" via… |
CVE-2017-1270 | Low | 3.3 | 2017-12-20 | IBM Security Guardium 10.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. Th… |
CVE-2017-1261 | Low | 3.3 | 2017-12-20 | IBM Security Guardium 10.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 124736. |
CVE-2017-15530 | Low | 3.3 | 2017-12-13 | Prior to 4.4.1.10, the Norton Family Android App can be susceptible to an Information Disclosure issue. Information disclosure is a very common issue that atta… |
CVE-2017-1716 | Low | 3.3 | 2017-12-13 | IBM Tivoli Workload Scheduler 8.6.0, 9.1.0, and 9.2.0 could disclose sensitive information to a local attacker due to improper permission settings. IBM X-Force… |
CVE-2017-15897 | Low | 3.1 | 2017-12-11 | Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified… |
CVE-2017-1497 | Low | 3.7 | 2017-12-07 | IBM Sterling File Gateway 2.2 could allow an unauthorized user to view files they should not have access to providing they know the directory location of the f… |
CVE-2017-1355 | Low | 3.7 | 2017-12-07 | IBM Atlas eDiscovery Process Management 6.0.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties h… |
CVE-2017-1353 | Low | 3.5 | 2017-12-07 | IBM Atlas eDiscovery Process Management 6.0.3 could allow an authenticated attacker to obtain sensitive information when an unsuspecting user clicks on unsafe… |
CVE-2017-1341 | Low | 3.7 | 2017-12-07 | IBM WebSphere MQ 8.0 and 9.0 could allow, under special circumstances, an unauthorized user to access an object which they should have been denied access. IBM… |
CVE-2017-17433 | Low | 3.7 | 2017-12-06 | The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before… |
CVE-2017-8822 | Low | 3.7 | 2017-12-03 | In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, relays (that have incomple… |
CVE-2017-8118 | Low | 2.3 | 2017-11-22 | The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sensitive information… |
CVE-2017-2739 | Low | 3.1 | 2017-11-22 | The upgrade package of Huawei Vmall APP Earlier than HwVmall 1.5.3.0 versions is transferred through HTTP. A man in the middle (MITM) can tamper with the upgra… |
CVE-2017-2730 | Low | 3.5 | 2017-11-22 | HUAWEI HiLink APP (for IOS) versions earlier before 5.0.25.306 and HUAWEI Tech Support APP (for IOS) versions earlier before 5.0.0 have an information leak vul… |
CVE-2017-2705 | Low | 2.4 | 2017-11-22 | Huawei P9 smartphones with software versions earlier before EVA-AL10C00B365, versions earlier before EVA-AL00C00B365, versions earlier before EVA-CL00C92B365… |
CVE-2017-2701 | Low | 3.3 | 2017-11-22 | Mate 9 with software MHA-AL00AC00B125 has a denial of service (DoS) vulnerability. An attacker tricks a user into installing a malicious application. Since the… |
CVE-2017-2694 | Low | 3.3 | 2017-11-22 | The AlarmService component in HwVmall with software earlier than 1.5.2.0 versions has no control over calling permissions, allowing any third party to call. An… |
CVE-2017-15528 | Low | 3.7 | 2017-11-22 | Prior to v 7.6, the Install Norton Security (INS) product can be susceptible to a certificate spoofing vulnerability, which is a type of attack whereby a malic… |
CVE-2017-1088 | Low | 3.3 | 2017-11-16 | In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24, the kernel does not properly clear the me… |
CVE-2017-1086 | Low | 3.3 | 2017-11-16 | In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24, not all information in the struct ptrace_… |
CVE-2017-11874 | Low | 3.1 | 2017-11-15 | Microsoft Edge in Microsoft Windows 10 1703, 1709, Windows Server, version 1709, and ChakraCore allows an attacker to bypass Control Flow Guard (CFG) to run ar… |
CVE-2017-11850 | Low | 2.5 | 2017-11-15 | Microsoft Graphics Component in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Window… |
CVE-2017-11833 | Low | 3.1 | 2017-11-15 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to determine the o… |
CVE-2017-11791 | Low | 3.1 | 2017-11-15 | ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, an… |
CVE-2017-11768 | Low | 2.5 | 2017-11-15 | Windows Media Player in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 170… |
CVE-2017-9371 | Low | 2.6 | 2017-11-14 | In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, a loss of integrity vulnerability in the default configuration of the QN… |
CVE-2017-9369 | Low | 3.8 | 2017-11-14 | In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, an information disclosure vulnerability in the default configuration of… |
CVE-2017-3893 | Low | 1.9 | 2017-11-14 | In BlackBerry QNX Software Development Platform (SDP) 6.6.0, the default configuration of the QNX SDP system did not in all circumstances prevent attackers fro… |
CVE-2017-3892 | Low | 3.8 | 2017-11-14 | In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an information disclosure vulnerability in the default configuration of the QNX SDP could allow an… |
CVE-2017-13852 | Low | 3.3 | 2017-11-13 | An issue was discovered in certain Apple products. iOS before 11.1 is affected. macOS before 10.13.1 is affected. tvOS before 11.1 is affected. watchOS before… |
CVE-2017-13844 | Low | 2.4 | 2017-11-13 | An issue was discovered in certain Apple products. iOS before 11.1 is affected. The issue involves the "Messages" component. It allows physically proximate att… |
CVE-2017-13805 | Low | 2.4 | 2017-11-13 | An issue was discovered in certain Apple products. iOS before 11.1 is affected. The issue involves the "Siri" component. It allows physically proximate attacke… |
CVE-2017-13801 | Low | 3.3 | 2017-11-13 | An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Dictionary Widget" component. It allows attackers… |
CVE-2017-1000242 | Low | 3.3 | 2017-11-01 | Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure |
CVE-2017-5084 | Low | 3.3 | 2017-10-27 | Inappropriate implementation in image-burner in Google Chrome OS prior to 59.0.3071.92 allowed a local attacker to read local files via dbus-send commands to a… |
CVE-2017-5081 | Low | 3.3 | 2017-10-27 | Lack of verification of an extension's locale folder in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed… |
CVE-2017-1228 | Low | 3.7 | 2017-10-26 | IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) could allow a remote attacker to obtain sensitive information, caused by the failure to properly… |
CVE-2017-15096 | Low | 3.3 | 2017-10-26 | A flaw was found in GlusterFS in versions prior to 3.10. A null pointer dereference in send_brick_req function in glusterfsd/src/gf_attach.c may be used to cau… |