Low-severity CVEs (page 98)
Page 98 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-0159 | Low | 3.7 | 2017-04-12 | A security feature bypass vulnerability exists in Windows 10 1607, Windows Server 2012 R2, and Windows 2016 when ADFS incorrectly treats requests coming from E… |
CVE-2017-5607 | Low | 3.5 | 2017-04-10 | Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x befo… |
CVE-2017-5686 | Low | 3.9 | 2017-04-03 | The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version SY0059 may allow may allow an attacker with physical access to the system… |
CVE-2017-5685 | Low | 3.9 | 2017-04-03 | The BIOS in Intel NUC systems based on 6th Gen Intel Core processors prior to version KY0045 may allow may allow an attacker with physical access to the system… |
CVE-2017-5684 | Low | 3.9 | 2017-04-03 | The BIOS in Intel Compute Stick systems based on 6th Gen Intel Core processors prior to version CC047 may allow an attacker with physical access to the system… |
CVE-2017-7407 | Low | 2.4 | 2017-04-03 | The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in op… |
CVE-2016-8757 | Low | 3.3 | 2017-04-02 | ION memory management module in Huawei P9 phones with software EVA-AL10C00B192 and earlier versions, EVA-DL10C00B192 and earlier versions, EVA-TL10C00B192 and… |
CVE-2015-2246 | Low | 3.3 | 2017-04-02 | The MeWidget module on Huawei P7 smartphones with software P7-L10 V100R001C00B136 and earlier versions could lead to the disclosure of contact information. |
CVE-2014-8571 | Low | 3.3 | 2017-04-02 | Apps on Huawei Ascend P6 mobile phones with software EDGE-U00 V100R001C17B508SP01 and earlier versions before V100R001C17B508SP02; EDGE-T00 V100R001C01B508SP01… |
CVE-2017-2426 | Low | 3.3 | 2017-04-02 | An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "iBooks" component. It allows remote attackers to o… |
CVE-2017-2404 | Low | 3.3 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Quick Look" component. It allows remote attackers to tr… |
CVE-2017-2397 | Low | 2.4 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Accounts" component. It allows physically proximate att… |
CVE-2017-2384 | Low | 3.3 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves mishandling of deletion within the SQLite subsystem of the "… |
CVE-2017-2383 | Low | 3.1 | 2017-04-02 | An issue was discovered in certain Apple products. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. The issue involves clea… |
CVE-2016-6349 | Low | 3.3 | 2017-03-29 | The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command. |
CVE-2016-9471 | Low | 3.1 | 2017-03-28 | Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver in… |
CVE-2016-6102 | Low | 3.7 | 2017-03-27 | IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties ha… |
CVE-2015-4078 | Low | 3.1 | 2017-03-23 | Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-mid… |
CVE-2015-2263 | Low | 3.3 | 2017-03-23 | Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configur… |
CVE-2013-6446 | Low | 3.1 | 2017-03-23 | The JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5.x before 5.0.0 Beta 2, when using MRv2/YARN with HTTP authentication, allows remote authenticated… |
CVE-2017-5930 | Low | 2.7 | 2017-03-20 | The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delet… |
CVE-2016-9697 | Low | 3.1 | 2017-03-20 | An unspecified vulnerability in IBM Rhapsody DM 4.0, 5.0, and 6.0 could allow an attacker to perform a JSON Hijacking Attack. A JSON Hijacking Attack may expos… |
CVE-2017-0096 | Low | 2.6 | 2017-03-17 | Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2; Windows 10 Gold, 1511, and… |
CVE-2017-0042 | Low | 3.1 | 2017-03-17 | Windows Media Player in Microsoft Windows 8.1; Windows Server 2012 R2; Windows RT 8.1; Windows 7 SP1; Windows 2008 SP2 and R2 SP1, Windows Server 2016; Windows… |
CVE-2016-8016 | Low | 3.4 | 2017-03-14 | Information exposure in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to obtain the existence of u… |
CVE-2017-5985 | Low | 3.3 | 2017-03-14 | lxc-user-nic in Linux Containers (LXC) allows local users with a lxc-usernet allocation to create network interfaces on the host and choose the name of those i… |
CVE-2017-1150 | Low | 3.1 | 2017-03-08 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated attacker with specialized access to tables… |
CVE-2017-1124 | Low | 2.9 | 2017-03-07 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference #: 199805… |
CVE-2017-5865 | Low | 3.7 | 2017-03-03 | The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error message… |
CVE-2015-2877 | Low | 3.3 | 2017-03-03 | Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat… |
CVE-2016-7553 | Low | 3.3 | 2017-02-27 | The buf.pl script before 2.20 in Irssi before 0.8.20 uses weak permissions for the scrollbuffer dump file created between upgrades, which might allow local use… |
CVE-2017-5928 | Low | 3.7 | 2017-02-27 | The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a performance.now "T… |
CVE-2016-9009 | Low | 3.1 | 2017-02-24 | IBM WebSphere MQ 8.0 could allow an authenticated user with authority to create a cluster object to cause a denial of service to MQ clustering. IBM Reference #… |
CVE-2017-2357 | Low | 3.3 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12.3 is affected. The issue involves the "IOAudioFamily" component. It allows attackers to o… |
CVE-2017-2351 | Low | 2.4 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WiFi" component, which allows physically proximate at… |
CVE-2016-7765 | Low | 2.4 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Clipboard" component, which allows physically proximate… |
CVE-2016-7714 | Low | 3.3 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue i… |
CVE-2016-7664 | Low | 2.4 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Accessibility" component. which allows physically proxi… |
CVE-2016-7657 | Low | 3.3 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue i… |
CVE-2016-7653 | Low | 2.4 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Media Player" component, which allows physically proxim… |
CVE-2016-7625 | Low | 3.3 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "IOKit" component. It allows local users to obtain… |
CVE-2016-7624 | Low | 3.3 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "IOAcceleratorFamily" component. It allows local us… |
CVE-2016-7620 | Low | 3.3 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "IOSurface" component. It allows local users to obt… |
CVE-2016-7577 | Low | 3.7 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. The issue involves the "FaceTime" component… |
CVE-2016-4670 | Low | 3.3 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. The issue involves the "Security" component… |
CVE-2016-4665 | Low | 3.3 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue invol… |
CVE-2016-4664 | Low | 3.3 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue invol… |
CVE-2016-9348 | Low | 3.3 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-9338 | Low | 2.7 | 2017-02-13 | An issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 controller 1763-L16AWA, Series A and B, Version 14.000 and prior versions; 1763-L1… |
CVE-2016-8344 | Low | 3.7 | 2017-02-13 | An issue was discovered in Honeywell Experion Process Knowledge System (PKS) platform: Experion PKS, Release 3xx and prior, Experion PKS, Release 400, Experion… |
CVE-2016-0206 | Low | 3.3 | 2017-02-08 | IBM Cloud Orchestrator could allow a local authenticated attacker to cause the server to slow down for a short period of time by using a specially crafted and… |
CVE-2016-0202 | Low | 3.3 | 2017-02-08 | A vulnerability has been identified in tasks, backend object generated for handling any action performed by the application in IBM Cloud Orchestrator. It is po… |
CVE-2015-7494 | Low | 2.8 | 2017-02-08 | A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resour… |
CVE-2016-9085 | Low | 3.3 | 2017-02-03 | Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors. |
CVE-2016-8217 | Low | 3.7 | 2017-02-03 | EMC RSA BSAFE Crypto-J versions prior to 6.2.2 has a PKCS#12 Timing Attack Vulnerability. A possible timing attack could be carried out by modifying a PKCS#12… |
CVE-2016-9703 | Low | 2.4 | 2017-02-01 | IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work stat… |
CVE-2016-6001 | Low | 3.1 | 2017-02-01 | IBM Forms Experience Builder could be susceptible to a server-side request forgery (SSRF) from the application design interface allowing for some information d… |
CVE-2016-5953 | Low | 3.7 | 2017-02-01 | IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permission… |
CVE-2016-5938 | Low | 3.3 | 2017-02-01 | IBM Kenexa LMS on Cloud allows web pages to be stored locally which can be read by another user on the system. |
CVE-2016-8942 | Low | 3.1 | 2017-02-01 | IBM Tivoli Storage Productivity Center could allow an authenticated user with intimate knowledge of the system to edit a limited set of properties on the serve… |
CVE-2016-3046 | Low | 2.7 | 2017-02-01 | IBM Security Access Manager for Web is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements which could allow the attacke… |
CVE-2016-3045 | Low | 3.7 | 2017-02-01 | IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access… |
CVE-2016-3021 | Low | 2.7 | 2017-02-01 | IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specially crafted HTTP req… |
CVE-2016-0394 | Low | 3.3 | 2017-02-01 | IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate certain files. |
CVE-2016-0297 | Low | 3.7 | 2017-02-01 | IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) could allow a remote attacker to obtain sensitive information due to a missing HTTP Strict-Transpo… |
CVE-2016-0296 | Low | 3.3 | 2017-02-01 | IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available to a local user. |
CVE-2015-8034 | Low | 3.3 | 2017-01-30 | The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the… |
CVE-2017-3323 | Low | 3.7 | 2017-01-27 | Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: General). Supported versions that are affected are 7.2.25 and earlier, 7.3… |
CVE-2017-3322 | Low | 3.7 | 2017-01-27 | Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: NDBAPI). Supported versions that are affected are 7.2.25 and earlier, 7.3… |
CVE-2017-3321 | Low | 3.7 | 2017-01-27 | Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: General). Supported versions that are affected are 7.2.19 and earlier, 7.3… |
CVE-2017-3320 | Low | 2.4 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.7.16 and e… |
CVE-2017-3319 | Low | 3.1 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: X Plugin). Supported versions that are affected are 5.7.16 and earlier. Diff… |
CVE-2017-3301 | Low | 3.3 | 2017-01-27 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Easily expl… |
CVE-2017-3264 | Low | 3.1 | 2017-01-27 | Vulnerability in the Siebel UI Framework component of Oracle Siebel CRM (subcomponent: Open UI). The supported version that is affected is 16.1. Difficult to e… |
CVE-2017-3259 | Low | 3.7 | 2017-01-27 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112… |
CVE-2017-3240 | Low | 3.3 | 2017-01-27 | Vulnerability in the RDBMS Security component of Oracle Database Server. The supported version that is affected is 12.1.0.2. Easily exploitable vulnerability a… |
CVE-2017-3239 | Low | 3.3 | 2017-01-27 | Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0… |
CVE-2017-3235 | Low | 3.5 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8330 | Low | 3.7 | 2017-01-27 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Difficult t… |
CVE-2016-8328 | Low | 3.7 | 2017-01-27 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Java Mission Control). The supported version that is affected is Java SE: 8u112. Diffic… |
CVE-2016-8314 | Low | 3.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Core Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affecte… |
CVE-2016-8305 | Low | 2.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-5509 | Low | 3.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are a… |
CVE-2016-1551 | Low | 3.7 | 2017-01-27 | ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate… |
CVE-2016-9932 | Low | 3.3 | 2017-01-26 | CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "sup… |
CVE-2016-7429 | Low | 3.7 | 2017-01-13 | NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows remote attackers to cause a denial of servi… |
CVE-2016-6770 | Low | 3.3 | 2017-01-12 | An elevation of privilege vulnerability in the Framework API could enable a local malicious application to access system functions beyond its access level. Thi… |
CVE-2016-9015 | Low | 3.7 | 2017-01-11 | Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS… |
CVE-2015-8020 | Low | 3.7 | 2017-01-11 | Clustered Data ONTAP versions 8.0, 8.3.1, and 8.3.2 contain a default privileged account which under certain conditions can be used for unauthorized informatio… |
CVE-2016-4323 | Low | 3.7 | 2017-01-06 | A directory traversal exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an ov… |
CVE-2016-2380 | Low | 3.1 | 2017-01-06 | An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out-of… |
CVE-2016-7903 | Low | 3.7 | 2017-01-04 | Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link v… |
CVE-2016-9908 | Low | 3.3 | 2016-12-23 | Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_… |
CVE-2016-4027 | Low | 3.5 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev10. App Suite frontend offers to control whether a user wants to store cookies that exceed… |
CVE-2016-2877 | Low | 3.3 | 2016-11-30 | IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 uses weak permissions for unspecified directories under the web root, which allows local users to… |
CVE-2016-2874 | Low | 3.1 | 2016-11-30 | IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 mishandles authorization, which allows remote authenticated users to obtain sensitive information… |
CVE-2016-3009 | Low | 3.5 | 2016-11-30 | Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hi… |
CVE-2016-3002 | Low | 2.1 | 2016-11-30 | IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows physically proximate attackers to obtain sensitive information by reading cached da… |
CVE-2016-2953 | Low | 3.7 | 2016-11-30 | IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 does not require SSL, which allows remote attackers to obtain sensitive cleartext informat… |
CVE-2016-2952 | Low | 3.7 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive informatio… |