Total
36333 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-1000374 | 1 Netbsd | 1 Netbsd | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and possibly earlier versions. | |||||
| CVE-2017-1000372 | 1 Openbsd | 1 Openbsd | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions. | |||||
| CVE-2017-1000371 | 1 Linux | 1 Linux Kernel | 2026-06-17 | 7.2 HIGH | 7.8 HIGH |
| The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to i386 based systems. | |||||
| CVE-2017-1000370 | 1 Linux | 1 Linux Kernel | 2026-06-17 | 7.2 HIGH | 7.8 HIGH |
| The offset2lib patch as used in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'ed with 1GB of arguments or environmental strings then the stack occupies the address 0x80000000 and the PIE binary is mapped above 0x40000000 nullifying the protection of the offset2lib patch. This affects Linux Kernel version 4.11.5 and earlier. This is a different issue than CVE-2017-1000371. This issue appears to be limited to i386 based systems. | |||||
| CVE-2017-1000365 | 1 Linux | 1 Linux Kernel | 2026-06-17 | 7.2 HIGH | 7.8 HIGH |
| The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and earlier. It appears that this feature was introduced in the Linux Kernel version 2.6.23. | |||||
| CVE-2017-1000361 | 1 Opendaylight | 1 Opendaylight | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight. Controller launches exceptions and consumes more CPU resources. Component: OpenDaylight is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0. | |||||
| CVE-2017-1000212 | 1 Alchemist-elixir | 1 Alchemist-server | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server. A malicious website can execute requests against an ephemeral port on localhost that are then evaluated as elixir code. | |||||
| CVE-2017-1000192 | 1 Cygnux | 1 Syspass | 2026-06-17 | 5.0 MEDIUM | 9.8 CRITICAL |
| Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files inclusion. The attacker can read the configuration files that contain the login and password from the database, private encryption key, as well as other sensitive information. | |||||
| CVE-2017-1000168 | 1 Sodiumoxide Project | 1 Sodiumoxide | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate public keys | |||||
| CVE-2017-1000152 | 1 Mahara | 1 Mahara | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 running PHP 5.3 are vulnerable to one user being logged in as another user on a separate computer as the same session ID is served. This situation can occur when a user takes an action that forces another user to be logged out of Mahara, such as an admin changing another user's account settings. | |||||
| CVE-2017-1000145 | 1 Mahara | 1 Mahara | 2026-06-17 | 4.0 MEDIUM | 4.9 MEDIUM |
| Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to anonymous comments being able to be placed on artefact detail pages even when the site administrator had disallowed anonymous comments. | |||||
| CVE-2017-1000142 | 1 Mahara | 1 Mahara | 2026-06-17 | 5.5 MEDIUM | 6.5 MEDIUM |
| Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to users being able to delete their submitted page through URL manipulation. | |||||
| CVE-2017-1000107 | 1 Jenkins | 1 Script Security | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection. | |||||
| CVE-2017-1000083 | 3 Debian, Gnome, Redhat | 8 Debian Linux, Evince, Enterprise Linux Desktop and 5 more | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename. | |||||
| CVE-2017-1000080 | 1 Onosproject | 1 Onos | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Linux foundation ONOS 1.9.0 allows unauthenticated use of websockets. | |||||
| CVE-2017-1000079 | 1 Onosproject | 1 Onos | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Linux foundation ONOS 1.9.0 is vulnerable to a DoS. | |||||
| CVE-2017-1000066 | 1 Keepass | 1 Keepass | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in the disclosure of sensitive information. | |||||
| CVE-2017-1000046 | 1 Mautic | 1 Mautic | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Mautic 2.6.1 and earlier fails to set flags on session cookies | |||||
| CVE-2017-1000037 | 1 Rvm Project | 1 Rvm | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| RVM automatically loads environment variables from files in $PWD resulting in command execution RVM vulnerable to command injection when automatically loading environment variables from files in $PWD RVM automatically executes hooks located in $PWD resulting in code execution RVM automatically installs gems as specified by files in $PWD resulting in code execution RVM automatically does "bundle install" on a Gemfile specified by .versions.conf in $PWD resulting in code execution | |||||
| CVE-2017-0909 | 1 Private Address Check Project | 1 Private Address Check | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery. | |||||