2016-05-05 - CVE Archive

CVE-2016-3718 May 05, 18:59 MEDIUM POC KEV PATCH THREAT Act Now

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

SSRF Oracle Red Hat Canonical Enterprise Linux Desktop +29

NVD Exploit-DB VulDB

CVSS 3.1

5.5

EPSS

83.8%

Threat

6.6

CVE-2016-3715 May 05, 18:59 MEDIUM POC KEV PATCH THREAT Act Now

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Information Disclosure Path Traversal Oracle Red Hat Canonical +30

NVD Exploit-DB VulDB

CVSS 3.1

5.5

EPSS

77.7%

Threat

6.4

CVE-2016-2107 May 05, 01:59 MEDIUM POC PATCH THREAT This Month

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 80.0%.

Information Disclosure Google Node.js OpenSSL Android +18

NVD Exploit-DB

CVSS 3.1

5.9

EPSS

80.0%

Threat

5.1

CVE-2016-3717 May 05, 18:59 MEDIUM POC PATCH THREAT This Month

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 33.7%.

Information Disclosure Red Hat Canonical Enterprise Linux Desktop Enterprise Linux Server +8

NVD Exploit-DB

CVSS 3.0

5.5

EPSS

33.7%

CVE-2016-2168 May 05, 18:59 MEDIUM This Month

The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Denial Of Service Apache Subversion

NVD

CVSS 3.0

6.5

EPSS

7.4%

CVE-2016-2167 May 05, 18:59 MEDIUM This Month

The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.

Authentication Bypass Apache Subversion

NVD

CVSS 3.0

6.8

EPSS

1.0%

CVE-2016-4008 May 05, 18:59 MEDIUM This Month

The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Denial Of Service Canonical Fedora Libtasn1 Ubuntu Linux +3

NVD

CVSS 3.0

5.9

EPSS

5.0%