Vulnerability Summary for the Week of November 14, 2016 の抜粋

High Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
dotcms -- dotcms	SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.	2016-11-14	7.5	CVE-2016-8902 MISC MISC MISC MISC
emc -- avamar_data_store	EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) versions 7.3 and older contain a vulnerability that may expose the Avamar servers to potentially be compromised by malicious users.	2016-11-15	7.2	CVE-2016-0909 miscellaneous CONFIRM
exponentcms -- exponent_cms	In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection. Ref: http://www.exponentcms.org/ Exponent CMS is an Open Source Content Management System, based on PHP, MySQL and the Exponent Framework. Dynamic CMS Content Management Solution with Enterprise Level Content Management Features.	2016-11-15	7.5	CVE-2016-9287 CONFIRM
:
linux -- linux_kernel	The __ext4_journal_stop function in fs/ext4/ext4_jbd2.c in the Linux kernel before 4.3.3 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field.	2016-11-16	9.3	CVE-2015-8961 CONFIRM CONFIRM CONFIRM CONFIRM
:   同様案件、多数
objective_development -- little_snitch	Little Snitch version 3.0 through 3.6.1 suffer from a buffer overflow vulnerability that could be locally exploited which could lead to an escalation of privileges (EoP) and unauthorised ring0 access to the operating system. The buffer overflow is related to insufficient checking of parameters to the "OSMalloc" and "copyin" kernel API calls.	2016-11-15	7.2	CVE-2016-8661 MISC
samsung -- samsung_mobile	Integer overflow in SystemUI in KK(4.4) and L(5.0/5.1) on Samsung Note devices allows attackers to cause a denial of service (UI restart) via vectors involving APIs and an activity that computes an out-of-bounds array index, aka SVE-2016-6906.	2016-11-11	7.8	CVE-2016-9277 CONFIRM

Back to top