Maple Labs

Maple Labs · CVE search

Every CVE, searchable.

The US government’s National Vulnerability Database, kept on Maple Labs’ own hardware and updated every two hours. Search by CVE, product or words, and filter by severity or CISA’s known-exploited list.

424,071 CVEs, updated from the NVD 1 hour ago.

1–20 of 54

  1. CVE-2017-17806 high 7.8

    The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.

  2. CVE-2017-17805 high 7.8

    The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable.

  3. CVE-2016-1254 high 7.5

    Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.

  4. CVE-2015-3138 high 7.5

    print-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service (segmentation fault and process crash).

  5. CVE-2014-4616 medium 5.9

    Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.

  6. CVE-2015-3405 high 7.5

    ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.

  7. CVE-2015-5203 medium 5.5

    Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.

  8. CVE-2015-5221 medium 5.5

    Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.

  9. CVE-2016-9961 critical 9.8

    game-music-emu before 0.6.1 mishandles unspecified integer values.

  10. CVE-2016-9960 medium 5.5

    game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash).

  11. CVE-2016-9959 high 7.8

    game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.

  12. CVE-2016-9958 high 7.8

    game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations.

  13. CVE-2016-9957 high 7.8

    Stack-based buffer overflow in game-music-emu before 0.6.1.

  14. CVE-2017-6542 critical 9.8

    The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overflow.

  15. CVE-2015-8010 medium 6.1

    Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi.

  16. CVE-2016-7797 high 7.5

    Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.

  17. CVE-2016-9556 medium 5.5

    The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.

  18. CVE-2016-10048 high 7.5

    Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecified vectors.

  19. CVE-2014-9851 high 7.5

    ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (application crash).

  20. CVE-2014-9850 high 7.5

    Logic error in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (resource consumption).