NVD List
| Id | Name | Description | Reject | CVSS Version | CVSS Score | Severity | Pub Date | Modified Date | Actions |
|---|---|---|---|---|---|---|---|---|---|
| 83990 | CVE-2016-9124 | Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks. An account lockdown feature was considered, but rejected to avoid introducing service disruptions to regular users during such attacks. A random delay has instead been introduced as a countermeasure in case of password failures, along with a system to discourage parallel brute forcing. These systems will effectively allow the valid users to log in to the adserver, even while an attack is in progress. | 2 | 5 | Medium | 2017-03-29 | 2017-03-29 | View | |
| 83989 | CVE-2016-9123 | go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures. | 2 | 5 | Medium | 2017-03-29 | 2017-03-29 | View | |
| 83988 | CVE-2016-9122 | go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated. | 2 | 5 | Medium | 2017-03-29 | 2017-03-29 | View | |
| 83987 | CVE-2016-9121 | go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack. | 2 | 6.4 | Medium | 2017-03-29 | 2017-03-29 | View | |
| 83986 | CVE-2016-9011 | The wmf_malloc function in api.c in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (application crash) via a crafted wmf file, which triggers a memory allocation failure. | 2 | 4.3 | Medium | 2017-03-29 | 2017-03-27 | View |
Page 875 of 17672, showing 5 records out of 88360 total, starting on record 4371, ending on 4375
