Skip to content
OpenAdvisories

Archive

April 2017

Vulnerabilities first published in this month (UTC), newest first.

← March 2017 2017 / April May 2017 →
  1. 19
  2. 2177
  3. 348
  4. 423
  5. 534
  6. 632
  7. 787
  8. 8 
  9. 926
  10. 1098
  11. 1136
  12. 12154
  13. 1377
  14. 1460
  15. 152
  16. 161
  17. 1732
  18. 1814
  19. 1923
  20. 20101
  21. 2147
  22. 226
  23. 2319
  24. 24281
  25. 2537
  26. 2611
  27. 2720
  28. 2876
  29. 299
  30. 3029
All Critical High Medium Low Exploited only Public exploit

20 results · Clear filters · Feed

  • Critical 9.8
    CVE-2017-2096

    smalruby and smalruby-editor vulnerable to OS Command Injection

    smalruby-editor v0.4.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

    Ruby Programming Shounendan smalruby-editor smalruby-editor smalruby RubyGems
  • Critical 9.8
    CVE-2017-3066 Exploited Public exploit EPSS 91%

    Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier ha…

    KEV Feb 24, 2025
  • Critical 9.9
    CVE-2016-6902

    lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.

    limited-shell lshell Ubuntu PyPI
  • Critical 9.9
    CVE-2016-6903

    lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.

    limited-shell lshell Ubuntu PyPI
  • Critical 9.8
    CVE-2016-3109 EPSS 28%

    Shopware RCE Vulnerability

    The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.

    shopware/shopware Packagist
  • Critical 9.8
    CVE-2016-2173 Public exploit

    Improper Input Validation in Spring AMQP

    org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.

    org.springframework.amqp:spring-amqp Maven
  • Critical 9.8
    CVE-2016-1555 Exploited Public exploit Scanner template EPSS 98%

    (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgea…

    KEV Mar 25, 2022
  • Critical 9.1
    CVE-2016-8721

    An exploitable OS Command Injection vulnerability exists in the web application 'ping' functionality of Moxa AWK-3131A …

    Moxa Moxa AWK-3131A WAP ICS / OT
  • Critical 9.8
    CVE-2017-5645 Public exploit Scanner template EPSS 89%

    Deserialization of Untrusted Data in Log4j

    In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

    Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  • Critical 9.8
    CVE-2017-5651

    Expected Behavior Violation in Apache Tomcat

    In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the process…

    Apache Software Foundation Apache Tomcat org.apache.tomcat.embed:tomcat-embed-core org.apache.tomcat:tomcat-coyote Maven
  • Critical 9.1
    CVE-2017-5648 EPSS 13%

    Exposure of Resource to Wrong Sphere in Apache Tomcat

    While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted appli…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • Critical 9.8
    CVE-2016-4800

    Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request

    The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backsl…

    org.eclipse.jetty:jetty-server Maven
  • Critical 9.8
    CVE-2015-7564 Public exploit

    TeamPass vulnerable to SQL Injection

    Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) c…

    nilsteampassnet/teampass Packagist
  • Critical 9.8
    CVE-2016-1908 EPSS 14%

    The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the loc…

    openssh openssh Debian Ubuntu
  • Critical 9.8
    CVE-2016-10321

    web2py is vulnerable to password brute-force attack

    web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.

    web2py web2py Ubuntu PyPI
  • Critical —
    CVE-2016-5682

    Cross-Site Scripting in swagger-ui

    Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section.

    swagger-ui npm
  • Critical 9.8
    CVE-2016-6809

    Apache Tika allows Java code execution for serialized objects embedded in MATLAB files

    Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.

    tika org.apache.tika:tika-core Debian Maven
  • Critical 9.8
    CVE-2016-8735 Exploited EPSS 90%

    Apache Tomcat Improper Access Control vulnerability

    Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this lis…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
    KEV May 12, 2023
  • Critical 9.8
    CVE-2017-7575

    Schneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection pas…

  • Critical 10.0
    CVE-2017-7574

    Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-k…