Archive
May 2017
Vulnerabilities first published in this month (UTC), newest first.
1,010 results · Feed
-
High 7.5CVE-2017-0234 EPSS 38%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-022…
-
Unscored —CVE-2017-0266 EPSS 36%
A remote code execution vulnerability exists in Microsoft Edge in the way affected Microsoft scripting engines render w…
-
Unscored —
The kernel in Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows locally authenticated attackers to gain priv…
-
Unscored —CVE-2017-0229 EPSS 11%
A remote code execution vulnerability exists in Microsoft Edge in the way JavaScript engines render when handling objec…
-
Unscored —
The kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and…
-
High 7.3
High severity vulnerability that affects Microsoft.AspNetCore.Mvc
An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.
-
Unscored —
Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Win…
-
Unscored —
The Graphics Component in the kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Wi…
-
High 7.5CVE-2017-0236 EPSS 32%
ChakraCore RCE Vulnerability
A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-022…
-
Unscored —
Conexant Systems mictray64 task, as used on HP Elite, EliteBook, ProBook, and ZBook systems, leaks sensitive data (keys…
-
Unscored —
The mark_line_tr function in gxscanc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service…
-
Unscored —
An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. This might lead to invalid w…
-
High 7.2CVE-2017-8912 Public exploit
CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code par…
-
Unscored —
LightDM through 1.22.0, when systemd is used in Ubuntu 16.10 and 17.x, allows physically proximate attackers to bypass …
-
Unscored —
An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare …
-
Unscored —CVE-2017-7472 Public exploit
The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumpti…
-
Unscored —
Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute ar…
-
Unscored —
Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS use…
-
Unscored —
Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka guest transfer) …
-
Unscored —
An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTT…
-
Unscored —
An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA ima…
-
Unscored —
An issue was discovered on OnePlus One and X devices. Due to a lenient updater-script on the OnePlus One and X OTA imag…
-
Unscored —
An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade at…
-
Unscored —
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclo…
-
Unscored —
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter…
-
Unscored —
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privil…
-
Unscored —
The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebS…
-
Unscored —
A potential security vulnerability has been identified with HP Integrated Lights-Out 4 (iLO 4) firmware version 2.11 an…
-
Unscored —
Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC (Privilege At…
-
Unscored —
The Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.8, ProxySG 6.5 prior 6.5.10.6, ProxySG 6.6 prior to 6.6.5…
-
Unscored —
Symantec Advanced Secure Gateway (ASG) 6.6, ASG 6.7 prior to 6.7.2.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6, and P…
-
Unscored —
Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.13, ASG 6.7 prior to 6.7.3.1, ProxySG 6.5 prior to 6.5.10.6, …
-
Unscored —
The Symantec Content Analysis (CA) 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense (MTD) 1.1 management consoles are…
-
Unscored —
A vulnerability was discovered in Siemens SIMATIC WinCC (V7.3 before Upd 11 and V7.4 before SP1), SIMATIC WinCC Runtime…
-
Unscored —
A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2 HF1), SIMATIC Automation Tool (All…
-
Medium 6.5
Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a …
-
Medium 6.5
Specially crafted PROFINET DCP broadcast packets could cause a denial of service condition of affected products on a lo…
-
Unscored —
Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of …
-
Unscored —
Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3…
-
Unscored —
In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a …