Archive
June 2017
Vulnerabilities first published in this month (UTC), newest first.
131 results · Clear filters · Feed
-
Unscored —CVE-2017-8478 Public exploit
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2…
-
Unscored —CVE-2017-8488 Public exploit
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2…
-
Unscored —
A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafte…
-
Unscored —CVE-2017-8483 Public exploit
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2…
-
Unscored —CVE-2017-8471 Public exploit
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2…
-
Unscored —CVE-2017-8485 Public exploit
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2…
-
Unscored —CVE-2017-8479 Public exploit
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2…
-
Unscored —CVE-2017-8476 Public exploit
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2…
-
Unscored —CVE-2017-8480 Public exploit
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2…
-
Unscored —
Microsoft Edge in Windows 10 1607 and Windows Server 2016 allows an attacker to execute arbitrary code in the context o…
-
Unscored —CVE-2017-9603 Public exploit
SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitr…
-
Unscored —CVE-2017-9429 Public exploit
SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitr…
-
Medium 5.9
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expression…
-
Unscored —CVE-2017-9418 Public exploit
SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute a…
-
Unscored —
The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial …
-
Unscored —CVE-2017-9125 Public exploit
The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of s…
-
Unscored —CVE-2017-9128 Public exploit
The quicktime_video_width function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial o…
-
Unscored —CVE-2017-9122 Public exploit
The quicktime_read_moov function in moov.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (…
-
Unscored —CVE-2017-9126 Public exploit
The quicktime_read_dref_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of ser…
-
Unscored —CVE-2017-9124 Public exploit
The quicktime_match_32 function in util.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (N…
-
Unscored —
There is a remote stack-based buffer overflow (SEH) in register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.…
-
Unscored —CVE-2017-9123 Public exploit
The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of s…
-
Unscored —CVE-2017-9127 Public exploit
The quicktime_user_atoms_read_atom function in useratoms.c in libquicktime 1.2.4 allows remote attackers to cause a den…
-
Unscored —
Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root…
-
Unscored —
The drag-and-drop (DnD) function in VMware Workstation 12.x before version 12.5.4 and Fusion 8.x before version 8.5.5 h…
-
Unscored —
A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an unauthenticated, remote attac…
-
Medium 5.4CVE-2017-9516 Public exploit
Craft CMS XSS Vulnerability
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
-
Unscored —CVE-2017-7180 Public exploit
Net Monitor for Employees Pro through 5.3.4 has an unquoted service path, which allows a Security Feature Bypass of its…
-
Unscored —CVE-2015-7346 Public exploit
SQL injection vulnerability in ZCMS 1.1.
-
Unscored —
XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers t…
-
Unscored —CVE-2017-4905 Public exploit
VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESX…
-
Unscored —CVE-2017-4914 Public exploit
VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of t…
-
Unscored —CVE-2017-7312 Public exploit
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can ad…
-
Unscored —CVE-2017-7314 Public exploit
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creatin…
-
Unscored —CVE-2016-9834 Public exploit
An XSS vulnerability allows remote attackers to execute arbitrary client side script on vulnerable installations of Sop…
-
High 8.8
Mercurial has Incorrect Permission Assignment for Critical Resource
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.
-
Unscored —CVE-2017-8836 Public exploit
CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2…
-
Unscored —CVE-2017-8838 Public exploit
XSS via syncid exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380…
-
Unscored —
SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380h…
-
Unscored —CVE-2017-8837 Public exploit
Cleartext password storage exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw…