Archive
July 2017
Vulnerabilities first published in this month (UTC), newest first.
83 results · Clear filters · Feed
-
Unscored —CVE-2017-7046 Public exploit
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCl…
-
Unscored —CVE-2017-7042 Public exploit
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCl…
-
Unscored —CVE-2017-7061 Public exploit
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCl…
-
Unscored —CVE-2017-7041 Public exploit
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCl…
-
Unscored —CVE-2017-7018 Public exploit
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCl…
-
High 8.8
DNN (aka DotNetNuke) has Remote Code Execution via a cookie
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."
KEV Nov 3, 2021 -
Unscored —CVE-2017-11469 Public exploit
get2post.php in IDERA Uptime Monitor 7.8 has directory traversal in the file_name parameter.
-
Unscored —CVE-2017-11470 Public exploit
IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatifGadget/getxenmetrics.php via th…
-
Unscored —CVE-2017-11471 Public exploit
IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatIfGadget/getmetrics.php via the e…
-
Critical 9.8
Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as …
KEV Mar 25, 2022 -
Critical 9.8
OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injection
OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.
-
Critical 9.8CVE-2016-6798 Public exploit
XML External Entity Reference in Apache Sling
In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowi…
-
Medium 6.1CVE-2016-5394 Public exploit
Cross site scripting in Apache Sling
In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabili…
-
Unscored —
The Humax Wi-Fi Router model HG100R-* 2.0.6 is prone to an authentication bypass vulnerability via specially crafted re…
-
Unscored —CVE-2017-11456 Public exploit
Geneko GWR routers allow directory traversal sequences starting with a /../ substring, as demonstrated by unauthenticat…
-
Unscored —
A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2…
-
High 8.8
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilit…
KEV Mar 3, 2022 -
High 8.8
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the af…
KEV Apr 19, 2023 -
Unscored —CVE-2017-9813 Public exploit
In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptN…
-
Unscored —CVE-2017-9810 Public exploit
There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Ma…
-
Unscored —
The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus …
-
Unscored —
The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Main…
-
Unscored —CVE-2017-9609 Public exploit
Cross-site scripting (XSS) vulnerability in Blackcat CMS 1.2 allows remote authenticated users to inject arbitrary web …
-
Unscored —CVE-2017-9934 Public exploit
Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability.
-
Unscored —
Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors inv…
-
Unscored —CVE-2017-1182 Public exploit
IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to execute arbitrary commands on the sy…
-
Unscored —
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Trav…
-
Unscored —
ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course…
-
Unscored —
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range f…
-
Unscored —
dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a …
-
Unscored —CVE-2017-11176 Public exploit
The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the ret…
-
Unscored —
Internet Explorer on Microsoft Windows 8.1 and Windows RT 8.1, and Windows Server 2012 R2 allows an attacker to execute…
-
Unscored —
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Serve…
-
High 7.8
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mi…
KEV Feb 25, 2022 -
Unscored —CVE-2017-8564 Public exploit
Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold an…
-
Unscored —
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute…
-
Unscored —CVE-2017-7175 Public exploit
NfSen before 1.3.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the customfmt p…
-
Critical 9.8
Code execution in Apache Struts 1 plugin
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
KEV Feb 10, 2022 -
Unscored —CVE-2017-9627 Public exploit
An Uncontrolled Resource Consumption issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2…
-
Unscored —CVE-2017-7950 Public exploit
Nitro Pro 11.0.3 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted PCX…