Archive
September 2017
Vulnerabilities first published in this month (UTC), newest first.
136 results · Clear filters · Feed
-
Unscored —CVE-2017-14939 Public exploit
decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2…
-
Unscored —CVE-2017-14620 Public exploit
SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQ…
-
Unscored —CVE-2017-14702 Public exploit
ERS Data System 1.8.1.0 allows remote attackers to execute arbitrary code, related to "com.branaghgroup.ecers.update.Up…
-
Unscored —CVE-2017-14738 Public exploit
FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize i…
-
Unscored —CVE-2017-14507 Public exploit
Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to exe…
-
Unscored —
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was in…
-
Unscored —CVE-2017-14845 Public exploit
Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.
-
Unscored —CVE-2017-14846 Public exploit
Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.
-
Unscored —CVE-2017-14842 Public exploit
Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.
-
Unscored —CVE-2017-14840 Public exploit
TeamWork TicketPlus allows Arbitrary File Upload in updateProfile.
-
Unscored —CVE-2017-14847 Public exploit
Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.
-
Unscored —CVE-2017-14839 Public exploit
TeamWork Photo Fusion allows Arbitrary File Upload in changeAvatar and changeCover.
-
Unscored —CVE-2017-14844 Public exploit
Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.
-
Unscored —CVE-2017-14838 Public exploit
TeamWork Job Links allows Arbitrary File Upload in profileChange and coverChange.
-
Unscored —CVE-2017-14841 Public exploit
Mojoomla Annual Maintenance Contract (AMC) Management System allows Arbitrary File Upload in profilesetting image handl…
-
Unscored —CVE-2017-14843 Public exploit
Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.
-
Unscored —
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and …
-
Unscored —CVE-2017-11120 Public exploit
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor rep…
-
Unscored —CVE-2015-1336 Public exploit
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access …
-
Unscored —CVE-2015-3643 Public exploit
usb-creator before 0.2.38.3ubuntu0.1 on Ubuntu 12.04 LTS, before 0.2.56.3ubuntu0.1 on Ubuntu 14.04 LTS, before 0.2.62ub…
-
Unscored —CVE-2017-13129 Public exploit
Cross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to h…
-
Unscored —CVE-2017-14704 Public exploit
Multiple unrestricted file upload vulnerabilities in the (1) imageSubmit and (2) proof_submit functions in Claydip Lara…
-
Unscored —CVE-2017-14703 Public exploit
SQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute arbitrary SQL command…
-
High 8.8CVE-2015-7293 Public exploit
Plone vulnerable to cross-site request forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.
-
Medium 6.1CVE-2017-14735 Public exploit
OWASP AntiSamy Cross-site Scripting vulnerability
OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.
-
Unscored —CVE-2014-0997 Public exploit
WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used …
-
Unscored —
Multiple hardcoded credentials in Xsuite 2.x.
-
Unscored —CVE-2015-4669 Public exploit
The MySQL "root" user in Xsuite 2.x does not have a password set, which allows local users to access databases on the s…
-
Unscored —CVE-2015-4668 Public exploit
Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web si…
-
Medium 6.1CVE-2015-6748 Public exploit
Improper Neutralization of Input During Web Page Generation in Jsoup
Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.
-
Unscored —CVE-2017-1235 Public exploit
IBM WebSphere MQ 8.0 could allow an authenticated user to cause a premature termination of a client application thread …
-
Unscored —
Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchiv…
-
Unscored —
Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) a…
-
Unscored —CVE-2017-14712 Public exploit
In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Phonecall Notes Title parameter.
-
Unscored —CVE-2017-14717 Public exploit
In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Description parameter.
-
Unscored —
DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeO…
-
Unscored —CVE-2017-14680 Public exploit
ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a …
-
Critical 9.8
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_add…
KEV Mar 25, 2022 -
Unscored —CVE-2017-12930 Public exploit
SQL Injection in the admin interface in TecnoVISION DLX Spot Player4 version >1.5.10 allows remote unauthenticated user…
-
Unscored —
Arbitrary File Upload in resource.php of TecnoVISION DLX Spot Player4 version >1.5.10 allows remote authenticated users…