September 2017

4 results · Clear filters · Feed

• High 8.8
  CVE-2015-7293 Public exploit

  Plone vulnerable to cross-site request forgery

  Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.

  plone PyPI
  Sep 25, 2017
• High 8.1
  CVE-2017-12615 Exploited · Ransomware Public exploit EPSS 100%

  When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server

  When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could th…

  Apache Software Foundation Apache Tomcat org.apache.tomcat.embed:tomcat-embed-core Maven
  Sep 19, 2017

  KEV Mar 25, 2022
• High 8.1
  CVE-2017-9805 Exploited Public exploit EPSS 99%

  REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

  The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloa…

  Apache Software Foundation Apache Struts org.apache.struts:struts2-rest-plugin Maven
  Sep 15, 2017

  KEV Nov 3, 2021
• High 7.8
  CVE-2017-8759 Exploited Public exploit EPSS 89%

  Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely v…

  Microsoft Microsoft .NET Framework
  Sep 13, 2017

  KEV Nov 3, 2021