Archive
October 2017
Vulnerabilities first published in this month (UTC), newest first.
172 results · Clear filters · Feed
-
Unscored —CVE-2017-15963 Public exploit
iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser p…
-
Unscored —CVE-2017-15962 Public exploit
iStock Management System 1.0 allows Arbitrary File Upload via user/profile.
-
Unscored —CVE-2017-15971 Public exploit
Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sen…
-
Unscored —CVE-2017-15964 Public exploit
Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.
-
High 8.8
GNU Wget: stack overflow in HTTP protocol handling
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk len…
-
Unscored —CVE-2014-2023 Public exploit
Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin all…
-
Medium 6.1CVE-2017-15878 Public exploit
Cross-Site Scripting in keystone
A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.
-
High 8.8CVE-2017-15879 Public exploit
Keystone is vulnerable to CSV injection
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export.
-
Unscored —CVE-2017-15223 Public exploit
Denial-of-service vulnerability in ArGoSoft Mini Mail Server 1.0.0.2 and earlier allows remote attackers to waste CPU r…
-
Unscored —
Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code.
-
Unscored —CVE-2017-15081 Public exploit
In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.
-
Unscored —CVE-2015-2878 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hija…
-
Unscored —CVE-2015-5533 Public exploit
SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote…
-
Unscored —CVE-2011-4334 Public exploit
edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated use…
-
Unscored —CVE-2011-4333 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in LabWiki 1.1 and earlier allow remote attackers to inject arbitra…
-
Unscored —
Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated…
-
Unscored —CVE-2017-15808 Public exploit
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.
-
Unscored —
osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly …
-
Unscored —CVE-2017-15687 Public exploit
DOM Based Cross Site Scripting (XSS) exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.…
-
Unscored —CVE-2017-7089 Public exploit
An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud befo…
-
Unscored —
An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud befo…
-
Unscored —CVE-2017-7115 Public exploit
An issue was discovered in certain Apple products. iOS before 11 is affected. tvOS before 11 is affected. The issue inv…
-
Unscored —CVE-2017-7092 Public exploit
An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud befo…
-
Medium 5.3CVE-2017-9947 Public exploit
A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V…
-
Unscored —CVE-2017-15727 Public exploit
In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.
-
Unscored —CVE-2017-15734 Public exploit
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php.
-
Unscored —CVE-2017-15735 Public exploit
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary.
-
Unscored —CVE-2017-15730 Public exploit
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
-
Unscored —CVE-2017-15291 Public exploit
Cross-site scripting (XSS) vulnerability in the Wireless MAC Filtering page in TP-LINK TL-MR3220 wireless routers allow…
-
Unscored —CVE-2017-15645 Public exploit
CSRF exists in Webmin 1.850. By sending a GET request to at/create_job.cgi containing dir=/&cmd= in the URI, an attacke…
-
Unscored —CVE-2017-15646 Public exploit
Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Dow…
-
Unscored —
On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a cr…
-
Unscored —CVE-2017-15644 Public exploit
SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/…
-
Unscored —CVE-2017-15643 Public exploit
An active network attacker (MiTM) can achieve remote code execution on a machine that runs IKARUS Anti Virus 2.16.7. IK…
-
Unscored —CVE-2017-15649 Public exploit
net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls…
-
Unscored —CVE-2015-6668 Public exploit
The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the…
-
Unscored —CVE-2017-15639 Public exploit
tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the…
-
High 7.5
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Support…
KEV Feb 10, 2022 -
Unscored —CVE-2017-10309 Public exploit
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment). Supported versions that are affect…
-
Unscored —
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Support…