Archive
October 2017
Vulnerabilities first published in this month (UTC), newest first.
172 results · Clear filters · Feed
-
Unscored —CVE-2017-10352 Public exploit
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). T…
-
Unscored —CVE-2017-10033 Public exploit
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Support Tools). Suppor…
-
Unscored —
Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Perfor…
-
Unscored —CVE-2017-12579 Public exploit
An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and ea…
-
Unscored —CVE-2015-7714 Public exploit
Multiple SQL injection vulnerabilities in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allow remote ad…
-
Unscored —CVE-2015-7715 Public exploit
Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows…
-
Unscored —CVE-2017-15359 Public exploit
In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory …
-
Unscored —
The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior…
-
Unscored —CVE-2017-14956 Public exploit
AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "…
-
Unscored —CVE-2017-15595 Public exploit
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded rec…
-
Unscored —CVE-2017-15578 Public exploit
In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/edit_category.php.
-
Unscored —CVE-2017-15579 Public exploit
In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa_pages_per_page cookie in a playlist action to watch…
-
Unscored —CVE-2014-8357 Public exploit
backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a…
-
Unscored —
The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary com…
-
Unscored —
Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a cr…
-
Unscored —CVE-2017-15221 Public exploit
ASX to MP3 converter 3.1.3.7.2010.11.05 has a buffer overflow via a crafted M3U file, a related issue to CVE-2009-1324.
-
Unscored —CVE-2017-15361 Public exploit
The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 000000000…
-
Unscored —
Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup fi…
-
Unscored —
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update…
-
Medium 6.1CVE-2017-15374 Public exploit
Shopware XSS Vulnerability
Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to p…
-
Unscored —CVE-2017-15303 Public exploit
In CPUID CPU-Z before 1.43, there is an arbitrary memory write that results directly in elevation of privileges, becaus…
-
Critical 9.8
Remote code execution occurs in Apache Solr
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulner…
-
Medium 5.0CVE-2017-10617 Public exploit
Contrail: XML External Entity (XXE) vulnerability
The ifmap service that comes bundled with Contrail has an XML External Entity (XXE) vulnerability that may allow an attacker to retrieve sensitive system files. Affected releases are Juniper Networks Contrail 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 pri…
-
Unscored —CVE-2017-15013 Public exploit
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design g…
-
Unscored —CVE-2017-15276 Public exploit
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design g…
-
Unscored —CVE-2017-15014 Public exploit
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design g…
-
Unscored —CVE-2017-15012 Public exploit
OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 does not properly validate the …
-
Unscored —
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windo…
-
Unscored —CVE-2017-11785 Public exploit
The Microsoft Windows Kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Win…
-
Unscored —
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacke…
-
Unscored —
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacke…
-
Unscored —
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windo…
-
High 7.8
Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary comman…
KEV Nov 3, 2021 -
Unscored —CVE-2017-11783 Public exploit
Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Serve…
-
Unscored —CVE-2017-11823 Public exploit
The Microsoft Device Guard on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a securit…
-
Unscored —
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacke…
-
Unscored —
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacke…
-
High 7.8
Microsoft Office 2010, SharePoint Enterprise Server 2010, SharePoint Server 2010, Web Applications, Office Web Apps Ser…
KEV Mar 3, 2022 -
Unscored —
There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices, as demonstrated by the "Name des Bou…
-
Medium 5.4CVE-2017-15284 Public exploit
OctoberCMS Cross-Site Scripting
Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context …