Archive
November 2017
Vulnerabilities first published in this month (UTC), newest first.
85 results · Clear filters · Feed
-
Unscored —CVE-2017-1000405 Public exploit
The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd() function insid…
-
Unscored —
An issue was discovered in certain Apple products. macOS High Sierra before Security Update 2017-001 is affected. The i…
-
High 7.5
The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooc…
-
Unscored —CVE-2017-16952 Public exploit
KMPlayer 4.2.2.4 allows remote attackers to cause a denial of service via a crafted NSV file.
-
Unscored —CVE-2017-16951 Public exploit
Winamp Pro 5.66 Build 3512 allows remote attackers to cause a denial of service via a crafted WAV, WMV, AU, ASF, AIFF, …
-
Unscored —CVE-2017-16994 Public exploit
The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, …
-
Unscored —CVE-2017-16962 Public exploit
The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities v…
-
Unscored —
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbit…
-
Unscored —
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denia…
-
Unscored —CVE-2017-16939 Public exploit
The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to ga…
-
Unscored —
The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin pa…
-
Unscored —CVE-2017-16935 Public exploit
Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers t…
-
Unscored —CVE-2015-3934 Public exploit
Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to execute arbitrary SQL commands v…
-
Unscored —CVE-2017-16902 Public exploit
On the Vonage VDV-23 115 3.2.11-0.9.40 home router, sending a long string of characters in the loginPassword and/or log…
-
Unscored —
In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passw…
-
Unscored —
On BIG-IP versions 11.6.0-11.6.2 (fixed in 11.6.2 HF1), 12.0.0-12.1.2 HF1 (fixed in 12.1.2 HF2), or 13.0.0-13.0.0 HF2 (…
-
High 7.5
jqueryFileTree vulnerable to Directory Traversal
jqueryFileTree 2.1.5 and older Directory Traversal
-
Unscored —CVE-2017-16819 Public exploit
A stored cross-site scripting vulnerability in the Icon Time Systems RTC-1000 v2.5.7458 and earlier time clock allows r…
-
Unscored —CVE-2017-16843 Public exploit
Vonage VDV-23 115 3.2.11-0.9.40 devices have stored XSS via the NewKeyword or NewDomain field to /goform/RgParentalBasi…
-
Unscored —CVE-2017-16777 Public exploit
If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a lo…
-
Unscored —CVE-2017-16841 Public exploit
LanSweeper 6.0.100.75 has XSS via the description parameter to /Calendar/CalendarActions.aspx.
-
Unscored —CVE-2017-16836 Public exploit
Arris TG1682G devices with Comcast TG1682_2.0s7_PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS vi…
-
Unscored —CVE-2017-15271 Public exploit
A use-after-free issue could be triggered remotely in the SFTP component of PSFTPd 10.0.4 Build 729. This issue could b…
-
Unscored —CVE-2017-15270 Public exploit
The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values (CSV) …
-
High 8.1
Zeta Components Mail Arbitrary code execution via a crafted email address
The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email …
-
Unscored —CVE-2017-14961 Public exploit
In IKARUS anti.virus 2.16.7, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating…
-
Unscored —CVE-2017-7851 Public exploit
D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the dev…
-
Unscored —CVE-2017-8809 Public exploit
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulner…
-
High 7.8
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and M…
KEV Nov 3, 2021 -
High 7.5
Chakra Core vulnerable to privilege escalation when writing to JavaScript null scope objects
ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vu…
-
Unscored —
ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, versi…
-
Unscored —
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows …
-
Unscored —CVE-2017-11831 Public exploit
Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2…
-
Unscored —
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windo…
-
Unscored —
Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker …
-
Unscored —CVE-2017-11830 Public exploit
Device Guard in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allo…
-
Unscored —
ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 170…
-
Unscored —
ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, versi…
-
Unscored —
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include p…
-
Unscored —
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB b…