Archive
November 2017
Vulnerabilities first published in this month (UTC), newest first.
85 results · Clear filters · Feed
-
Medium 5.5CVE-2017-12624 Public exploit
Improper Input Validation in Apache CXF
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS…
-
Unscored —
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL prot…
-
Medium 5.4CVE-2017-16807 Public exploit
Kirby XSS Vulnerability
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.
-
Unscored —
The Process function in RemoteTaskServer/WebServer/HttpServer.cs in Ulterius before 1.9.5.0 allows HTTP server director…
-
Unscored —CVE-2017-13795 Public exploit
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iClou…
-
Unscored —CVE-2017-13792 Public exploit
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iClou…
-
Unscored —CVE-2017-13783 Public exploit
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iClou…
-
Unscored —CVE-2017-13802 Public exploit
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iClou…
-
Unscored —CVE-2017-13794 Public exploit
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iClou…
-
Unscored —CVE-2017-13785 Public exploit
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iClou…
-
Unscored —CVE-2017-13797 Public exploit
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iClou…
-
Unscored —CVE-2017-13784 Public exploit
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iClou…
-
Unscored —CVE-2017-13798 Public exploit
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iClou…
-
Unscored —CVE-2017-13796 Public exploit
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iClou…
-
Unscored —CVE-2017-13849 Public exploit
An issue was discovered in certain Apple products. iOS before 11.1 is affected. tvOS before 11.1 is affected. watchOS b…
-
Unscored —CVE-2017-13791 Public exploit
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iClou…
-
Unscored —CVE-2017-16780 Public exploit
The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration f…
-
Unscored —CVE-2017-16781 Public exploit
The installer in MyBB before 1.8.13 has XSS.
-
Unscored —CVE-2017-16783 Public exploit
In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter.
-
Unscored —
The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attacker…
-
Unscored —
The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST req…
-
Unscored —CVE-2017-16567 Public exploit
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. …
-
Unscored —CVE-2017-16568 Public exploit
Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality…
-
Unscored —CVE-2017-11309 Public exploit
Buffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allows remote servers to execute arbitrary c…
-
Unscored —
Buffer overflow in the ViewerCtrlLib.ViewerCtrl ActiveX control in Avaya IP Office Contact Center before 10.1.1 allows …
-
High 7.8
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary fil…
KEV Nov 3, 2021 -
Critical 9.8
Deserialization of Untrusted Data in Apache commons collections
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal …
-
Critical 9.8CVE-2015-3933 Public exploit
MetalGenix GeniXCMS vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the (1) email parameter or (2) userid parameter to register.php.
-
High 8.8CVE-2017-9096 Public exploit
Improper Restriction of XML External Entity Reference in iText
The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.
-
Unscored —
In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian han…
-
Unscored —CVE-2017-6331 Public exploit
Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a…
-
Unscored —
A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. The applicat…
-
Unscored —CVE-2017-16001 Public exploit
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently s…
-
Unscored —
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_…
-
High 8.8CVE-2017-16570 Public exploit
Cross-Site Request Forgery (CSRF) in keystone
KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header.
-
Unscored —CVE-2017-16543 Public exploit
Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated…
-
Unscored —CVE-2017-16542 Public exploit
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name para…
-
Unscored —CVE-2017-16541 Public exploit
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discov…
-
Unscored —CVE-2017-16513 Public exploit
Ipswitch WS_FTP Professional before 12.6.0.3 has buffer overflows in the local search field and the backup locations fi…
-
Unscored —CVE-2017-16237 Public exploit
In Vir.IT eXplorer Anti-Virus before 8.5.42, the driver file (VIAGLT64.SYS) contains an Arbitrary Write vulnerability b…