Archive
December 2017
Vulnerabilities first published in this month (UTC), newest first.
181 results · Clear filters · Feed
-
Unscored —CVE-2017-17630 Public exploit
Yoga Class Script 1.0 has SQL Injection via the /list city parameter.
-
Unscored —CVE-2017-17610 Public exploit
E-commerce MLM Software 1.0 has SQL Injection via the service_detail.php pid parameter, event_detail.php eventid parame…
-
Unscored —CVE-2017-17641 Public exploit
Resume Clone Script 2.0.5 has SQL Injection via the preview.php id parameter.
-
Unscored —CVE-2017-17579 Public exploit
FS Freelancer Clone 1.0 has SQL Injection via the profile.php u parameter.
-
Unscored —CVE-2017-17614 Public exploit
Food Order Script 1.0 has SQL Injection via the /list city parameter.
-
Unscored —CVE-2017-17606 Public exploit
Co-work Space Search Script 1.0 has SQL Injection via the /list city parameter.
-
Unscored —CVE-2017-17582 Public exploit
FS Grubhub Clone 1.0 has SQL Injection via the /food keywords parameter.
-
Unscored —CVE-2017-17638 Public exploit
Groupon Clone Script 3.01 has SQL Injection via the city_ajax.php state_id parameter.
-
Unscored —CVE-2017-17586 Public exploit
FS Olx Clone 1.0 has SQL Injection via the subpage.php scat parameter or the message.php pid parameter.
-
Unscored —CVE-2017-17622 Public exploit
Online Exam Test Application Script 1.6 has SQL Injection via the exams.php sort parameter.
-
Unscored —CVE-2017-17595 Public exploit
Beauty Parlour Booking Script 1.0 has SQL Injection via the /list gender or city parameter.
-
Unscored —CVE-2017-17602 Public exploit
Advance B2B Script 2.1.3 has SQL Injection via the tradeshow-list-detail.php show_id or view-product.php pid parameter.
-
Unscored —CVE-2017-17616 Public exploit
Event Search Script 1.0 has SQL Injection via the /event-list city parameter.
-
Unscored —CVE-2017-17624 Public exploit
PHP Multivendor Ecommerce 1.0 has SQL Injection via the single_detail.php sid parameter, or the category.php searchcat …
-
Unscored —CVE-2017-17618 Public exploit
Kickstarter Clone Script 2.0 has SQL Injection via the investcalc.php projid parameter.
-
Unscored —CVE-2017-17583 Public exploit
FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter.
-
Unscored —CVE-2017-17603 Public exploit
Advanced Real Estate Script 4.0.7 has SQL Injection via the search-results.php Projectmain, proj_type, searchtext, sell…
-
Unscored —CVE-2017-17588 Public exploit
FS IMDB Clone 1.0 has SQL Injection via the movie.php f parameter, tvshow.php s parameter, or show_misc_video.php id pa…
-
Unscored —CVE-2017-17572 Public exploit
FS Amazon Clone 1.0 has SQL Injection via the PATH_INFO to /VerAyari.
-
Unscored —CVE-2017-17607 Public exploit
CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.
-
High 7.5
wolfSSL Bleichenbacher/ROBOT
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application. This vulnerability is referred to as "ROBOT."
-
High 7.5
BouncyCastle JCE TLS Bleichenbacher/ROBOT
BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover th…
-
Unscored —
The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. Th…
-
Unscored —
ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to…
-
High 7.5
ChakraCore RCE Vulnerability
ChakraCore and Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulne…
-
Unscored —
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows S…
-
High 7.5
ChakraCore vulnerable to remote code execution
ChakraCore and Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulne…
-
Unscored —
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows S…
-
Unscored —
Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold,…
-
Unscored —
Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Wi…
-
High 7.5
ChakraCore vulnerable to privilege escalation due to exposure from scriptFunction
ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption…
-
High 7.5
ChakraCore vulnerable to remote code execution
ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memor…
-
Unscored —
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows S…
-
Unscored —CVE-2017-5717 Public exploit
Type Confusion in Content Protection HECI Service in Intel Graphics Driver allows unprivileged user to elevate privileg…
-
High 8.1
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. …
KEV Dec 10, 2021 -
Unscored —
An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jque…
-
Unscored —CVE-2014-8358 Public exploit
Huawei EC156, EC176, and EC177 USB Modem products with software before UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014…
-
Unscored —CVE-2017-11319 Public exploit
Perspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and …
-
Unscored —CVE-2017-17111 Public exploit
Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-detai…
-
Unscored —CVE-2017-17110 Public exploit
Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.