Overview 1,564 matches · 186 in Waratek scope · 14 protected · 10 exploited · 6 CISA KEV · 110 public PoC · 26 EPSS ≥ 0.5
1,564matches
186in Waratek scope11.9%
14protected0.9%
10exploited0.6%
6CISA KEV0.4%
110public PoC7.0%
26EPSS ≥ 0.51.7%
Protected by Waratek
14
0.9%
Rule in development
0
0.0%
Mitigation candidate
3
0.2%
No exploit published
169
10.8%
Outside Waratek scope
48
3.1%
Not applicable
1,306
83.5%
Withdrawn CVE
24
1.5%
blocked by ARMR today
14
0.9%
partly blocked
0
0.0%
not blocked
1,550
99.1%
not established
0
0.0%
unrecorded
0
0.0%
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2017-7855 | Medium | 2017-08-31 | Not applicable | Working exploit published | In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" parameter. |
| CVE-2017-1450 | Medium | 2017-08-31 | Not applicable | No public exploit | IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 128177. |
| CVE-2017-1449 | Medium | 2017-08-31 | Not applicable | No public exploit | IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 128174. |
| CVE-2017-1447 | Medium | 2017-08-31 | Not applicable | No public exploit | IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128172. |
| CVE-2017-1444 | Medium | 2017-08-31 | Not applicable | No public exploit | IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128110. |
| CVE-2017-14076 | Critical | 2017-08-31 | Not applicable | No public exploit | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action. |
| CVE-2017-14070 | Medium | 2017-08-31 | Not applicable | No public exploit | Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to ipsearch.php, related to PHP_SELF. |
| CVE-2017-14069 | Critical | 2017-08-31 | Not applicable | No public exploit | SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php. |
| CVE-2017-14064 | Critical | 2017-08-31 | Not applicable | No public exploit | Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len. |
| CVE-2017-14063 | High | 2017-08-31 | No exploit published | No public exploit | Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL. |
| CVE-2017-14062 | Critical | 2017-08-31 | Not applicable | No public exploit | Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact. |
| CVE-2017-14061 | Critical | 2017-08-31 | Not applicable | No public exploit | Integer overflow in the _isBidi function in bidi.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact. |
| CVE-2017-14060 | Medium | 2017-08-31 | Not applicable | No public exploit | In ImageMagick 7.0.6-10, a NULL Pointer Dereference issue is present in the ReadCUTImage function in coders/cut.c that could allow an attacker to cause a Denial of Service (in the QueueAuthenticPixelCacheNexus function within the MagickCore/cache.c file) by submitting a malformed image file. |
| CVE-2017-14059 | Medium | 2017-08-31 | Not applicable | No public exploit | In FFmpeg 3.3.3, a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption. When a crafted CINE file, which claims a large "duration" field in the header but does not contain sufficient backing data, is provided, the image-offset parsing loop would consume huge CPU and memory resources, since there is no EOF check inside the loop. |
| CVE-2017-14058 | Medium | 2017-08-31 | Not applicable | No public exploit | In FFmpeg 2.4 and 3.3.3, the read_data function in libavformat/hls.c does not restrict reload attempts for an insufficient list, which allows remote attackers to cause a denial of service (infinite loop). |
| CVE-2017-14057 | Medium | 2017-08-31 | Not applicable | No public exploit | In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large "name_len" or "count" field in the header but does not contain sufficient backing data, is provided, the loops over the name and markers would consume huge CPU and memory resources, since there is no EOF check inside these loops. |
| CVE-2017-14056 | Medium | 2017-08-31 | Not applicable | No public exploit | In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted RL2 file, which claims a large "frame_count" field in the header but does not contain sufficient backing data, is provided, the loops (for offset and size tables) would consume huge CPU and memory resources, since there is no EOF check inside these loops. |
| CVE-2017-14055 | Medium | 2017-08-31 | Not applicable | No public exploit | In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop. |
| CVE-2017-14054 | Medium | 2017-08-31 | Not applicable | No public exploit | In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted IVR file, which claims a large "len" field in the header but does not contain sufficient backing data, is provided, the first type==4 loop would consume huge CPU resources, since there is no EOF check inside the loop. |
| CVE-2017-14051 | Medium | 2017-08-31 | Not applicable | No public exploit | An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel through 4.12.10 allows local users to cause a denial of service (memory corruption and system crash) by leveraging root access. |
| CVE-2017-14050 | High | 2017-08-31 | Not applicable | No public exploit | In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file. |
| CVE-2017-14049 | Medium | 2017-08-31 | Not applicable | No public exploit | In BlackCat CMS 1.2, backend/settings/ajax_save_settings.php allows remote authenticated users to conduct XSS attacks via the Website header or Website footer field. |
| CVE-2017-14048 | High | 2017-08-31 | Not applicable | No public exploit | BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php. NOTE: this can be exploited via CSRF. |
| CVE-2017-13708 | Critical | 2017-08-31 | Not applicable | Working exploit published | Buffer overflow in the web server service in VX Search Enterprise 10.0.14 allows remote attackers to execute arbitrary code via a crafted GET request. |
| CVE-2017-13670 | Medium | 2017-08-31 | Not applicable | No public exploit | In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajax_upload.php, as demonstrated by a ZIP archive that contains a .php file. |
| CVE-2017-11158 | High | 2017-08-31 | Not applicable | No public exploit | Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Drive before 4.2.5-4396 on Windows allow local attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory. |
| CVE-2017-0902 | High | 2017-08-31 | Not applicable | No public exploit | RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls. |
| CVE-2017-0901 | High | 2017-08-31 | Not applicable | Working exploit published | RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem. |
| CVE-2017-0900 | High | 2017-08-31 | Not applicable | No public exploit | RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command. |
| CVE-2017-0899 | Critical | 2017-08-31 | Not applicable | No public exploit | RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences. |
| CVE-2016-5795 | High | 2017-08-31 | Not applicable | No public exploit | An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-Vu Version 6.5 and prior. An attacker could enter malicious input to WebCTRL, i-Vu, or SiteScan Web through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network. |
| CVE-2016-10510 | Medium | 2017-08-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by bypassing the strip_image_tags protection mechanism in system/classes/Kohana/Security.php. |
| CVE-2016-10509 | High | 2017-08-31 | Not applicable | No public exploit | SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2.3.0.0 allows remote authenticated administrators to execute arbitrary SQL commands via a carrier (aka courier_id) parameter to openbay.php. |
| CVE-2016-10508 | Medium | 2017-08-31 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in phpThumb() before 1.7.14 allow remote attackers to inject arbitrary web script or HTML via parameters in demo/phpThumb.demo.showpic.php. |
| CVE-2016-0713 | Medium | 2017-08-31 | Not applicable | No public exploit | Gorouter in Cloud Foundry cf-release v141 through v228 allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks via vectors related to modified requests. |
| CVE-2015-7711 | Medium | 2017-08-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in popuphelp.php in ATutor 2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the h parameter. |
| CVE-2015-7700 | Critical | 2017-08-31 | Not applicable | No public exploit | Double-free vulnerability in the sPLT chunk structure and png.c in pngcrush before 1.7.87 allows attackers to have unspecified impact via unknown vectors. |
| CVE-2015-5958 | High | 2017-08-31 | Not applicable | Working exploit published | phpFileManager 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL. |
| CVE-2015-5695 | Medium | 2017-08-31 | Not applicable | No public exploit | Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an internal zone file transfer, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted resource record set. |
| CVE-2014-8677 | Medium | 2017-08-31 | Not applicable | Working exploit published | The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and smarty/templates_c is not writable to execute arbitrary php code via a crafted database name. |
| CVE-2014-8676 | Medium | 2017-08-31 | Not applicable | Working exploit published | Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in a URL path parameter. |
| CVE-2014-8675 | High | 2017-08-31 | Not applicable | Working exploit published | Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash. |
| CVE-2017-9945 | Medium | 2017-08-30 | Not applicable | No public exploit | In the Siemens 7KM PAC Switched Ethernet PROFINET expansion module (All versions < V2.1.3), a Denial-of-Service condition could be induced by a specially crafted PROFINET DCP packet sent as a local Ethernet (Layer 2) broadcast. The affected component requires a manual restart via the main device to recover. |
| CVE-2017-3163 | High | 2017-08-30 | Protected by Waratek | No public exploit | When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process exposed. Solr servers protected and restricted by firewall rules and/or authentication would not be at risk since only trusted clients and users would gain direct HTTP access. |
| CVE-2017-1446 | Medium | 2017-08-30 | Not applicable | No public exploit | IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128171. |
| CVE-2017-1445 | Medium | 2017-08-30 | Not applicable | No public exploit | IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128170. |
| CVE-2017-1443 | Medium | 2017-08-30 | Not applicable | No public exploit | IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128109. |
| CVE-2017-1442 | High | 2017-08-30 | Not applicable | No public exploit | IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 128107. |
| CVE-2017-1441 | Medium | 2017-08-30 | Not applicable | No public exploit | IBM Emptoris Services Procurement 10.0.0.5 could allow a local user to view sensitive information stored locally due to improper access control. IBM X-Force ID: 128106. |
| CVE-2017-1440 | High | 2017-08-30 | Not applicable | No public exploit | IBM Emptoris Services Procurement 10.0.0.5 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a malicious file from a remote system, which could allow the attacker to execute arbitrary code on the vulnerable Web server. IBM X-Force ID: 128105. |
| CVE-2017-14042 | Medium | 2017-08-30 | Not applicable | No public exploit | A memory allocation failure was discovered in the ReadPNMImage function in coders/pnm.c in GraphicsMagick 1.3.26. The vulnerability causes a big memory allocation, which may lead to remote denial of service in the MagickRealloc function in magick/memory.c. |
| CVE-2017-14041 | High | 2017-08-30 | Not applicable | No public exploit | A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution. |
| CVE-2017-14040 | High | 2017-08-30 | Not applicable | No public exploit | An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. The vulnerability may lead to remote denial of service or possibly unspecified other impact. |
| CVE-2017-14039 | High | 2017-08-30 | Not applicable | No public exploit | A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in lib/openjp2/t2.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact. |
| CVE-2017-14038 | Medium | 2017-08-30 | Not applicable | No public exploit | CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability. |
| CVE-2017-14037 | Medium | 2017-08-30 | Not applicable | No public exploit | CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability. |
| CVE-2017-14036 | Medium | 2017-08-30 | Not applicable | No public exploit | CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS. |
| CVE-2017-14035 | Critical | 2017-08-30 | Not applicable | No public exploit | CrushFTP 8.x before 8.2.0 has a serialization vulnerability. |
| CVE-2017-14032 | High | 2017-08-30 | Not applicable | No public exploit | ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected. |
| CVE-2017-13780 | High | 2017-08-30 | Not applicable | No public exploit | The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows directory traversal attacks for reading arbitrary files via the module/admin_conf/download.php file parameter. |
| CVE-2017-13778 | Medium | 2017-08-30 | Not applicable | No public exploit | Fiyo CMS 2.0.7 has XSS in dapur\apps\app_config\sys_config.php via the site_name parameter. |
| CVE-2017-13777 | Medium | 2017-08-30 | Not applicable | No public exploit | GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version==10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it. |
| CVE-2017-13776 | Medium | 2017-08-30 | Not applicable | No public exploit | GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version!=10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it. |
| CVE-2017-13775 | Medium | 2017-08-30 | Not applicable | No public exploit | GraphicsMagick 1.3.26 has a denial of service issue in ReadJNXImage() in coders/jnx.c whereby large amounts of CPU and memory resources may be consumed although the file itself does not support the requests. |
| CVE-2017-13774 | High | 2017-08-30 | Not applicable | No public exploit | Hikvision iVMS-4200 devices before v2.6.2.7 allow local users to generate password-recovery codes via unspecified vectors. |
| CVE-2017-13769 | Medium | 2017-08-30 | Not applicable | No public exploit | The WriteTHUMBNAILImage function in coders/thumbnail.c in ImageMagick through 7.0.6-10 allows an attacker to cause a denial of service (buffer over-read) by sending a crafted JPEG file. |
| CVE-2017-13768 | Medium | 2017-08-30 | Not applicable | No public exploit | Null Pointer Dereference in the IdentifyImage function in MagickCore/identify.c in ImageMagick through 7.0.6-10 allows an attacker to perform denial of service by sending a crafted image file. |
| CVE-2017-13767 | High | 2017-08-30 | Not applicable | No public exploit | In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSDP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-msdp.c by adding length validation. |
| CVE-2017-13766 | High | 2017-08-30 | Not applicable | No public exploit | In Wireshark 2.4.0 and 2.2.0 to 2.2.8, the Profinet I/O dissector could crash with an out-of-bounds write. This was addressed in plugins/profinet/packet-dcerpc-pn-io.c by adding string validation. |
| CVE-2017-13765 | High | 2017-08-30 | Not applicable | No public exploit | In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the IrCOMM dissector has a buffer over-read and application crash. This was addressed in plugins/irda/packet-ircomm.c by adding length validation. |
| CVE-2017-13764 | High | 2017-08-30 | Not applicable | No public exploit | In Wireshark 2.4.0, the Modbus dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/packet-mbtcp.c by adding length validation. |
| CVE-2017-13763 | High | 2017-08-30 | No exploit published | No public exploit | ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited. |
| CVE-2017-13762 | Medium | 2017-08-30 | Not applicable | No public exploit | ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS. |
| CVE-2017-12735 | High | 2017-08-30 | Not applicable | No public exploit | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic. |
| CVE-2017-12734 | High | 2017-08-30 | Not applicable | No public exploit | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V1.81.2). An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use the integrated webserver on port 80/tcp only in trusted networks. |
| CVE-2017-12717 | High | 2017-08-30 | Not applicable | No public exploit | An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A maliciously crafted dll file placed earlier in the search path may allow an attacker to execute code within the context of the application. |
| CVE-2017-12713 | High | 2017-08-30 | Not applicable | No public exploit | An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multiple files and folders with ACLs that affect other users are allowed to be modified by non-administrator accounts. |
| CVE-2017-12711 | High | 2017-08-30 | Not applicable | No public exploit | An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A built-in user account has been granted a sensitive privilege that may allow a user to elevate to administrative privileges. |
| CVE-2017-12710 | High | 2017-08-30 | Not applicable | No public exploit | A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to obtain sensitive information. |
| CVE-2017-12708 | Critical | 2017-08-30 | Not applicable | No public exploit | An Improper Restriction Of Operations Within The Bounds Of A Memory Buffer issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities that allow invalid locations to be referenced for the memory buffer, which may allow an attacker to execute arbitrary code or cause the system to crash. |
| CVE-2017-12706 | Critical | 2017-08-30 | Not applicable | No public exploit | A stack-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities where there is a lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer, which could allow an attacker to execute arbitrary code under the context of the process. |
| CVE-2017-12704 | High | 2017-08-30 | Not applicable | No public exploit | A heap-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities where there is a lack of proper validation of the length of user-supplied data prior to copying it to the heap-based buffer, which could allow an attacker to execute arbitrary code under the context of the process. |
| CVE-2017-12702 | High | 2017-08-30 | Not applicable | No public exploit | An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. String format specifiers based on user provided input are not properly validated, which could allow an attacker to execute arbitrary code. |
| CVE-2017-12698 | Critical | 2017-08-30 | Not applicable | No public exploit | An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Specially crafted requests allow a possible authentication bypass that could allow remote code execution. |
| CVE-2017-12069 | High | 2017-08-30 | Not applicable | No public exploit | An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.03.367. Among the affected products are Siemens SIMATIC PCS7 (All versions V8.1 and earlier), SIMATIC WinCC (All versions < V7.4 SP1), SIMATIC WinCC Runtime Professional (All versions < V14 SP1), SIMATIC NET PC Software, and SIMATIC IT Production Suite. By sending specially crafted packets to the OPC Discovery Server at port 4840/tcp, an attacker might cause the system to access various resources chosen by the attacker. |
| CVE-2017-11157 | High | 2017-08-30 | Not applicable | No public exploit | Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Backup before 4.2.5-4396 on Windows allow local attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory. |
| CVE-2016-6800 | Medium | 2017-08-30 | Not applicable | No public exploit | The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not properly sanitized. It is possible to inject arbitrary JavaScript code in these form fields. This code gets executed from the browser of every user who is visiting this article. Mitigation: Upgrade to Apache OFBiz 16.11.01. |
| CVE-2016-5001 | Medium | 2017-08-30 | No exploit published | No public exploit | This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token. |
| CVE-2016-4462 | High | 2017-08-30 | Not applicable | No public exploit | By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01 |
| CVE-2016-10507 | Medium | 2017-08-30 | Not applicable | No public exploit | Integer overflow vulnerability in the bmp24toimage function in convertbmp.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted bmp file. |
| CVE-2016-10506 | Medium | 2017-08-30 | Not applicable | No public exploit | Division-by-zero vulnerabilities in the functions opj_pi_next_cprl, opj_pi_next_pcrl, and opj_pi_next_rpcl in pi.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files. |
| CVE-2016-10505 | Medium | 2017-08-30 | Not applicable | No public exploit | NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files. |
| CVE-2016-10504 | Medium | 2017-08-30 | Not applicable | Working exploit published | Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (application crash) via a crafted bmp file. |
| CVE-2017-3757 | High | 2017-08-29 | Not applicable | No public exploit | An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand notebooks (not ThinkPads). This could allow an attacker with local privileges to execute code with administrative privileges. |
| CVE-2017-3746 | High | 2017-08-29 | Not applicable | No public exploit | ThinkPad USB 3.0 Ethernet Adapter (part number 4X90E51405) driver, various versions, was found to contain a privilege escalation vulnerability that could allow a local user to execute arbitrary code with administrative or system level privileges. |
| CVE-2017-3155 | Medium | 2017-08-29 | No exploit published | No public exploit | Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting. |
| CVE-2017-3154 | High | 2017-08-29 | No exploit published | No public exploit | Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information. |
| CVE-2017-3153 | Medium | 2017-08-29 | No exploit published | No public exploit | Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality. |
| CVE-2017-3152 | Medium | 2017-08-29 | No exploit published | No public exploit | Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality. |
| CVE-2017-3151 | Medium | 2017-08-29 | No exploit published | No public exploit | Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionality. |