WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Published to 2017-12-31✕
Overview 46,205 matches · 2,341 in Waratek scope · 151 protected · 220 exploited · 30 CISA KEV · 9,221 public PoC · 366 EPSS ≥ 0.5
split by peak 5,687 / year
Not applicable: 42,965Outside Waratek scope: 899No exploit published: 2,079Mitigation candidate: 111Protected by Waratek: 151 Medium: 46,205 not established: 3not blocked: 46,051blocked by ARMR today: 151 No public exploit: 36,760Forecast only: 101Proof of concept only: 52Working exploit published: 9,072Exploited: 220
19891 Not applicable1 Medium1 not blocked1 No public exploit1 19902 Not applicable2 Medium2 not blocked2 Working exploit published1 No public exploit1 19914 Not applicable4 Medium4 not blocked4 No public exploit4 19920 19933 Not applicable3 Medium3 not blocked3 No public exploit3 199410 Not applicable10 Medium10 not blocked10 Working exploit published2 No public exploit8 19956 Not applicable6 Medium6 not blocked6 Working exploit published2 No public exploit4 199621 Not applicable21 Medium21 not blocked21 Working exploit published5 No public exploit16 199789 Not applicable89 Medium89 not blocked89 Working exploit published18 No public exploit71 199885 Not applicable85 Medium85 not blocked85 Working exploit published11 No public exploit74 1999357 Outside Waratek scope1 Not applicable356 Medium357 not blocked357 Working exploit published119 No public exploit238 2000467 Mitigation candidate4 No exploit published3 Not applicable460 Medium467 not blocked467 Exploited2 Working exploit published195 No public exploit270 2001706 Mitigation candidate2 No exploit published4 Outside Waratek scope7 Not applicable693 Medium706 not blocked706 Exploited3 Working exploit published219 Forecast only2 No public exploit482 2002980 Protected by Waratek2 Mitigation candidate6 No exploit published15 Outside Waratek scope4 Not applicable953 Medium980 blocked by ARMR today2 not blocked978 Exploited3 Working exploit published246 Forecast only3 No public exploit728 2003747 Protected by Waratek2 Mitigation candidate4 No exploit published18 Outside Waratek scope1 Not applicable722 Medium747 blocked by ARMR today2 not blocked745 Working exploit published243 No public exploit504 20041,265 Protected by Waratek1 Mitigation candidate1 No exploit published16 Outside Waratek scope4 Not applicable1,243 Medium1,265 blocked by ARMR today1 not blocked1,264 Exploited10 Working exploit published414 Forecast only1 No public exploit840 20052,430 Protected by Waratek3 Mitigation candidate4 No exploit published39 Outside Waratek scope6 Not applicable2,378 Medium2,430 blocked by ARMR today3 not blocked2,427 Exploited8 Working exploit published622 Forecast only6 No public exploit1,794 20063,324 Protected by Waratek4 Mitigation candidate4 No exploit published48 Outside Waratek scope3 Not applicable3,265 Medium3,324 blocked by ARMR today4 not blocked3,320 Exploited10 Working exploit published1,137 Forecast only2 No public exploit2,175 20073,101 Protected by Waratek2 Mitigation candidate9 No exploit published60 Outside Waratek scope53 Not applicable2,977 Medium3,101 blocked by ARMR today2 not blocked3,099 Exploited14 Working exploit published1,052 Forecast only1 No public exploit2,034 20082,582 Protected by Waratek4 Mitigation candidate8 No exploit published71 Outside Waratek scope26 Not applicable2,473 Medium2,582 blocked by ARMR today4 not blocked2,578 Exploited7 Working exploit published987 Proof of concept only2 Forecast only1 No public exploit1,585 20092,786 Protected by Waratek5 Mitigation candidate9 No exploit published115 Outside Waratek scope31 Not applicable2,626 Medium2,786 blocked by ARMR today5 not blocked2,781 Exploited16 Working exploit published1,123 Proof of concept only2 Forecast only3 No public exploit1,642 20102,241 Protected by Waratek6 Mitigation candidate9 No exploit published118 Outside Waratek scope34 Not applicable2,074 Medium2,241 blocked by ARMR today6 not blocked2,235 Exploited14 Working exploit published547 Proof of concept only1 Forecast only2 No public exploit1,677 20112,101 Protected by Waratek4 Mitigation candidate3 No exploit published132 Outside Waratek scope58 Not applicable1,904 Medium2,101 blocked by ARMR today4 not blocked2,097 Exploited9 Working exploit published294 Proof of concept only3 Forecast only1 No public exploit1,794 20123,035 Protected by Waratek5 Mitigation candidate17 No exploit published177 Outside Waratek scope50 Not applicable2,786 Medium3,035 blocked by ARMR today5 not blocked3,029 not established1 Exploited20 Working exploit published475 Proof of concept only2 Forecast only42 No public exploit2,496 20132,914 Protected by Waratek12 Mitigation candidate12 No exploit published225 Outside Waratek scope155 Not applicable2,510 Medium2,914 blocked by ARMR today12 not blocked2,901 not established1 Exploited23 Working exploit published237 Proof of concept only1 Forecast only6 No public exploit2,647 20145,314 Protected by Waratek32 Mitigation candidate9 No exploit published215 Outside Waratek scope165 Not applicable4,893 Medium5,314 blocked by ARMR today32 not blocked5,282 Exploited24 Working exploit published415 Proof of concept only7 Forecast only12 No public exploit4,856 20153,501 Protected by Waratek20 Mitigation candidate1 No exploit published205 Outside Waratek scope126 Not applicable3,149 Medium3,501 blocked by ARMR today20 not blocked3,481 Exploited23 Working exploit published254 Proof of concept only7 Forecast only8 No public exploit3,209 20162,446 Protected by Waratek25 Mitigation candidate4 No exploit published292 Outside Waratek scope51 Not applicable2,074 Medium2,446 blocked by ARMR today25 not blocked2,420 not established1 Exploited16 Working exploit published122 Proof of concept only6 Forecast only9 No public exploit2,293 20175,687 Protected by Waratek24 Mitigation candidate5 No exploit published326 Outside Waratek scope124 Not applicable5,208 Medium5,687 blocked by ARMR today24 not blocked5,663 Exploited18 Working exploit published332 Proof of concept only21 Forecast only2 No public exploit5,314
1990199319961999200220052008201120142017
46,205 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 463 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2017-18005 Medium 2017-12-31 Not applicable No public exploit Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a TIFF file.
CVE-2017-18004 Medium 2017-12-31 Not applicable No public exploit Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint.
CVE-2017-17995 Medium 2017-12-30 Not applicable No public exploit Biometric Shift Employee Management System has XSS via the Last_Name parameter in an index.php?user=ajax request.
CVE-2017-17994 Medium 2017-12-30 Not applicable No public exploit Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competency_criteria request.
CVE-2017-17993 Medium 2017-12-30 Not applicable No public exploit Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=addition_deduction request.
CVE-2017-17991 Medium 2017-12-30 Not applicable No public exploit Biometric Shift Employee Management System has XSS via the expense_name parameter in an index.php?user=expenses request.
CVE-2017-17989 Medium 2017-12-30 Not applicable No public exploit Biometric Shift Employee Management System has XSS via the index.php holiday_name parameter in an edit_holiday action.
CVE-2017-17988 Medium 2017-12-30 Not applicable No public exploit PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter.
CVE-2017-17986 Medium 2017-12-30 Not applicable No public exploit PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter.
CVE-2017-17985 Medium 2017-12-30 Not applicable No public exploit PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter.
CVE-2017-17984 Medium 2017-12-30 Not applicable No public exploit PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter.
CVE-2017-17982 Medium 2017-12-30 Not applicable No public exploit PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php.
CVE-2017-17981 Medium 2017-12-30 Not applicable No public exploit PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/slider_edit.php edit_id parameter.
CVE-2017-17975 Medium 2017-12-30 Not applicable No public exploit Use-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c in the Linux kernel through 4.14.10 allows attackers to cause a denial of service (system crash) or possibly have unspecified other impact by triggering failure of audio registration, because a kfree of the usbtv data structure occurs during a usbtv_video_free call, but the usbtv_video_fail label's code attempts to both access and free this data structure.
CVE-2017-17089 Medium 2017-12-30 Not applicable No public exploit custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionality.
CVE-2017-12813 Medium 2017-12-30 Not applicable No public exploit PHPJabbers File Sharing Script 1.0 has stored XSS in the comments section.
CVE-2017-12812 Medium 2017-12-30 Not applicable No public exploit PHPJabbers Night Club Booking Software has stored XSS in the name parameter in the reservations tab.
CVE-2017-12811 Medium 2017-12-30 Not applicable No public exploit PHPJabbers Star Rating Script 4.0 has stored XSS via a rating item.
CVE-2017-12810 Medium 2017-12-30 Not applicable No public exploit PHPJabbers PHP Newsletter Script 4.2 has stored XSS in lists in the admin panel.
CVE-2016-10704 Medium 2017-12-30 Not applicable No public exploit Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503.
CVE-2017-17971 Medium 2017-12-29 Not applicable No public exploit The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS.
CVE-2017-17933 Medium 2017-12-29 Not applicable No public exploit cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter.
CVE-2017-17910 Medium 2017-12-29 Not applicable No public exploit On Hoermann BiSecur devices before 2018, a vulnerability can be exploited by recording a single radio transmission. An attacker can intercept an arbitrary radio frame exchanged between a BiSecur transmitter and a receiver to obtain the encrypted packet and the 32-bit serial number. The interception of the one-time pairing process is specifically not required. Due to use of AES-128 with an initial static random value and static data vector (all of this static information is the same across different customers' installations), the attacker can easily derive the utilized encryption key and decrypt the intercepted packet. The key can be verified by decrypting the intercepted packet and checking for known plaintext. Subsequently, an attacker can create arbitrary radio frames with the correct encryption key to control BiSecur garage and entrance gate operators and possibly other BiSecur systems as well ("wireless cloning"). To conduct the attack, a low cost Software Defined Radio (SDR) is sufficient. This affects Hoermann Hand Transmitter HS5-868-BS, HSE1-868-BS, and HSE2-868-BS devices.
CVE-2017-17760 Medium 2017-12-29 Not applicable No public exploit OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used.
CVE-2017-16876 Medium 2017-12-29 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
CVE-2016-3695 Medium 2017-12-29 Not applicable No public exploit The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequently cause a denial of service by leveraging failure to disable APEI error injection through EINJ when securelevel is set.
CVE-2014-4978 Medium 2017-12-29 Not applicable No public exploit The rs_filter_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary files via a symlink attack on (1) /tmp/rs-filter-graph.png or (2) /tmp/rs-filter-graph.
CVE-2013-4578 Medium 2017-12-29 No exploit published No public exploit jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.
CVE-2017-17967 Medium 2017-12-28 Not applicable No public exploit pptreader.dll in Kingsoft WPS Office 10.1.0.6930 allows remote attackers to cause a denial of service via a crafted PPT file, aka CNVD-2017-35482.
CVE-2017-17958 Medium 2017-12-28 Not applicable No public exploit PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the my_wishlist.php fid parameter.
CVE-2017-17956 Medium 2017-12-28 Not applicable No public exploit PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter.
CVE-2017-17955 Medium 2017-12-28 Not applicable No public exploit PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the shopping-cart.php cusid parameter.
CVE-2017-17954 Medium 2017-12-28 Not applicable No public exploit PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the seller-view.php usid parameter.
CVE-2017-17953 Medium 2017-12-28 Not applicable No public exploit PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the category.php chid1 parameter.
CVE-2017-17949 Medium 2017-12-28 Not applicable No public exploit Cells Blog 3.5 has XSS via the pub_readpost.php fmid parameter.
CVE-2017-17948 Medium 2017-12-28 Not applicable No public exploit Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request.
CVE-2017-17940 Medium 2017-12-28 Not applicable No public exploit PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.
CVE-2017-17938 Medium 2017-12-28 Not applicable No public exploit PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter.
CVE-2017-17937 Medium 2017-12-28 Not applicable No public exploit Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search.
CVE-2017-15892 Medium 2017-12-28 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated users to inject arbitrary web script or HTML via (1) COMMAND, (2) COMMANDS INSTRUCTION, or (3) DESCRIPTION parameter.
CVE-2017-15886 Medium 2017-12-28 Not applicable No public exploit Server-side request forgery (SSRF) vulnerability in Link Preview in Synology Chat before 2.0.0-1124 allows remote authenticated users to download arbitrary local files via a crafted URI.
CVE-2017-10910 Medium 2017-12-28 Not applicable No public exploit MQTT.js 2.x.x prior to 2.15.0 issue in handling PUBLISH tickets may lead to an attacker causing a denial-of-service condition.
CVE-2015-7889 Medium 2017-12-28 Not applicable Working exploit published The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND service action, which might allow remote attackers with knowledge of the local email address to obtain sensitive information via a crafted application that sends a crafted intent.
CVE-2017-9608 Medium 2017-12-27 Not applicable No public exploit The dnxhd decoder in FFmpeg before 3.2.6, and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted mov file.
CVE-2017-7158 Medium 2017-12-27 Not applicable No public exploit An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Screen Sharing Server" component. It allows attackers to obtain root privileges for reading files by leveraging screen-sharing access.
CVE-2017-7154 Medium 2017-12-27 Not applicable Working exploit published An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. The issue involves the "Kernel" component. It allows local users to bypass intended memory-read restrictions or cause a denial of service (system crash).
CVE-2017-7152 Medium 2017-12-27 Not applicable No public exploit An issue was discovered in certain Apple products. iOS before 11.2 is affected. The issue involves the "Mail Message Framework" component. It allows remote attackers to spoof the address bar via a crafted web site.
CVE-2017-17934 Medium 2017-12-27 Not applicable No public exploit ImageMagick 7.0.7-17 Q16 x86_64 has memory leaks in coders/msl.c, related to MSLPopImage and ProcessMSLScript, and associated with mishandling of MSLPushImage calls.
CVE-2017-17929 Medium 2017-12-27 Not applicable No public exploit PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter.
CVE-2017-17927 Medium 2017-12-27 Not applicable No public exploit PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATH_INFO to service-list/category/.
CVE-2017-17926 Medium 2017-12-27 Not applicable No public exploit PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed e-mail address.
CVE-2017-17925 Medium 2017-12-27 Not applicable No public exploit PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title parameter.
CVE-2017-17924 Medium 2017-12-27 Not applicable No public exploit PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the id parameter to admin/review_userwise.php.
CVE-2017-17914 Medium 2017-12-27 Not applicable No public exploit In ImageMagick 7.0.7-16 Q16, a vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows attackers to cause a denial of service (ReadOneMNGImage large loop) via a crafted mng image file.
CVE-2017-17911 Medium 2017-12-27 Not applicable No public exploit packages/core/contact.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?p=core/contact request, aka Open Bug Bounty ID OBB-278503.
CVE-2017-17909 Medium 2017-12-27 Not applicable No public exploit PHP Scripts Mall Responsive Realestate Script has XSS via the admin/general.php gplus parameter.
CVE-2017-17907 Medium 2017-12-27 Not applicable No public exploit PHP Scripts Mall Car Rental Script has XSS via the admin/areaedit.php carid parameter or the admin/sitesettings.php websitename parameter.
CVE-2017-17904 Medium 2017-12-27 Not applicable No public exploit FS Lynda Clone has XSS via the keywords parameter to tutorial/ or the edit_profile_first_name parameter to user/edit_profile.
CVE-2017-17896 Medium 2017-12-27 Not applicable No public exploit Readymade Job Site Script has XSS via the keyword parameter to the /job URI.
CVE-2017-17893 Medium 2017-12-27 Not applicable No public exploit Readymade Video Sharing Script has XSS via the search_video.php search parameter, the viewsubs.php chnlid parameter, or the user-profile-edit.php fname parameter.
CVE-2017-17887 Medium 2017-12-27 Not applicable No public exploit In ImageMagick 7.0.7-16 Q16, a memory leak vulnerability was found in the function GetImagePixelCache in magick/cache.c, which allows attackers to cause a denial of service via a crafted MNG image file that is processed by ReadOneMNGImage.
CVE-2017-17886 Medium 2017-12-27 Not applicable No public exploit In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPSDChannelZip in coders/psd.c, which allows attackers to cause a denial of service via a crafted psd image file.
CVE-2017-17885 Medium 2017-12-27 Not applicable No public exploit In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPICTImage in coders/pict.c, which allows attackers to cause a denial of service via a crafted PICT image file.
CVE-2017-17884 Medium 2017-12-27 Not applicable No public exploit In ImageMagick 7.0.7-16 Q16, a memory leak vulnerability was found in the function WriteOnePNGImage in coders/png.c, which allows attackers to cause a denial of service via a crafted PNG image file.
CVE-2017-17883 Medium 2017-12-27 Not applicable No public exploit In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPGXImage in coders/pgx.c, which allows attackers to cause a denial of service via a crafted PGX image file.
CVE-2017-17882 Medium 2017-12-27 Not applicable No public exploit In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in coders/xpm.c, which allows attackers to cause a denial of service via a crafted XPM image file.
CVE-2017-17881 Medium 2017-12-27 Not applicable No public exploit In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service via a crafted MAT image file.
CVE-2017-17869 Medium 2017-12-27 Not applicable No public exploit The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter.
CVE-2017-17868 Medium 2017-12-27 Not applicable No public exploit In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter (p_r_p) value, as demonstrated by p_r_p_564233524_tag.
CVE-2017-17862 Medium 2017-12-27 Not applicable No public exploit kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service.
CVE-2017-17859 Medium 2017-12-27 Not applicable No public exploit Samsung Internet Browser 6.2.01.12 allows remote attackers to bypass the Same Origin Policy, and conduct UXSS attacks to obtain sensitive information, via vectors involving an IFRAME element inside XSLT data in one part of an MHTML file. Specifically, JavaScript code in another part of this MHTML file does not have a document.domain value corresponding to the domain that is hosting the MHTML file, but instead has a document.domain value corresponding to an arbitrary URL within the content of the MHTML file.
CVE-2017-17844 Medium 2017-12-27 Not applicable No public exploit An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot directly decrypt) to a victim, and relying on the victim to automatically decrypt that block and then send it back to the attacker as quoted text, aka the TBE-01-005 "replay" issue.
CVE-2017-17843 Medium 2017-12-27 Not applicable No public exploit An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.
CVE-2017-17832 Medium 2017-12-27 Not applicable No public exploit ServersCheck Monitoring Software before 14.2.3 is prone to a cross-site scripting vulnerability as user supplied-data is not validated/sanitized when passed in the settings_SMS_ALERT_TYPE parameter, and JavaScript can be executed on settings-save.html (the Settings - SMS Alerts page).
CVE-2017-1698 Medium 2017-12-27 Not applicable No public exploit IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could reveal sensitive information from an error message that could lead to further attacks against the system. IBM X-Force ID: 124390.
CVE-2017-16768 Medium 2017-12-27 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in User Policy editor in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary HTML via the name parameter.
CVE-2017-1365 Medium 2017-12-27 Not applicable No public exploit IBM Team Concert (RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 126858.
CVE-2017-1191 Medium 2017-12-27 Not applicable No public exploit An undisclosed vulnerability in CLM applications (including IBM Rational Collaborative Lifecycle Management 4.0, 5.0, and 6.0) with potential for failure to restrict URL Access. IBM X-Force ID: 123661.
CVE-2015-7668 Medium 2017-12-27 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map_id parameter.
CVE-2015-7667 Medium 2017-12-27 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in the ResAds plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter.
CVE-2015-7666 Medium 2017-12-27 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal parameter.
CVE-2015-7324 Medium 2017-12-27 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) img or (2) url tag of a new comment.
CVE-2017-12740 Medium 2017-12-26 Outside Waratek scope No public exploit Siemens LOGO! Soft Comfort (All versions before V8.2) lacks integrity verification of software packages downloaded via an unprotected communication channel. This could allow a remote attacker to manipulate the software package while performing a Man-in-the-Middle (MitM) attack.
CVE-2017-13869 Medium 2017-12-25 Not applicable Working exploit published An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVE-2017-13868 Medium 2017-12-25 Not applicable Working exploit published An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVE-2017-13865 Medium 2017-12-25 Not applicable Working exploit published An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVE-2017-13864 Medium 2017-12-25 Not applicable No public exploit An issue was discovered in certain Apple products. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. The issue involves the "APNs Server" component. It allows man-in-the-middle attackers to track users by leveraging mishandling of client certificates.
CVE-2017-13860 Medium 2017-12-25 Not applicable No public exploit An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. The issue involves the "Mail Drafts" component. It allows man-in-the-middle attackers to read e-mail content by leveraging mishandling of S/MIME credential encryption.
CVE-2017-13855 Medium 2017-12-25 Not applicable Working exploit published An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app that triggers type confusion.
CVE-2017-16766 Medium 2017-12-22 Not applicable No public exploit An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager (DSM) before 6.1.4-15217 and before 6.0.3-8754-6 allows local users to inject arbitrary web script or HTML via the -fn option.
CVE-2017-15322 Medium 2017-12-22 Not applicable No public exploit Some Huawei smartphones with software of BGO-L03C158B003CUSTC158D001 and BGO-L03C331B009CUSTC331D001 have a DoS vulnerability due to insufficient input validation. An attacker could exploit this vulnerability by sending specially crafted NFC messages to the target device. Successful exploit could make a service crash.
CVE-2017-15312 Medium 2017-12-22 Not applicable No public exploit Huawei SmartCare V200R003C10 has a stored XSS (cross-site scripting) vulnerability in the dashboard module. A remote authenticated attacker could exploit this vulnerability to inject malicious scripts in the affected device.
CVE-2017-15310 Medium 2017-12-22 Not applicable No public exploit Huawei iReader app before 8.0.2.301 has an arbitrary file deletion vulnerability due to the lack of input validation. An attacker can exploit this vulnerability to delete specific files from the SD card.
CVE-2017-10907 Medium 2017-12-22 Not applicable No public exploit Directory traversal vulnerability in OneThird CMS Show Off v1.85 and earlier. Show Off v1.85 en and earlier allows an attacker to read arbitrary files via unspecified vectors.
CVE-2017-10872 Medium 2017-12-22 Not applicable No public exploit H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via unspecified vectors.
CVE-2017-6139 Medium 2017-12-21 Not applicable No public exploit In F5 BIG-IP APM software version 13.0.0 and 12.1.2, under rare conditions, the BIG-IP APM system appends log details when responding to client requests. Details in the log file can vary; customers running debug mode logging with BIG-IP APM are at highest risk.
CVE-2017-6136 Medium 2017-12-21 Not applicable No public exploit In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, undisclosed traffic patterns sent to BIG-IP virtual servers, with the TCP Fast Open and Tail Loss Probe options enabled in the associated TCP profile, may cause a disruption of service to the Traffic Management Microkernel (TMM).
CVE-2017-6134 Medium 2017-12-21 Not applicable No public exploit In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, 12.1.0 - 12.1.2 and 11.5.1 - 11.6.1, an undisclosed sequence of packets, sourced from an adjacent network may cause TMM to crash.
CVE-2017-17830 Medium 2017-12-21 Not applicable No public exploit Bus Booking Script has CSRF via admin/new_master.php.
CVE-2017-17828 Medium 2017-12-21 Not applicable No public exploit Bus Booking Script has XSS via the results.php datepicker parameter or the admin/new_master.php spemail parameter.
‹ prev page 1 of 463 next ›