CVE-database
133.515 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2017-6444 HIGH · 7.5 The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast network connection, which allows… Mikrotik
- CVE-2017-5626 CRITICAL · 9.8 OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unlock the… Oneplus
- CVE-2017-5624 CRITICAL · 9.8 An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the (locked) bootloader start the platform with… Oneplus
- CVE-2017-6819 MEDIUM · 6.5 In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources. The CSRF can trigger… Wordpress
- CVE-2017-6818 MEDIUM · 6.1 In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names. Wordpress
- CVE-2017-6817 MEDIUM · 5.4 In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds. Wordpress Debian
- CVE-2017-6816 MEDIUM · 4.9 In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality. Wordpress Debian
- CVE-2017-6815 MEDIUM · 6.1 In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation. Wordpress Debian
- CVE-2017-6814 MEDIUM · 5.4 In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode… Wordpress Debian
- CVE-2017-6812 MEDIUM · 6.1 paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.vote.php (id parameter). Mangoswebv4 Project
- CVE-2017-6811 MEDIUM · 6.1 paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.shop.php (id parameter). Mangoswebv4 Project
- CVE-2017-6810 MEDIUM · 6.1 paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.fplinks.php (linkid parameter). Mangoswebv4 Project
- CVE-2017-6809 MEDIUM · 6.1 paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.donate.php (id parameter). Mangoswebv4 Project
- CVE-2017-6808 MEDIUM · 6.1 paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.faq.php (id parameter). Mangoswebv4 Project
- CVE-2017-6513 CRITICAL · 9.9 The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which allows remote authenticated users to control other… Softaculous
- CVE-2017-6466 HIGH · 8.1 F-Secure Software Updater 2.20, as distributed in several F-Secure products, downloads installation packages over plain http and does not perform file integrity validation after download.… F-secure
- CVE-2010-4314 HIGH · 8.8 Remote attackers can use the iPrint web-browser ActiveX plugin in Novell iPrint Client before 5.42 for Windows XP/Vista/Win7 to execute code by overflowing the "name"… Novell Microsoft
- CVE-2017-6802 HIGH · 7.5 An issue was discovered in ytnef before 1.9.2. There is a potential heap-based buffer over-read on incoming Compressed RTF Streams, related to DecompressRTF() in libytnef. Ytnef Project Debian
- CVE-2017-6801 HIGH · 7.5 An issue was discovered in ytnef before 1.9.2. There is a potential out-of-bounds access with fields of Size 0 in TNEFParse() in libytnef. Ytnef Project Debian
- CVE-2017-6800 HIGH · 7.5 An issue was discovered in ytnef before 1.9.2. An invalid memory access (heap-based buffer over-read) can occur during handling of LONG data types, related to… Ytnef Project Debian
- CVE-2017-6799 MEDIUM · 6.1 A cross-site scripting (XSS) vulnerability in view_filters_page.php in MantisBT before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'view_type' parameter. Mantisbt
- CVE-2017-6798 HIGH · 7.8 Trend Micro Endpoint Sensor 1.6 before b1290 has a DLL hijacking vulnerability that allows remote attackers to execute arbitrary code, aka Trend Micro Vulnerability Identifier… Trendmicro
- CVE-2017-6596 MEDIUM · 5.5 partclone.chkimg in partclone 0.2.89 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone image header. An attacker may be… Partclone Project
- CVE-2017-6506 CRITICAL · 9.8 In Azure Data Expert Ultimate 2.2.16 lijdt de SMTP-verificatiefunctie aan een kwetsbaarheid voor bufferoverloop, wat leidt tot uitvoering van externe code. De aanvalsvector is een… Azure Dex
- CVE-2017-6427 HIGH · 7.5 A Buffer Overflow was discovered in EvoStream Media Server 1.7.1. A crafted HTTP request with a malicious header will cause a crash. An example attack… Evostream
- CVE-2017-5859 CRITICAL · 9.8 On Cambium Networks cnPilot R200/201 devices before 4.3, there is a vulnerability involving the certificate of the device and its RSA keys, aka RBN-183. Cambiumnetworks
- CVE-2017-2788 CRITICAL · 10.0 A buffer overflows exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the… Pharos
- CVE-2017-2787 CRITICAL · 9.0 A buffer overflows exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the… Pharos
- CVE-2017-2786 HIGH · 7.5 A denial of service vulnerability exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent… Pharos
- CVE-2017-2785 CRITICAL · 10.0 An exploitable buffer overflow exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to… Pharos
- CVE-2016-8714 HIGH · 8.8 An exploitable buffer overflow vulnerability exists in the LoadEncoding functionality of the R programming language version 3.3.0. A specially crafted R script can cause a… R Project Debian
- CVE-2017-6355 MEDIUM · 5.5 Integer overflow in the vrend_create_shader function in vrend_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (process crash)… Freedesktop
- CVE-2017-6314 MEDIUM · 5.5 The make_available_at_least function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (infinite loop) via a large TIFF file. Gnome Fedoraproject Debian
- CVE-2017-6313 HIGH · 7.1 Integer underflow in the load_resources function in io-icns.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (out-of-bounds read and program crash) via… Gnome Fedoraproject Debian
- CVE-2017-6312 MEDIUM · 5.5 Integer overflow in io-ico.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted image entry… Gnome Fedoraproject Debian
- CVE-2017-6311 HIGH · 7.5 gdk-pixbuf-thumbnailer.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors related to printing an error… Gnome Fedoraproject
- CVE-2017-5872 HIGH · 7.5 The TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 57.1 before 57.152, 58.1 before 58.142, or 59.1 before 59.172, when running a TLS… Unisys
- CVE-2015-2330 HIGH · 7.5 Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies. Webkitgtk
- CVE-2017-6465 CRITICAL · 9.8 Remote Code Execution was discovered in FTPShell Client 6.53. By default, the client sends a PWD command to the FTP server it is connecting to;… Ftpshell
- CVE-2017-4960 HIGH · 7.5 An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26. There… Cloudfoundry Pivotal Software
- CVE-2017-6797 MEDIUM · 6.1 A cross-site scripting (XSS) vulnerability in bug_change_status_page.php in MantisBT before 1.3.7 and 2.x before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'action_type'… Mantisbt
- CVE-2017-6591 MEDIUM · 6.1 There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field. Django-epiceditor Project
- CVE-2017-6590 MEDIUM · 6.3 An issue was discovered in network-manager-applet (aka network-manager-gnome) in Ubuntu 12.04 LTS, 14.04 LTS, 16.04 LTS, and 16.10. A local attacker could use this issue… Canonical
- CVE-2017-6589 MEDIUM · 6.1 EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML… Epiceditor Project
- CVE-2017-6529 HIGH · 8.8 Er is een probleem ontdekt in dnaTools dnaLIMS 4-2015s13. dnaLIMS is kwetsbaar voor sessiekaping door de UID-parameter te raden. Dnatools
- CVE-2017-6528 HIGH · 8.1 Er is een probleem ontdekt in dnaTools dnaLIMS 4-2015s13. dnaLIMS wordt beïnvloed door wachtwoordopslag in platte tekst (het bestand/home/dna/spool/.pfile). Dnatools
- CVE-2017-6527 HIGH · 7.5 An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files… Dnatools
- CVE-2017-6526 CRITICAL · 9.8 An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi POST requests). Dnatools
- CVE-2017-6432 HIGH · 8.1 An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unencrypted, binary… Dahuasecurity
- CVE-2017-6578 HIGH · 7.2 A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the… Mail-masta Project