Users login

Create an account »

JOIN XATRIX

Users login

Home » CVE vulnerabilities

CVE Vulnerabilities

CVE vulnerabilities is a database of publicly known information security vulnerabilities and exposures.
Page: 123456 out of 2784

CVE-2017-6808 | March 11, 2017
paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.faq.php (id parameter).
Severity: Medium | Impact score: 2.90 | Exploit score: 8.60
Vendors affected: Mangoswebv4_project

CVE-2017-6513 | March 11, 2017
The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which allows remote authenticated users to control other virtual machines managed by Virtualizor by accessing a modified URL.
Severity: | Impact score: 0.00 | Exploit score: 0.00

CVE-2017-6466 | March 11, 2017
F-Secure Software Updater 2.20, as distributed in several F-Secure products, downloads installation packages over plain http and does not perform file integrity validation after download. Man-in-the-middle attackers can replace the file with their own executable which will be executed under the SYSTEM account. Note that when Software Updater is configured to install updates automatically, it checks if the downloaded file is digitally signed by default, but does not check the author of the signature. When running in manual mode (default), no signature check is performed.
Severity: | Impact score: 0.00 | Exploit score: 0.00

CVE-2017-6804 | March 10, 2017
A Stored XSS Vulnerability exists in the WP Markdown Editor (aka wp-markdown-editor) plugin 2.0.3 for WordPress. An example attack vector is a crafted IMG element in Add New Post or Edit Post.
Severity: Medium | Impact score: 2.90 | Exploit score: 8.60
Vendors affected: Wp_markdown_editor_project

CVE-2017-6802 | March 10, 2017
An issue was discovered in ytnef before 1.9.2. There is a potential heap-based buffer over-read on incoming Compressed RTF Streams, related to DecompressRTF() in libytnef.
Severity: Medium | Impact score: 2.90 | Exploit score: 10.00
Vendors affected: Ytnef_project

CVE-2017-6801 | March 10, 2017
An issue was discovered in ytnef before 1.9.2. There is a potential out-of-bounds access with fields of Size 0 in TNEFParse() in libytnef.
Severity: Medium | Impact score: 2.90 | Exploit score: 10.00
Vendors affected: Ytnef_project

CVE-2017-6800 | March 10, 2017
An issue was discovered in ytnef before 1.9.2. An invalid memory access (heap-based buffer over-read) can occur during handling of LONG data types, related to MAPIPrint() in libytnef.
Severity: Medium | Impact score: 2.90 | Exploit score: 10.00
Vendors affected: Ytnef_project

CVE-2017-6799 | March 10, 2017
A cross-site scripting (XSS) vulnerability in view_filters_page.php in MantisBT before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'view_type' parameter.
Severity: Medium | Impact score: 2.90 | Exploit score: 8.60
Vendors affected: Mantisbt

CVE-2017-6798 | March 10, 2017
Trend Micro Endpoint Sensor 1.6 before b1290 has a DLL hijacking vulnerability that allows remote attackers to execute arbitrary code, aka Trend Micro Vulnerability Identifier 2015-0208.
Severity: High | Impact score: 10.00 | Exploit score: 8.60
Vendors affected: Trend_micro

CVE-2017-6596 | March 10, 2017
partclone.chkimg in partclone 0.2.89 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone image header. An attacker may be able to launch a 'Denial of Service attack' in the context of the user running the affected application.
Severity: Medium | Impact score: 2.90 | Exploit score: 8.60
Vendors affected: Partclone_project

CVE-2017-6506 | March 10, 2017
In Azure Data Expert Ultimate 2.2.16, the SMTP verification function suffers from a buffer overflow vulnerability, leading to remote code execution. The attack vector is a crafted SMTP daemon that sends a long 220 (aka "Service ready") string.
Severity: | Impact score: 0.00 | Exploit score: 0.00

CVE-2017-6427 | March 10, 2017
A Buffer Overflow was discovered in EvoStream Media Server 1.7.1. A crafted HTTP request with a malicious header will cause a crash. An example attack methodology may include a long message-body in a GET request.
Severity: | Impact score: 0.00 | Exploit score: 0.00

CVE-2017-5859 | March 10, 2017
On Cambium Networks cnPilot R200/201 devices before 4.3, there is a vulnerability involving the certificate of the device and its RSA keys, aka RBN-183.
Severity: High | Impact score: 10.00 | Exploit score: 10.00
Vendors affected: Cambium_networks

CVE-2017-5638 | March 10, 2017
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 mishandles file upload, which allows remote attackers to execute arbitrary commands via a #cmd= string in a crafted Content-Type HTTP header, as exploited in the wild in March 2017.
Severity: | Impact score: 0.00 | Exploit score: 0.00

CVE-2017-2788 | March 10, 2017
A buffer overflows exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to a heap based buffer overflow resulting in potential remote code execution. This client is always listening, has root privileges, and requires no user interaction to exploit.
Severity: High | Impact score: 10.00 | Exploit score: 10.00
Vendors affected: Pharos

CVE-2017-2787 | March 10, 2017
A buffer overflows exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to a heap based buffer overflow resulting in potential remote code execution. This client is always listening, has root privileges, and requires no user interaction to exploit.
Severity: High | Impact score: 10.00 | Exploit score: 8.60
Vendors affected: Pharos

CVE-2017-2786 | March 10, 2017
A denial of service vulnerability exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to an out of bounds read causing a crash and a denial of service.
Severity: Medium | Impact score: 2.90 | Exploit score: 10.00
Vendors affected: Pharos

CVE-2017-2785 | March 10, 2017
An exploitable buffer overflow exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to a heap based buffer overflow resulting in remote code execution. This client is always listening, has root privileges, and requires no user interaction to exploit.
Severity: High | Impact score: 10.00 | Exploit score: 10.00
Vendors affected: Pharos

CVE-2017-6797 | March 09, 2017
A cross-site scripting (XSS) vulnerability in bug_change_status_page.php in MantisBT before 1.3.7 and 2.x before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'action_type' parameter.
Severity: Medium | Impact score: 2.90 | Exploit score: 8.60
Vendors affected: Mantisbt

CVE-2017-6591 | March 09, 2017
There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field.
Severity: Medium | Impact score: 2.90 | Exploit score: 8.60
Vendors affected: Django-epiceditor_project

CVE-2017-6590 | March 09, 2017
An issue was discovered in network-manager-applet (aka network-manager-gnome) in Ubuntu 12.04 LTS, 14.04 LTS, 16.04 LTS, and 16.10. A local attacker could use this issue at the default Ubuntu login screen to access local files and execute arbitrary commands as the lightdm user. The exploitation requires physical access to the locked computer and the Wi-Fi must be turned on. An access point that lets you use a certificate to login is required as well, but it's easy to create one. Then, it's possible to open a nautilus window and browse directories. One also can open some applications such as Firefox, which is useful for downloading malicious binaries.
Severity: Medium | Impact score: 10.00 | Exploit score: 3.40
Vendors affected: Canonical

CVE-2017-6589 | March 09, 2017
EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML document.
Severity: Medium | Impact score: 2.90 | Exploit score: 8.60
Vendors affected: Epiceditor_project

CVE-2017-6578 | March 09, 2017
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the POST Parameter: subscriber_email.
Severity: Medium | Impact score: 6.40 | Exploit score: 8.00
Vendors affected: Mail-masta_project

CVE-2017-6577 | March 09, 2017
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the POST Parameter: list_id.
Severity: Medium | Impact score: 6.40 | Exploit score: 8.00
Vendors affected: Mail-masta_project

CVE-2017-6576 | March 09, 2017
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/campaign/campaign-delete.php with the GET Parameter: id.
Severity: Medium | Impact score: 6.40 | Exploit score: 8.00
Vendors affected: Mail-masta_project

Page: 123456 out of 2784

Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »