CVEs from 2017
Total
11,681
critical
critical 1,647
high
high 5,041
medium
medium 4,168
low
low 159
% Critical
14.1%
% with KEV
0.7%
% with exploit
9.8%
Top vendors
Top products
- imagemagick 1,426
- joomla\! 932
- kanboard 848
- ntp 762
- tomcat 676
- mahara 572
- postgresql 492
- asterisk 435
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-2234 | critical | 9.8 | 9.8 | 9y ago | Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier, Toshiba Home gateway HEM-GW26A firmware HEM-GW26A-FW-V1.2.0 and earlier may allow remote attackers to access a non-documented … | |||
| CVE-2017-2225 | critical | 9.8 | 9.8 | 9y ago | Untrusted search path vulnerability in EbidSettingChecker.exe (version 1.0.0.0) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | |||
| CVE-2017-7406 | critical | 9.8 | 9.8 | 9y ago | The D-Link DIR-615 device before v20.12PTb04 doesn't use SSL for any of the authenticated pages. Also, it doesn't allow the user to generate his own SSL Certificate. An attacker can simply monitor ne… | |||
| CVE-2017-7405 | critical | 9.8 | 9.8 | 9y ago | On the D-Link DIR-615 before v20.12PTb04, once authenticated, this device identifies the user based on the IP address of his machine. By spoofing the IP address belonging to the victim's host, an att… | |||
| CVE-2017-10989 | critical | 9.8 | 9.8 | 9y ago | The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer ove… | |||
| CVE-2017-10968 | critical | 9.8 | 9.8 | 9y ago | In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "<?php" in a route=template request. | |||
| CVE-2017-6714 | critical | 9.8 | 9.8 | 9y ago | A vulnerability in the AutoIT service of Cisco Ultra Services Framework Staging Server could allow an unauthenticated, remote attacker to execute arbitrary shell commands as the Linux root user. The … | |||
| CVE-2017-6713 | critical | 9.8 | 9.8 | 9y ago | A vulnerability in the Play Framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to gain full access to the affected system. The vulnerability is due t… | |||
| CVE-2017-6709 | critical | 9.8 | 9.8 | 9y ago | A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller (… | |||
| CVE-2017-6708 | critical | 9.8 | 9.8 | 9y ago | A vulnerability in the symbolic link (symlink) creation functionality of the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to read sensitive file… | |||
| CVE-2017-1175 | critical | 9.8 | 9.8 | 9y ago | IBM Maximo Asset Management 7.1, 7.5, and 7.6 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or del… | |||
| CVE-2017-1269 | critical | 9.8 | 9.8 | 9y ago | IBM Security Guardium 10.0 and 10.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete inform… | |||
| CVE-2017-10913 | critical | 9.8 | 9.8 | 9y ago | The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of concurrent unmap calls, which allows backend attackers to obtain sensitive information or gain priv… | |||
| CVE-2017-10804 | critical | 9.8 | 9.8 | 9y ago | In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 c… | |||
| CVE-2017-10807 | critical | 9.8 | 9.8 | 9y ago | JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled. | |||
| CVE-2017-7317 | critical | 9.8 | 9.8 | 9y ago | An issue was discovered on Humax Digital HG100 2.0.6 devices. The attacker can find the root credentials in the backup file, aka GatewaySettings.bin. | |||
| CVE-2017-7315 | critical | 9.8 | 9.8 | 9y ago | An issue was discovered on Humax Digital HG100R 2.0.6 devices. To download the backup file it's not necessary to use credentials, and the router credentials are stored in plaintext inside the backup,… | |||
| CVE-2017-7919 | critical | 9.8 | 9.8 | 9y ago | An Improper Authentication issue was discovered in Newport XPS-Cx and XPS-Qx. An attacker may bypass authentication by accessing a specific uniform resource locator (URL). | |||
| CVE-2017-8116 | critical | 9.8 | 9.8 | 9y ago | The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands with root privileges via shell metachara… | |||
| CVE-2017-10788 | critical | 9.8 | 9.8 | 9y ago | The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) ce… | |||
| CVE-2017-10699 | critical | 9.8 | 9.8 | 9y ago | arbitrary code execution in vlc | |||
| CVE-2017-10670 | critical | 9.8 | 9.8 | 9y ago | An XML External Entity (XXE) issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET), exploitable by sending a crafted standard-conform… | |||
| CVE-2017-7905 | critical | 9.8 | 9.8 | 9y ago | A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750 Feeder Protection Relay, firmware versions prior to Version 7.47; SR 760 Feeder Protection Relay, firmw… | |||
| CVE-2017-7903 | critical | 9.8 | 9.8 | 9y ago | A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 17… | |||
| CVE-2017-7902 | critical | 9.8 | 9.8 | 9y ago | A "Reusing a Nonce, Key Pair in Encryption" issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and pri… | |||
| CVE-2017-7899 | critical | 9.8 | 9.8 | 9y ago | An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L1… | |||
| CVE-2017-7898 | critical | 9.8 | 9.8 | 9y ago | An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Vers… | |||
| CVE-2017-6044 | critical | 9.8 | 9.8 | 9y ago | An Improper Authorization issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Several files and directories can… | |||
| CVE-2017-6041 | critical | 9.8 | 9.8 | 9y ago | An Unrestricted Upload issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Master, A520 Slave, A530, A542, A571, Check B… | |||
| CVE-2017-6034 | critical | 9.8 | 9.8 | 9y ago | An Authentication Bypass by Capture-Replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which … | |||
| CVE-2017-6028 | critical | 9.8 | 9.8 | 9y ago | An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and Modicon M251, all firmware versions. Log-in credentials are se… | |||
| CVE-2017-6022 | critical | 9.8 | 9.8 | 9y ago | A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Journal Service, Version 1.0.51 and prior versions. They use ha… | |||
| CVE-2017-10685 | critical | 9.8 | 9.8 | 9y ago | In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack. | |||
| CVE-2017-10684 | critical | 9.8 | 9.8 | 9y ago | In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack. | |||
| CVE-2017-4997 | critical | 9.8 | 9.8 | 9y ago | EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could potentially be exploited by malicious users to compromise the affect… | |||
| CVE-2017-10672 | critical | 9.8 | 9.8 | 9y ago | Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call. | |||
| CVE-2017-6086 | high | 8.8 | 9.8 | 9y ago | ViMbAdmin CSRF Vulnerabilities | |||
| CVE-2017-2491 | high | 8.8 | 9.8 | 9y ago | Use after free vulnerability in the String.replace method JavaScriptCore in Apple Safari in iOS before 10.3 allows remote attackers to execute arbitrary code via a crafted web page, or a crafted file. | |||
| CVE-2017-9830 | critical | 9.8 | 9.8 | 9y ago | Remote Code Execution is possible in Code42 CrashPlan 5.4.x via the org.apache.commons.ssl.rmi.DateRMI Java class, because (upon instantiation) it creates an RMI server that listens on a TCP port and… | |||
| CVE-2017-9615 | critical | 9.8 | 9.8 | 9y ago | Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbose logging writes the administrator password to a world-read… | |||
| CVE-2017-9466 | critical | 9.8 | 9.8 | 9y ago | The executable httpd on the TP-Link WR841N V8 router before TL-WR841N(UN)_V8_170210 contained a design flaw in the use of DES for block encryption. This resulted in incorrect access control, which al… | |||
| CVE-2017-9848 | critical | 9.8 | 9.8 | 9y ago | SQL injection vulnerability in C_InfoService.asmx in WebServices in Easysite 7.0 could allow remote attackers to execute arbitrary SQL commands via an XML document containing a crafted ArticleIDs ele… | |||
| CVE-2017-9828 | critical | 9.8 | 9.8 | 9y ago | '/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root … | |||
| CVE-2017-9772 | critical | 9.8 | 9.8 | 9y ago | Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_N… | |||
| CVE-2017-2781 | critical | 9.8 | 9.8 | 9y ago | An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted x509 certificate can cause a buffer overfl… | |||
| CVE-2017-2780 | critical | 9.8 | 9.8 | 9y ago | An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted x509 certificate can cause a buffer overfl… | |||
| CVE-2017-9424 | critical | 9.8 | 9.8 | 9y ago | IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization. | |||
| CVE-2017-9807 | critical | 9.8 | 9.8 | 9y ago | An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval() call on the contents of the "key… | |||
| CVE-2017-4990 | critical | 9.8 | 9.8 | 9y ago | In EMC Avamar Server Software 7.4.1-58, 7.4.0-242, 7.3.1-125, 7.3.0-233, 7.3.0-226, an unauthorized attacker may leverage the file upload feature of the system maintenance page to load a maliciously … | |||
| CVE-2017-4989 | critical | 9.8 | 9.8 | 9y ago | In EMC Avamar Server Software 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401, an unauthenticated remote attacker may potentially bypass the authentication process to gain access to th… | |||
| CVE-2017-6050 | critical | 9.8 | 9.8 | 9y ago | A SQL Injection issue was discovered in Ecava IntegraXor Versions 5.2.1231.0 and prior. The application fails to properly validate user input, which may allow for an unauthenticated attacker to remot… | |||
| CVE-2017-2805 | critical | 9.8 | 9.8 | 9y ago | An exploitable stack-based buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera. A specially crafted http request can cause a stack-based buffer… | |||
| CVE-2017-9771 | critical | 9.8 | 9.8 | 9y ago | install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the database_username, database_host, or database_password parameter. | |||
| CVE-2017-3098 | critical | 9.8 | 9.8 | 9y ago | Adobe Captivate versions 9 and earlier have a remote code execution vulnerability in the quiz reporting feature that could be abused to read and write arbitrary files to the server. | |||
| CVE-2017-3097 | critical | 9.8 | 9.8 | 9y ago | Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading functions in the installer plugin. A successful… | |||
| CVE-2017-3096 | critical | 9.8 | 9.8 | 9y ago | Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the character code mapping module. Successful exploitation could lead to arbitrary code execut… | |||
| CVE-2017-3095 | critical | 9.8 | 9.8 | 9y ago | Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the PDF parsing engine. Successful exploitation could lead to arbitrary code execution. | |||
| CVE-2017-3094 | critical | 9.8 | 9.8 | 9y ago | Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the PDF processing engine. Successful exploitation could lead to arbitrary code execution. | |||
| CVE-2017-3093 | critical | 9.8 | 9.8 | 9y ago | Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the bitmap representation module. Successful exploitation could lead to arbitrary code executi… | |||
| CVE-2017-3092 | critical | 9.8 | 9.8 | 9y ago | Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading of editor control library functions in the inst… | |||
| CVE-2017-3090 | critical | 9.8 | 9.8 | 9y ago | Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading of browser related library extensions in the in… | |||
| CVE-2017-3089 | critical | 9.8 | 9.8 | 9y ago | Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the PDF imaging model. Successful exploitation could lead to arbitrary code execution. | |||
| CVE-2017-3086 | critical | 9.8 | 9.8 | 9y ago | Adobe Shockwave versions 12.2.8.198 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. | |||
| CVE-2017-3084 | critical | 9.8 | 9.8 | 9y ago | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the advertising metadata functionality. Successful exploitation could lead to arbitrary code exe… | |||
| CVE-2017-3083 | critical | 9.8 | 9.8 | 9y ago | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the Primetime SDK functionality related to the profile metadata of the media stream. Successful … | |||
| CVE-2017-3082 | critical | 9.8 | 9.8 | 9y ago | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the LocaleID class. Successful exploitation could lead to arbitrary code execution. | |||
| CVE-2017-3081 | critical | 9.8 | 9.8 | 9y ago | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability during internal computation caused by multiple display object mask manipulations. Successful exploi… | |||
| CVE-2017-3079 | critical | 9.8 | 9.8 | 9y ago | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the internal representation of raster data. Successful exploitation could lead to arbitrary c… | |||
| CVE-2017-3075 | critical | 9.8 | 9.8 | 9y ago | Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability when manipulating the ActionsScript 2 XML class. Successful exploitation could lead to arbitrary co… | |||
| CVE-2017-7679 | critical | 9.8 | 9.8 | 9y ago | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header. | |||
| CVE-2017-3169 | critical | 9.8 | 9.8 | 9y ago | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. | |||
| CVE-2017-3167 | critical | 9.8 | 9.8 | 9y ago | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being… | |||
| CVE-2017-3216 | critical | 9.8 | 9.8 | 9y ago | WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to … | |||
| CVE-2017-1000378 | critical | 9.8 | 9.8 | 9y ago | The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times. This allow… | |||
| CVE-2017-1000374 | critical | 9.8 | 9.8 | 9y ago | A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and po… | |||
| CVE-2017-1000372 | critical | 9.8 | 9.8 | 9y ago | A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects Open… | |||
| CVE-2017-9757 | high | 8.8 | 9.8 | 9y ago | IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell. This can be exploited directly by authenticated users, or through CSRF. | |||
| CVE-2017-4984 | critical | 9.8 | 9.8 | 9y ago | In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, an unauthenticated remote attacker may be able to elevate their permissions to root through a comm… | |||
| CVE-2017-9741 | critical | 9.8 | 9.8 | 9y ago | install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix parameter, related to replacing TABLES_PREFIX in the configuration file. | |||
| CVE-2017-9736 | critical | 9.8 | 9.8 | 9y ago | SPIP 3.1.x before 3.1.6 and 3.2.x before Beta 3 does not remove shell metacharacters from the host field, allowing a remote attacker to cause remote code execution. | |||
| CVE-2017-9728 | critical | 9.8 | 9.8 | 9y ago | In uClibc 0.9.33.2, there is an out-of-bounds read in the get_subexp function in misc/regex/regexec.c when processing a crafted regular expression. | |||
| CVE-2017-1197 | critical | 9.8 | 9.8 | 9y ago | IBM BigFix Compliance (TEMA SUAv1 SCA SCM) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 123672. | |||
| CVE-2017-0283 | high | 8.8 | 9.8 | 9y ago | Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007 S… | |||
| CVE-2017-7676 | critical | 9.8 | 9.8 | 9y ago | Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character | |||
| CVE-2017-2810 | critical | 9.8 | 9.8 | 9y ago | An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker ca… | |||
| CVE-2017-9603 | high | 8.8 | 9.8 | 9y ago | SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter to wp-admin/edit.php. | |||
| CVE-2017-9429 | high | 8.8 | 9.8 | 9y ago | SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php. | |||
| CVE-2017-9246 | critical | 9.8 | 9.8 | 9y ago | New Relic .NET Agent contains SQL Injection | |||
| CVE-2017-6667 | critical | 9.8 | 9.8 | 9y ago | A vulnerability in the update process for the dynamic JAR file of the Cisco Context Service software development kit (SDK) could allow an unauthenticated, remote attacker to execute arbitrary code on… | |||
| CVE-2017-4992 | critical | 9.8 | 9.8 | 9y ago | Cloud Foundry UAA privilege escalation with user invitations | |||
| CVE-2017-4955 | critical | 9.8 | 9.8 | 9y ago | An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.65, 1.7.x versions prior to 1.7.48, 1.8.x versions prior to 1.8.28, and 1.9.x versions prior to 1.9.5. Several crede… | |||
| CVE-2017-2773 | critical | 9.8 | 9.8 | 9y ago | An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1.8.x versions prior to 1.8.23, and 1.9.x versions prior to 1.9.1. Incomplete va… | |||
| CVE-2017-9418 | high | 8.8 | 9.8 | 9y ago | SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php. | |||
| CVE-2017-9542 | critical | 9.8 | 9.8 | 9y ago | D-Link DIR-615 Wireless N 300 Router allows authentication bypass via a modified POST request to login.cgi. This issue occurs because it fails to validate the password field. Successful exploitation … | |||
| CVE-2017-4918 | critical | 9.8 | 9.8 | 9y ago | VMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service startup script. Successful exploitation of this issue may allow unprivileged use… | |||
| CVE-2017-5878 | critical | 9.8 | 9.8 | 9y ago | The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serializ… | |||
| CVE-2017-6640 | critical | 9.8 | 9.8 | 9y ago | A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an unauthenticated, remote attacker to log in to the administrative console of a DCNM server by using an account… | |||
| CVE-2017-6639 | critical | 9.8 | 9.8 | 9y ago | A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to access sensitive information… | |||
| CVE-2017-4907 | critical | 9.8 | 9.8 | 9y ago | VMware Unified Access Gateway (2.5.x, 2.7.x, 2.8.x prior to 2.8.1) and Horizon View (7.x prior to 7.1.0, 6.x prior to 6.2.4) contain a heap buffer-overflow vulnerability which may allow a remote atta… | |||
| CVE-2017-4917 | critical | 9.8 | 9.8 | 9y ago | VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This issue may allow plaintext credentials to be obtained. |