CVE Vulnerability Database
Search and browse 394,607 CVE records with CVSS scores, EPSS exploit predictions, CISA KEV status and whether the Vulnix engine has a detection for them.
14,642 records from 2017Clear filters
- CVE-2017-18005Medium 5.5Dec 31, 2017Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a TIFF file.
- CVE-2017-18004Medium 5.4Dec 31, 2017Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint.
- CVE-2017-18001Critical 9.8Dec 31, 2017Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI.
- CVE-2017-17704High 7.4Dec 31, 2017A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fixed AES key and IV. Each message is encrypted in CBC mode and restarts with the fixed IV, leading to replay attacks of entire messages. There is no authentication of messages beyond the use of the fixed AES key, so message forgery is also possible.
- CVE-2016-10704Medium 6.1Dec 30, 2017Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503.
- CVE-2017-17089Medium 4.8Dec 30, 2017custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionality.
- CVE-2017-14855High 8.6Dec 30, 2017Red Lion HMI panels allow remote attackers to cause a denial of service (software exception) via an HTTP POST request to a long URI that does not exist, as demonstrated by version HMI 2.41 PLC 2.42.
- CVE-2017-17997High 7.5Dec 30, 2017In Wireshark before 2.2.12, the MRDISC dissector misuses a NULL pointer and crashes. This was addressed in epan/dissectors/packet-mrdisc.c by validating an IPv4 address. This vulnerability is similar to CVE-2017-9343.
- CVE-2017-12813Medium 6.1Dec 30, 2017PHPJabbers File Sharing Script 1.0 has stored XSS in the comments section.
- CVE-2017-12812Medium 6.1Dec 30, 2017PHPJabbers Night Club Booking Software has stored XSS in the name parameter in the reservations tab.
- CVE-2017-12811Medium 6.1Dec 30, 2017PHPJabbers Star Rating Script 4.0 has stored XSS via a rating item.
- CVE-2017-12810Medium 6.1Dec 30, 2017PHPJabbers PHP Newsletter Script 4.2 has stored XSS in lists in the admin panel.
- CVE-2017-17995Medium 5.4Dec 30, 2017Biometric Shift Employee Management System has XSS via the Last_Name parameter in an index.php?user=ajax request.
- CVE-2017-17994Medium 5.4Dec 30, 2017Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competency_criteria request.
- CVE-2017-17993Medium 5.4Dec 30, 2017Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=addition_deduction request.
- CVE-2017-17992Critical 9.8Dec 30, 2017Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php form_file_name parameter in a download_form action.
- CVE-2017-17991Medium 5.4Dec 30, 2017Biometric Shift Employee Management System has XSS via the expense_name parameter in an index.php?user=expenses request.
- CVE-2017-17990High 8.8Dec 30, 2017Biometric Shift Employee Management System has CSRF via index.php in an edit_holiday action.
- CVE-2017-17989Medium 5.4Dec 30, 2017Biometric Shift Employee Management System has XSS via the index.php holiday_name parameter in an edit_holiday action.
- CVE-2017-17988Medium 4.8Dec 30, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter.
- CVE-2017-17987High 7.2Dec 30, 2017PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.
- CVE-2017-17986Medium 4.8Dec 30, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter.
- CVE-2017-17985Medium 4.8Dec 30, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter.
- CVE-2017-17984Medium 4.8Dec 30, 2017PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter.
- CVE-2017-17983High 8.8Dec 30, 2017PHP Scripts Mall Muslim Matrimonial Script has SQL injection via the view-profile.php mem_id parameter.