Total
316927 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-18643 | 1 Google | 1 Android | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. There is information disclosure of the kbase_context address of a GPU memory node. The Samsung ID is SVE-2017-8907 (December 2017). | |||||
| CVE-2017-18642 | 1 Syska | 2 Smartlight Rainbow Led Smart Bulb, Smartlight Rainbow Led Smart Bulb Firmware | 2024-11-21 | 3.3 LOW | 6.5 MEDIUM |
| Syska Smart Bulb devices through 2017-08-06 receive RGB parameters over cleartext Bluetooth Low Energy (BLE), leading to sniffing, reverse engineering, and replay attacks. | |||||
| CVE-2017-18641 | 1 Linuxcontainers | 1 Lxc | 2024-11-21 | 9.3 HIGH | 8.1 HIGH |
| In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers. | |||||
| CVE-2017-18640 | 4 Fedoraproject, Oracle, Quarkus and 1 more | 4 Fedora, Peoplesoft Enterprise Pt Peopletools, Quarkus and 1 more | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564. | |||||
| CVE-2017-18639 | 1 Progress | 1 Sitefinity Cms | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| Progress Sitefinity CMS before 10.1 allows XSS via /Pages Parameter : Page Title, /Content/News Parameter : News Title, /Content/List Parameter : List Title, /Content/Documents/LibraryDocuments/incident-request-attachments Parameter : Document Title, /Content/Images/LibraryImages/newsimages Parameter : Image Title, /Content/links Parameter : Link Title, /Content/links Parameter : Link Title, or /Content/Videos/LibraryVideos/default-video-library Parameter : Video Title. | |||||
| CVE-2017-18638 | 1 Graphite Project | 1 Graphite | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information. | |||||
| CVE-2017-18636 | 1 Esafenet | 1 Cdg | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| CDG through 2017-01-01 allows downloadDocument.jsp?command=download&pathAndName= directory traversal. | |||||
| CVE-2017-18635 | 4 Canonical, Debian, Novnc and 1 more | 4 Ubuntu Linux, Debian Linux, Novnc and 1 more | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name. | |||||
| CVE-2017-18634 | 1 Tagdiv | 1 Newspaper | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php. | |||||
| CVE-2017-18615 | 1 Wp-kama | 1 Kama Click Counter | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The kama-clic-counter plugin before 3.5.0 for WordPress has XSS. | |||||
| CVE-2017-18614 | 1 Wp-kama | 1 Kama Click Counter | 2024-11-21 | 9.3 HIGH | 8.1 HIGH |
| The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter. | |||||
| CVE-2017-18613 | 1 Trust Form Project | 1 Trust Form | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter. | |||||
| CVE-2017-18612 | 1 Netattingo | 1 Wp-whois-domain | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter. | |||||
| CVE-2017-18611 | 1 Magicfields | 1 Magic Fields | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter. | |||||
| CVE-2017-18610 | 1 Magicfields | 1 Magic Fields | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter. | |||||
| CVE-2017-18609 | 1 Magicfields | 1 Magic Fields | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter. | |||||
| CVE-2017-18608 | 1 Spot | 1 Spot.im Comments | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues. | |||||
| CVE-2017-18607 | 1 Theme-fusion | 1 Avada | 2024-11-21 | 6.8 MEDIUM | 8.8 HIGH |
| The avada theme before 5.1.5 for WordPress has CSRF. | |||||
| CVE-2017-18606 | 1 Theme-fusion | 1 Avada | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The avada theme before 5.1.5 for WordPress has stored XSS. | |||||
| CVE-2017-18605 | 1 Gravitatedesign | 1 Gravitate Qa Tracker | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection. | |||||