# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
23201 |
CVE-2017-8146 |
20 |
|
|
2017-11-22 |
2017-12-11 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The call module of P10 and P10 Plus smartphones with software versions before VTR-AL00C00B167, versions before VTR-TL00C01B167, versions before VKY-AL00C00B167, versions before VKY-TL00C01B167 has a DoS vulnerability. An attacker may trick a user into installing a malicious application, and the application can send given parameter to call module to crash the call and data communication process. |
23202 |
CVE-2017-8145 |
20 |
|
|
2017-11-22 |
2017-12-11 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The call module of P10 and P10 Plus smartphones with software versions before VTR-AL00C00B167, versions before VTR-TL00C01B167, versions before VKY-AL00C00B167, versions before VKY-TL00C01B167 has a DoS vulnerability. An attacker may trick a user into installing a malicious application, and the application can send given parameter to call module to crash the call and data communication process. |
23203 |
CVE-2017-8139 |
79 |
|
XSS |
2017-11-22 |
2017-12-08 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
HedEx Earlier than V200R006C00 versions have the stored cross-site scripting (XSS) vulnerability. Attackers can exploit the vulnerability to plant malicious scripts into the configuration file to interrupt the services of legitimate users. |
23204 |
CVE-2017-8138 |
352 |
|
CSRF |
2017-11-22 |
2017-12-08 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
HedEx Earlier than V200R006C00 versions has a cross-site request forgery (CSRF) vulnerability. An attacker could trick a user into accessing a website containing malicious scripts which may tamper with configurations and interrupt normal services. |
23205 |
CVE-2017-8136 |
200 |
|
+Info |
2017-11-22 |
2017-12-07 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
HedEx Earlier than V200R006C00 versions has an arbitrary file download vulnerability. An attacker could exploit it to download arbitrary files on a target device to cause information leak. |
23206 |
CVE-2017-8133 |
77 |
|
Exec Code |
2017-11-22 |
2017-12-07 |
6.5 |
None |
Remote |
Low |
Single system |
Partial |
Partial |
Partial |
Huawei iManager NetEco with software V600R008C00 and V600R008C10 has a command injection vulnerability. An authenticated, remote attacker could exploit this vulnerability to send malicious packets to a target device. Successful exploit could enable a low privileged user to execute commands that a high privileged user could execute, causing the files to be tampered with or deleted. |
23207 |
CVE-2017-8130 |
200 |
|
+Info |
2017-11-22 |
2017-12-08 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sensitive information, causing information leak. |
23208 |
CVE-2017-8127 |
79 |
|
XSS |
2017-11-22 |
2017-12-08 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
The UMA product with software V200R001 has a cross-site scripting (XSS) vulnerability due to insufficient input validation. An attacker could craft malicious links or scripts to launch XSS attacks. |
23209 |
CVE-2017-8125 |
79 |
|
XSS |
2017-11-22 |
2017-12-08 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
The UMA product with software V200R001 and V300R001 has a cross-site scripting (XSS) vulnerability due to insufficient input validation. An attacker could craft malicious links or scripts to launch XSS attacks. |
23210 |
CVE-2017-8121 |
200 |
|
+Info |
2017-11-22 |
2017-12-08 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sensitive information, causing information leak. |
23211 |
CVE-2017-8118 |
200 |
|
+Info |
2017-11-22 |
2017-12-08 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The UMA product with software V200R001 and V300R001 has an information leak vulnerability. An attacker could exploit them to obtain some sensitive information, causing information leak. |
23212 |
CVE-2017-8115 |
22 |
|
Dir. Trav. +Info |
2017-04-25 |
2017-05-05 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remote attackers to obtain system directory information. |
23213 |
CVE-2017-8114 |
269 |
|
|
2017-04-29 |
2019-10-02 |
6.5 |
None |
Remote |
Low |
Single system |
Partial |
Partial |
Partial |
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin. |
23214 |
CVE-2017-8112 |
835 |
|
DoS |
2017-05-02 |
2019-10-02 |
4.9 |
None |
Local |
Low |
Not required |
None |
None |
Complete |
hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and CPU consumption) via the message ring page count. |
23215 |
CVE-2017-8109 |
200 |
|
+Info |
2017-04-25 |
2017-05-05 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients). |
23216 |
CVE-2017-8108 |
59 |
|
+Priv |
2017-06-08 |
2019-10-02 |
4.6 |
None |
Local |
Low |
Not required |
Partial |
Partial |
Partial |
Unspecified tests in Lynis before 2.5.0 allow local users to write to arbitrary files or possibly gain privileges via a symlink attack on a temporary file. |
23217 |
CVE-2017-8106 |
476 |
|
DoS |
2017-04-24 |
2017-05-05 |
4.9 |
None |
Local |
Low |
Not required |
None |
None |
Complete |
The handle_invept function in arch/x86/kvm/vmx.c in the Linux kernel 3.12 through 3.15 allows privileged KVM guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a single-context INVEPT instruction with a NULL EPT pointer. |
23218 |
CVE-2017-8104 |
22 |
|
Dir. Trav. |
2017-04-24 |
2017-04-28 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter. |
23219 |
CVE-2017-8103 |
79 |
|
XSS |
2017-04-24 |
2017-04-27 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event. |
23220 |
CVE-2017-8102 |
79 |
|
XSS |
2017-04-24 |
2017-04-28 |
3.5 |
None |
Remote |
Medium |
Single system |
None |
Partial |
None |
Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipity_event_xsstrust plugin and a set_config error in that plugin. |
23221 |
CVE-2017-8101 |
352 |
|
CSRF |
2017-04-24 |
2017-04-27 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request. |
23222 |
CVE-2017-8100 |
352 |
|
CSRF |
2017-04-24 |
2017-05-02 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
There is CSRF in the CopySafe Web Protection plugin before 2.6 for WordPress, allowing attackers to change plugin settings. |
23223 |
CVE-2017-8099 |
352 |
|
CSRF |
2017-04-24 |
2017-04-28 |
5.8 |
None |
Remote |
Medium |
Not required |
None |
Partial |
Partial |
There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's status via a GET request. |
23224 |
CVE-2017-8098 |
352 |
|
CSRF |
2017-04-24 |
2017-04-29 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing. A malicious web page can use forged requests to make e107 download and install a plug-in provided by the attacker. |
23225 |
CVE-2017-8086 |
772 |
|
DoS |
2017-05-02 |
2019-10-02 |
4.9 |
None |
Local |
Low |
Not required |
None |
None |
Complete |
Memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (memory consumption) via vectors involving the orig_value variable. |
23226 |
CVE-2017-8085 |
79 |
|
XSS |
2017-04-24 |
2017-04-28 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php. |
23227 |
CVE-2017-8082 |
352 |
|
DoS CSRF |
2017-04-24 |
2017-04-27 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote attackers to disable the entire installation by merely tricking an admin into viewing a malicious page involving the /tools/required/files/importers/imageeditor?fID=1&imgData= URI. This results in a site-wide denial of service making the site not accessible to any users or any administrators. |
23228 |
CVE-2017-8081 |
338 |
|
CSRF |
2017-04-30 |
2019-10-02 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce. |
23229 |
CVE-2017-8080 |
434 |
|
Exec Code |
2017-05-05 |
2019-10-02 |
6.5 |
None |
Remote |
Low |
Single system |
Partial |
Partial |
Partial |
Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image uploads. |
23230 |
CVE-2017-8078 |
287 |
|
|
2017-04-23 |
2017-04-27 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
On the TP-Link TL-SG108E 1.0, the upgrade process can be requested remotely without authentication (httpupg.cgi with a parameter called cmd). This affects the 1.1.2 Build 20141017 Rel.50749 firmware. |
23231 |
CVE-2017-8077 |
798 |
|
|
2017-04-23 |
2019-10-02 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
On the TP-Link TL-SG108E 1.0, there is a hard-coded ciphering key (a long string beginning with Ei2HNryt). This affects the 1.1.2 Build 20141017 Rel.50749 firmware. |
23232 |
CVE-2017-8075 |
532 |
|
|
2017-04-23 |
2017-04-27 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "Switch Info" log lines where passwords are in cleartext. This affects the 1.1.2 Build 20141017 Rel.50749 firmware. |
23233 |
CVE-2017-8074 |
532 |
|
|
2017-04-23 |
2017-04-27 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "SEND data" log lines where passwords are encoded in hexadecimal. This affects the 1.1.2 Build 20141017 Rel.50749 firmware. |
23234 |
CVE-2017-8073 |
119 |
|
Overflow |
2017-04-23 |
2017-11-03 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, with a buffer overflow. |
23235 |
CVE-2017-8071 |
404 |
|
DoS |
2017-04-23 |
2017-04-28 |
2.1 |
None |
Local |
Low |
Not required |
None |
None |
Partial |
drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 uses a spinlock without considering that sleeping is possible in a USB HID request callback, which allows local users to cause a denial of service (deadlock) via unspecified vectors. |
23236 |
CVE-2017-8060 |
295 |
|
|
2017-05-05 |
2017-05-16 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call. |
23237 |
CVE-2017-8059 |
295 |
|
|
2017-05-05 |
2017-05-17 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
Acceptance of invalid/self-signed TLS certificates in "Foxit PDF - PDF reader, editor, form, signature" before 5.4 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept login information (username/password), in addition to the static authentication token if the user is already logged in. |
23238 |
CVE-2017-8058 |
295 |
|
|
2017-05-05 |
2017-05-16 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call. |
23239 |
CVE-2017-8057 |
200 |
|
+Info |
2017-04-25 |
2017-05-03 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In Joomla! 3.4.0 through 3.6.5 (fixed in 3.7.0), multiple files caused full path disclosures on systems with enabled error reporting. |
23240 |
CVE-2017-8056 |
611 |
|
DoS |
2017-04-22 |
2017-04-27 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. This causes the Firebox wgagent process to crash. This process crash ends all authenticated sessions to the Firebox, including management connections, and prevents new authenticated sessions until the process has recovered. The Firebox may also experience an overall degradation in performance while the wgagent process recovers. An attacker could continuously send XML-RPC requests that contain references to external entities to perform a limited Denial of Service (DoS) attack against an affected Firebox. |
23241 |
CVE-2017-8055 |
203 |
|
|
2017-04-22 |
2019-10-02 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. A login request that contains a blank password sent to the XML-RPC agent in Fireware v11.12.1 and earlier returns different responses for valid and invalid usernames. An attacker could exploit this vulnerability to enumerate valid usernames on an affected Firebox. |
23242 |
CVE-2017-8054 |
835 |
|
DoS |
2017-04-22 |
2019-10-02 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted PDF document. |
23243 |
CVE-2017-8053 |
835 |
|
DoS |
2017-04-22 |
2019-10-02 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
PoDoFo 0.9.5 allows denial of service (infinite recursion and stack consumption) via a crafted PDF file in PoDoFo::PdfParser::ReadDocumentStructure (PdfParser.cpp). |
23244 |
CVE-2017-8052 |
79 |
|
XSS |
2017-04-21 |
2017-04-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Craft CMS before 2.6.2974 allows XSS attacks. |
23245 |
CVE-2017-8050 |
|
|
|
2017-04-21 |
2019-10-02 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password. |
23246 |
CVE-2017-8048 |
|
|
Exec Code |
2017-10-03 |
2019-10-02 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
In Cloud Foundry capi-release versions 1.33.0 and later, prior to 1.42.0 and cf-release versions 268 and later, prior to 274, the original fix for CVE-2017-8033 introduces an API regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application. NOTE: 274 resolves the vulnerability but has a serious bug that is fixed in 275. |
23247 |
CVE-2017-8047 |
601 |
|
|
2017-10-03 |
2017-10-23 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
None |
In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it is possible to append a combination of characters to the URL that will allow for an open redirect. An attacker could exploit this as a phishing attack to gain access to user credentials or other sensitive data. NOTE: 274 resolves the vulnerability but has a serious bug that is fixed in 275. |
23248 |
CVE-2017-8044 |
79 |
|
XSS |
2017-11-27 |
2017-12-12 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3), certain pages allow code to be injected into the DOM environment through query parameters, leading to XSS attacks. |
23249 |
CVE-2017-8041 |
79 |
|
Exec Code XSS |
2017-09-08 |
2017-09-19 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, a user can execute a XSS attack on certain Single Sign-On service UI pages by inputting code in the text field for an organization name. |
23250 |
CVE-2017-8040 |
611 |
|
|
2017-09-08 |
2017-09-19 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was discovered in the Single Sign-On service dashboard. Privileged users can in some cases upload malformed XML leading to exposure of data on the Single Sign-On service broker file system. |