CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
3251 CVE-2017-11714 125 DoS 2017-07-28 2018-11-25
6.8
None Remote Medium Not required Partial Partial Partial
psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document, related to an out-of-bounds read in the igc_reloc_struct_ptr function in psi/igc.c.
3252 CVE-2017-11694 798 +Info 2017-07-28 2017-08-15
6.4
None Remote Low Not required Partial Partial None
MEDHOST Document Management System contains hard-coded credentials that are used for Apache Solr access. An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with Apache Solr may be able to obtain or modify sensitive patient and financial information. The Apache Solr account name is dms. The password is hard-coded throughout the application, and is the same across all installations. Customers do not have the option to change passwords. The dms account for Apache Solr has access to all indexed patient documents.
3253 CVE-2017-11693 798 +Info 2017-07-28 2017-08-15
6.4
None Remote Low Not required Partial Partial None
MEDHOST Document Management System contains hard-coded credentials that are used for customer database access. An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with the database may be able to obtain or modify sensitive patient and financial information. PostgreSQL is used as the Document Management System database. The account name is dms. The password is hard-coded throughout the application, and is the same across all installations. Customers do not have the option to change passwords. The dms account for PostgreSQL has access to the database schema for Document Management System.
3254 CVE-2017-11681 264 2017-07-27 2017-08-02
6.5
None Remote Low Single system Partial Partial Partial
Incorrect Access Control vulnerability in Hashtopussy 0.4.0 allows remote authenticated users to execute actions that should only be available for administrative roles, as demonstrated by an action=createVoucher request to agents.php.
3255 CVE-2017-11680 352 CSRF 2017-07-27 2017-08-02
6.8
None Remote Medium Not required Partial Partial Partial
Cross-Site Request Forgery (CSRF) exists in Hashtopussy 0.4.0, allowing an admin password change via users.php.
3256 CVE-2017-11679 352 CSRF 2017-07-27 2017-08-03
6.8
None Remote Medium Not required Partial Partial Partial
Cross-Site Request Forgery (CSRF) exists in Hashtopus 1.5g via the password parameter to admin.php in an a=config action.
3257 CVE-2017-11678 89 Exec Code Sql 2017-07-27 2017-08-03
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in Hashtopus 1.5g allows remote authenticated users to execute arbitrary SQL commands via the format parameter in admin.php.
3258 CVE-2017-11675 94 Exec Code 2017-07-27 2017-08-04
6.5
None Remote Low Single system Partial Partial Partial
The traverseStrictSanitize function in admin_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the admin_name array parameter to admin_dir/login.php, if there is an export of an error-log entry for that invalid array index.
3259 CVE-2017-11667 254 2017-07-26 2017-08-15
6.8
None Remote Medium Not required Partial Partial Partial
OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.
3260 CVE-2017-11649 352 CSRF 2018-03-06 2018-03-27
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0_RC3 build r6594 allows remote attackers to hijack the authentication of unspecified users for requests that enable SNMP on the remote device via vectors involving goform/setSnmp.
3261 CVE-2017-11648 352 CSRF 2017-07-31 2017-08-04
6.8
None Remote Medium Not required Partial Partial Partial
Techroutes TR 1803-3G Wireless Cellular Router/Modem 2.4.25 devices do not possess any protection against a CSRF vulnerability, as demonstrated by a goform/BasicSettings request to disable port filtering.
3262 CVE-2017-11646 352 CSRF 2017-07-28 2017-08-04
6.8
None Remote Medium Not required Partial Partial Partial
NetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 are vulnerable to CSRF attacks, as demonstrated by using administration.html to disable the firewall. They does not contain any token that can mitigate CSRF vulnerabilities within the device.
3263 CVE-2017-11642 476 2017-07-26 2018-10-18
6.8
None Remote Medium Not required Partial Partial Partial
GraphicsMagick 1.3.26 has a NULL pointer dereference in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image, a different vulnerability than CVE-2017-11638.
3264 CVE-2017-11638 20 2017-07-26 2018-10-18
6.8
None Remote Medium Not required Partial Partial Partial
GraphicsMagick 1.3.26 has a segmentation violation in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image, a different vulnerability than CVE-2017-11642.
3265 CVE-2017-11628 119 DoS Overflow 2017-07-25 2018-05-03
6.8
None Remote Medium Not required Partial Partial Partial
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function, e.g., a web application for syntax validation of php.ini directives.
3266 CVE-2017-11615 264 Exec Code 2017-07-26 2017-08-08
6.8
None Remote Medium Not required Partial Partial Partial
A sandbox escape in the Lua interface in Wube Factorio before 0.15.31 allows remote game servers or user-assisted attackers to execute arbitrary C code by including and loading a C library.
3267 CVE-2017-11600 125 DoS 2017-07-24 2018-06-27
6.9
None Local Medium Not required Complete Complete Complete
net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message.
3268 CVE-2017-11577 119 Exec Code Overflow 2017-07-23 2017-11-06
6.8
None Remote Medium Not required Partial Partial Partial
FontForge 20161012 is vulnerable to a buffer over-read in getsid (parsettf.c) resulting in DoS or code execution via a crafted otf file.
3269 CVE-2017-11575 119 Exec Code Overflow 2017-07-23 2017-11-06
6.8
None Remote Medium Not required Partial Partial Partial
FontForge 20161012 is vulnerable to a buffer over-read in strnmatch (char.c) resulting in DoS or code execution via a crafted otf file, related to a call from the readttfcopyrights function in parsettf.c.
3270 CVE-2017-11574 119 Exec Code Overflow 2017-07-23 2017-11-06
6.8
None Remote Medium Not required Partial Partial Partial
FontForge 20161012 is vulnerable to a heap-based buffer overflow in readcffset (parsettf.c) resulting in DoS or code execution via a crafted otf file.
3271 CVE-2017-11573 119 Exec Code Overflow 2017-07-23 2017-07-27
6.8
None Remote Medium Not required Partial Partial Partial
FontForge 20161012 is vulnerable to a buffer over-read in ValidatePostScriptFontName (parsettf.c) resulting in DoS or code execution via a crafted otf file.
3272 CVE-2017-11572 119 Exec Code Overflow 2017-07-23 2017-11-06
6.8
None Remote Medium Not required Partial Partial Partial
FontForge 20161012 is vulnerable to a heap-based buffer over-read in readcfftopdicts (parsettf.c) resulting in DoS or code execution via a crafted otf file.
3273 CVE-2017-11571 119 Exec Code Overflow 2017-07-23 2017-11-06
6.8
None Remote Medium Not required Partial Partial Partial
FontForge 20161012 is vulnerable to a stack-based buffer overflow in addnibble (parsettf.c) resulting in DoS or code execution via a crafted otf file.
3274 CVE-2017-11570 119 Exec Code Overflow 2017-07-23 2017-07-27
6.8
None Remote Medium Not required Partial Partial Partial
FontForge 20161012 is vulnerable to a buffer over-read in umodenc (parsettf.c) resulting in DoS or code execution via a crafted otf file.
3275 CVE-2017-11569 119 Exec Code Overflow 2017-07-23 2017-11-06
6.8
None Remote Medium Not required Partial Partial Partial
FontForge 20161012 is vulnerable to a heap-based buffer over-read in readttfcopyrights (parsettf.c) resulting in DoS or code execution via a crafted otf file.
3276 CVE-2017-11568 119 Exec Code Overflow 2017-07-23 2017-11-06
6.8
None Remote Medium Not required Partial Partial Partial
FontForge 20161012 is vulnerable to a heap-based buffer over-read in PSCharStringToSplines (psread.c) resulting in DoS or code execution via a crafted otf file.
3277 CVE-2017-11567 352 Exec Code CSRF 2017-09-07 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to __mg_admin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely.
3278 CVE-2017-11562 384 2017-12-18 2018-01-12
6.8
None Remote Medium Not required Partial Partial Partial
A Session Fixation Vulnerability exists in the MT4 Networks SenhaSegura Web Application 2.2.23.8 via login_if.php.
3279 CVE-2017-11508 89 +Priv Sql 2017-11-02 2017-11-22
6.5
None Remote Low Single system Partial Partial Partial
SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient privileges to run diagnostic scans. An attacker could exploit this vulnerability by entering a crafted SQL query into the password field of a diagnostic scan within SecurityCenter. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access.
3280 CVE-2017-11475 89 Sql 2017-07-20 2017-08-29
6.5
None Remote Low Single system Partial Partial Partial
GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php.
3281 CVE-2017-11464 369 2017-07-19 2017-07-27
6.8
None Remote Medium Not required Partial Partial Partial
A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrect protection against division by zero.
3282 CVE-2017-11463 275 2017-12-11 2018-03-27
6.5
None Remote Low Single system Partial Partial Partial
In Ivanti Service Desk (formerly LANDESK Management Suite) versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belonging to other users. In other words, a normal user can send requests to a specific URI with the target user's username in an HTTP payload in order to retrieve a key/token and use it to access/update objects belonging to other users. Such objects could be user profiles, tickets, incidents, etc.
3283 CVE-2017-11455 352 CSRF 2017-08-29 2017-09-12
6.8
None Remote Medium Not required Partial Partial Partial
diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote attackers to hijack the authentication of administrators for requests to start tcpdump, related to the lack of anti-CSRF tokens.
3284 CVE-2017-11450 20 DoS 2017-07-19 2017-07-20
6.8
None Remote Medium Not required Partial Partial Partial
coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via JPEG data that is too short.
3285 CVE-2017-11449 20 DoS 2017-07-19 2017-07-27
6.8
None Remote Medium Not required Partial Partial Partial
coders/mpc.c in ImageMagick before 7.0.6-1 does not enable seekable streams and thus cannot validate blob sizes, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an image received from stdin.
3286 CVE-2017-11438 264 2017-08-02 2017-08-15
6.5
None Remote Low Single system Partial Partial Partial
GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup.
3287 CVE-2017-11422 264 2017-07-24 2017-08-10
6.5
None Remote Low Single system Partial Partial Partial
Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include reset password, create new account, create new role, etc.
3288 CVE-2017-11403 416 2017-07-17 2018-10-18
6.8
None Remote Medium Not required Partial Partial Partial
The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 has an out-of-order CloseBlob call, resulting in a use-after-free via a crafted file.
3289 CVE-2017-11399 125 DoS Overflow 2017-07-17 2017-11-06
6.8
None Remote Medium Not required Partial Partial Partial
Integer overflow in the ape_decode_frame function in libavcodec/apedec.c in FFmpeg through 3.3.2 allows remote attackers to cause a denial of service (out-of-array access and application crash) or possibly have unspecified other impact via a crafted APE file.
3290 CVE-2017-11398 534 2018-01-19 2018-02-05
6.8
None Remote Medium Not required Partial Partial Partial
A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system.
3291 CVE-2017-11397 426 Exec Code 2017-12-15 2017-12-29
6.8
None Remote Medium Not required Partial Partial Partial
A service DLL preloading vulnerability in Trend Micro Encryption for Email versions 5.6 and below could allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable system.
3292 CVE-2017-11395 77 Exec Code 2017-09-22 2017-09-29
6.5
None Remote Low Single system Partial Partial Partial
Command injection vulnerability in Trend Micro Smart Protection Server (Standalone) 3.1 and 3.2 server administration UI allows attackers with authenticated access to execute arbitrary code on vulnerable installations.
3293 CVE-2017-11392 77 Exec Code 2017-08-03 2017-08-04
6.5
None Remote Low Single system Partial Partial Partial
Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "T" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745.
3294 CVE-2017-11391 77 Exec Code 2017-08-03 2017-08-07
6.5
None Remote Low Single system Partial Partial Partial
Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "t" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744.
3295 CVE-2017-11388 89 Exec Code Sql 2017-08-02 2017-08-05
6.5
None Remote Low Single system Partial Partial Partial
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate user provided strings before constructing SQL queries. Formerly ZDI-CAN-4639 and ZDI-CAN-4638.
3296 CVE-2017-11382 284 DoS 2017-08-03 2017-08-04
6.4
None Remote Low Not required None Partial Partial
Denial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote attackers to delete arbitrary files on vulnerable installations, thus disabling the service. Formerly ZDI-CAN-4350.
3297 CVE-2017-11364 295 2017-08-02 2017-08-04
6.5
None Remote Low Single system Partial Partial Partial
The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs.
3298 CVE-2017-11350 352 CSRF 2017-09-13 2017-09-21
6.8
None Remote Medium Not required Partial Partial Partial
Cross-Site Request Forgery (CSRF) exists in cgi-bin/ConfigSet on Axesstel MU553S MU55XS-V1.14 devices.
3299 CVE-2017-11348 22 Dir. Trav. 2017-07-17 2017-08-08
6.3
None Remote Medium Single system None Complete None
In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value.
3300 CVE-2017-11347 264 Exec Code 2017-07-17 2017-08-07
6.5
None Remote Low Single system Partial Partial Partial
Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.