CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
3251 CVE-2017-15763 119 DoS Exec Code Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to "Data from Faulting Address controls subsequent Write Address starting at BabaCAD4Image!ShowPlugInOptions+0x000000000001eca0."
3252 CVE-2017-15762 119 DoS Exec Code Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to a "User Mode Write AV near NULL starting at BabaCAD4Image!ShowPlugInOptions+0x000000000001f31b."
3253 CVE-2017-15761 119 DoS Exec Code Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to a "User Mode Write AV starting at BabaCAD4Image!ShowPlugInOptions+0x000000000001ecaa."
3254 CVE-2017-15760 119 DoS Exec Code Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to a "User Mode Write AV near NULL starting at BabaCAD4Image!ShowPlugInOptions+0x000000000001ce82."
3255 CVE-2017-15759 119 DoS Exec Code Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to a "User Mode Write AV near NULL starting at BabaCAD4Image!ShowPlugInOptions+0x000000000001b3f3."
3256 CVE-2017-15758 119 DoS Exec Code Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to "Data from Faulting Address controls subsequent Write Address starting at BabaCAD4Image!ShowPlugInOptions+0x000000000004d75b."
3257 CVE-2017-15757 119 DoS Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Data from Faulting Address controls Branch Selection starting at BabaCAD4Image!ShowPlugInOptions+0x00000000000029ba."
3258 CVE-2017-15756 119 DoS Exec Code Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to "Data from Faulting Address controls subsequent Write Address starting at BabaCAD4Image!ShowPlugInOptions+0x000000000004d7c4."
3259 CVE-2017-15755 119 DoS Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Data from Faulting Address controls Branch Selection starting at verifier!AVrfpDphFindBusyMemoryNoCheck+0x0000000000000091."
3260 CVE-2017-15754 119 DoS Exec Code Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to a "User Mode Write AV near NULL starting at BabaCAD4Image!ShowPlugInOptions+0x0000000000013968."
3261 CVE-2017-15753 119 DoS Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Data from Faulting Address controls Branch Selection starting at BabaCAD4Image!ShowPlugInOptions+0x00000000000029c2."
3262 CVE-2017-15752 119 DoS Exec Code Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to "Data from Faulting Address controls subsequent Write Address starting at BabaCAD4Image!ShowPlugInOptions+0x000000000004d6b0."
3263 CVE-2017-15751 119 DoS Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to a "Read Access Violation starting at BabaCAD4Image!ShowPlugInOptions+0x0000000000009f39."
3264 CVE-2017-15750 119 DoS Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with BabaCAD4Image plugin version 1.3 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to a "Read Access Violation starting at BabaCAD4Image!ShowPlugInOptions+0x0000000000009ae0."
3265 CVE-2017-15749 119 DoS Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Data from Faulting Address controls Branch Selection starting at CADIMAGE+0x00000000000348b9."
3266 CVE-2017-15748 119 DoS Exec Code Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to a "User Mode Write AV starting at CADIMAGE+0x000000000000613a."
3267 CVE-2017-15747 119 DoS Exec Code Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to a "Data Execution Prevention Violation starting at Unknown Symbol @ 0x0000700b00260112 called from CADIMAGE+0x00000000003d35ad."
3268 CVE-2017-15746 119 DoS Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Data from Faulting Address controls Branch Selection starting at CADIMAGE+0x00000000003d21b3."
3269 CVE-2017-15745 119 DoS Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Data from Faulting Address controls Branch Selection starting at CADIMAGE+0x000000000002ca2e."
3270 CVE-2017-15744 119 DoS Exec Code Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to a "Read Access Violation on Control Flow starting at CADIMAGE+0x00000000003d35a7."
3271 CVE-2017-15743 119 DoS Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Data from Faulting Address may be used as a return value starting at CADIMAGE+0x00000000003d24a0."
3272 CVE-2017-15742 119 DoS Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to a "Read Access Violation starting at CADIMAGE+0x00000000003d2328."
3273 CVE-2017-15741 119 DoS Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to "Possible Stack Corruption starting at CADIMAGE+0x00000000003d2378."
3274 CVE-2017-15740 119 DoS Exec Code Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to "Data from Faulting Address controls Code Flow starting at CADIMAGE+0x000000000033228e."
3275 CVE-2017-15739 119 DoS Exec Code Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to "Data from Faulting Address controls subsequent Write Address starting at CADIMAGE+0x00000000000042d5."
3276 CVE-2017-15738 119 DoS Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to a "Read Access Violation starting at CADIMAGE+0x00000000003d22d8."
3277 CVE-2017-15737 119 DoS Overflow 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dwg file, related to a "Read Access Violation starting at CADIMAGE+0x00000000003d246f."
3278 CVE-2017-15735 352 CSRF 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary.
3279 CVE-2017-15734 352 CSRF 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php.
3280 CVE-2017-15733 352 CSRF 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/ajax.attachment.php and admin/att.main.php.
3281 CVE-2017-15732 352 CSRF 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/news.php.
3282 CVE-2017-15731 352 CSRF 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.adminlog.php.
3283 CVE-2017-15730 352 CSRF 2017-10-22 2017-10-31
6.8
None Remote Medium Not required Partial Partial Partial
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
3284 CVE-2017-15729 352 CSRF 2017-10-22 2017-10-24
6.8
None Remote Medium Not required Partial Partial Partial
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for adding a glossary.
3285 CVE-2017-15715 20 2018-03-26 2019-04-22
6.8
None Remote Medium Not required Partial Partial Partial
In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.
3286 CVE-2017-15712 22 Dir. Trav. 2018-02-19 2018-03-16
6.8
None Remote Low Single system Complete None None
Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.
3287 CVE-2017-15699 20 DoS 2018-02-13 2018-03-15
6.8
None Remote Low Single system None None Complete
A Denial of Service vulnerability was found in Apache Qpid Dispatch Router versions 0.7.0 and 0.8.0. To exploit this vulnerability, a remote user must be able to establish an AMQP connection to the Qpid Dispatch Router and send a specifically crafted AMQP frame which will cause it to segfault and shut down.
3288 CVE-2017-15695 264 Exec Code 2018-06-13 2018-08-08
6.5
None Remote Low Single system Partial Partial Partial
When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privilege.
3289 CVE-2017-15693 502 Exec Code 2018-02-27 2018-03-23
6.0
None Remote Medium Single system Partial Partial Partial
In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized. A user with DATA:WRITE access to the cluster may be able to cause remote code execution if certain classes are present on the classpath.
3290 CVE-2017-15672 125 2017-11-06 2019-05-06
6.8
None Remote Medium Not required Partial Partial Partial
The read_header function in libavcodec/ffv1dec.c in FFmpeg 3.3.4 and earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.
3291 CVE-2017-15653 613 2018-01-31 2018-02-27
6.5
None Remote Low Single system Partial Partial Partial
Improper administrator IP validation after his login in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt allows an unauthorized user to execute any action knowing administrator session token by using a specific User-Agent string.
3292 CVE-2017-15651 20 Exec Code 2017-10-19 2017-10-31
6.5
None Remote Low Single system Partial Partial Partial
PRTG Network Monitor 17.3.33.2830 allows remote authenticated administrators to execute arbitrary code by uploading a .exe file and then proceeding in spite of the error message.
3293 CVE-2017-15645 352 Exec Code CSRF 2017-10-19 2017-11-07
6.8
None Remote Medium Not required Partial Partial Partial
CSRF exists in Webmin 1.850. By sending a GET request to at/create_job.cgi containing dir=/&cmd= in the URI, an attacker to execute arbitrary commands.
3294 CVE-2017-15638 264 Bypass 2017-11-09 2018-02-01
6.4
None Remote Low Not required Partial None Partial
The SuSEfirewall2 package before 3.6.312-2.13.1 in SUSE Linux Enterprise (SLE) Desktop 12 SP2, Server 12 SP2, and Server for Raspberry Pi 12 SP2; before 3.6.312.333-3.10.1 in SLE Desktop 12 SP3 and Server 12 SP3; before 3.6_SVNr208-2.18.3.1 in SLE Server 11 SP4; before 3.6.312-5.9.1 in openSUSE Leap 42.2; and before 3.6.312.333-7.1 in openSUSE Leap 42.3 might allow remote attackers to bypass intended access restrictions on the portmap service by leveraging a missing source net restriction for _rpc_ services.
3295 CVE-2017-15588 362 Exec Code 2017-10-18 2018-10-19
6.9
None Local Medium Not required Complete Complete Complete
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry.
3296 CVE-2017-15587 190 Overflow 2017-10-18 2018-11-27
6.8
None Remote Medium Not required Partial Partial Partial
An integer overflow was discovered in pdf_read_new_xref_section in pdf/pdf-xref.c in Artifex MuPDF 1.11.
3297 CVE-2017-15578 89 Sql 2017-10-17 2017-11-08
6.0
None Remote Medium Single system Partial Partial Partial
In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/edit_category.php.
3298 CVE-2017-15565 476 2017-10-17 2018-02-03
6.8
None Remote Medium Not required Partial Partial Partial
In Poppler 0.59.0, a NULL Pointer Dereference exists in the GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF document.
3299 CVE-2017-15536 264 +Priv 2018-02-04 2018-03-13
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.x before 1.2.0. Several web application vulnerabilities allow malicious authenticated users of CDSW to escalate privileges in CDSW. CDSW users can exploit these vulnerabilities in combination to gain root access to CDSW nodes, gain access to the CDSW database which includes Kerberos keytabs of CDSW users and bcrypt hashed passwords, and gain access to other privileged information such as session tokens, invitation tokens, and environment variables.
3300 CVE-2017-15535 2017-10-31 2017-11-22
6.4
None Remote Low Not required None Partial Partial
MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.