CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
3801 CVE-2017-1000150 384 2017-11-03 2017-11-13
6.5
None Remote Low Single system Partial Partial Partial
Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the site more vulnerable to session fixation attacks.
3802 CVE-2017-1000148 94 Exec Code 2017-11-03 2017-11-13
6.5
None Remote Low Single system Partial Partial Partial
Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML through the PHP "unserialize()" function when importing a skin from an XML file.
3803 CVE-2017-1000147 352 CSRF 2017-11-03 2017-11-15
6.0
None Remote Medium Single system Partial Partial Partial
Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery (CSRF) attack on the uploader contained in Mahara's filebrowser widget. This could allow an attacker to trick a Mahara user into unknowingly uploading malicious files into their Mahara account.
3804 CVE-2017-1000141 640 2018-01-30 2018-06-13
6.4
None Remote Low Not required None Partial Partial
An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user's ability to maintain their own account (changing username, changing primary email address, deleting account). The correct behavior was to either prompt them for their password and/or send a warning to their primary email address.
3805 CVE-2017-1000139 918 2017-11-03 2017-11-15
6.0
None Remote Medium Single system Partial Partial Partial
Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to server-side request forgery attacks as not all processes of curl redirects are checked against a white or black list. Employing SafeCurl will prevent issues.
3806 CVE-2017-1000134 264 2017-11-03 2017-11-15
6.5
None Remote Low Single system Partial Partial Partial
Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable because group members can lose access to the group files they uploaded if another group member changes the access permissions on them.
3807 CVE-2017-1000120 89 Exec Code Sql 2017-10-04 2017-10-13
6.5
None Remote Low Single system Partial Partial Partial
[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands via the fields parameter.
3808 CVE-2017-1000119 434 Exec Code 2017-10-04 2019-09-06
6.5
None Remote Low Single system Partial Partial Partial
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.
3809 CVE-2017-1000117 284 2017-10-04 2018-01-04
6.8
None Remote Medium Not required Partial Partial Partial
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
3810 CVE-2017-1000112 362 Mem. Corr. 2017-10-04 2018-08-05
6.9
None Local Medium Not required Complete Complete Complete
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.
3811 CVE-2017-1000107 284 Bypass 2017-10-04 2017-11-01
6.5
None Remote Low Single system Partial Partial Partial
Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method references, and type coercion expressions. This could be used to invoke arbitrary constructors and methods, bypassing sandbox protection.
3812 CVE-2017-1000096 284 Exec Code 2017-10-04 2019-07-05
6.5
None Remote Low Single system Partial Partial Partial
Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts were not subject to sandbox protection, and could therefore execute arbitrary code. This could be exploited e.g. by regular Jenkins users with the permission to configure Pipelines in Jenkins, or by trusted committers to repositories containing Jenkinsfiles.
3813 CVE-2017-1000093 352 CSRF 2017-10-04 2017-10-17
6.8
None Remote Medium Not required Partial Partial Partial
Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name. While Jenkins in general does not consider polling to be a protection-worthy action as it's similar to cache invalidation, the plugin specifically adds a permission to be able to use this functionality, and this issue undermines that permission.
3814 CVE-2017-1000091 352 CSRF 2017-10-04 2017-10-17
6.8
None Remote Medium Not required Partial Partial Partial
GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to verify Scan Credentials are correct). This functionality improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect to any web server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery.
3815 CVE-2017-1000090 352 CSRF 2017-10-04 2017-11-02
6.8
None Remote Medium Not required Partial Partial Partial
Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to add administrator role to any user, or to remove the authorization configuration, preventing legitimate access to Jenkins.
3816 CVE-2017-1000086 352 CSRF 2017-10-04 2017-11-02
6.0
None Remote Medium Single system Partial Partial Partial
The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.
3817 CVE-2017-1000083 77 Exec Code 2017-09-05 2018-11-15
6.8
None Remote Medium Not required Partial Partial Partial
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.
3818 CVE-2017-1000071 264 Bypass 2017-07-17 2017-08-04
6.8
None Remote Medium Not required Partial Partial Partial
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server.
3819 CVE-2017-1000069 352 CSRF 2017-07-17 2017-07-20
6.8
None Remote Medium Not required Partial Partial Partial
CSRF in Bitly oauth2_proxy 2.1 during authentication flow
3820 CVE-2017-1000067 89 Sql 2017-07-17 2017-07-21
6.5
None Remote Low Single system Partial Partial Partial
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.
3821 CVE-2017-1000053 502 Exec Code 2017-07-17 2017-08-03
6.8
None Remote Medium Not required Partial Partial Partial
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.
3822 CVE-2017-1000045 352 Bypass CSRF 2017-07-17 2017-07-26
6.8
None Remote Medium Not required Partial Partial Partial
Mautic SSO/OAuth2 plugins are vulnerable to CSRF of the state parameter resulting in authentication bypass through clickjacking
3823 CVE-2017-1000031 89 Exec Code Sql 2017-07-17 2017-07-19
6.5
None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and graph_template_id parameters.
3824 CVE-2017-1000017 918 2017-07-17 2018-07-27
6.5
None Remote Low Single system Partial Partial Partial
phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server
3825 CVE-2017-1000010 264 Exec Code 2017-07-17 2017-07-20
6.8
None Remote Medium Not required Partial Partial Partial
Audacity version 2.1.2 is vulnerable to Dll HIjacking in the avformat-55.dll resulting arbitrary code execution
3826 CVE-2017-1000008 352 CSRF 2017-07-17 2017-08-07
6.8
None Remote Medium Not required Partial Partial Partial
Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged in users to modify account information, including their password.
3827 CVE-2017-18607 352 CSRF 2019-09-10 2019-09-10
6.8
None Remote Medium Not required Partial Partial Partial
The avada theme before 5.1.5 for WordPress has CSRF.
3828 CVE-2017-18602 89 Sql 2019-09-10 2019-09-10
6.5
None Remote Low Single system Partial Partial Partial
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.
3829 CVE-2017-18597 89 Sql 2019-09-10 2019-09-10
6.5
None Remote Low Single system Partial Partial Partial
The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId parameter.
3830 CVE-2017-18596 269 2019-09-10 2019-09-10
6.5
None Remote Low Single system Partial Partial Partial
The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.
3831 CVE-2017-18586 22 Dir. Trav. 2019-08-22 2019-08-29
6.4
None Remote Low Not required Partial Partial None
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.
3832 CVE-2017-18569 352 CSRF 2019-08-20 2019-08-22
6.8
None Remote Medium Not required Partial Partial Partial
The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.
3833 CVE-2017-18547 352 CSRF 2019-08-16 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.
3834 CVE-2017-18546 352 CSRF 2019-08-16 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.
3835 CVE-2017-18544 352 CSRF 2019-08-16 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.
3836 CVE-2017-18523 352 CSRF 2019-08-20 2019-08-22
6.8
None Remote Medium Not required Partial Partial Partial
The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.
3837 CVE-2017-18521 352 CSRF 2019-08-21 2019-08-23
6.8
None Remote Medium Not required Partial Partial Partial
The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.
3838 CVE-2017-18513 352 CSRF 2019-08-14 2019-08-20
6.8
None Remote Medium Not required Partial Partial Partial
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.
3839 CVE-2017-18512 352 CSRF 2019-08-14 2019-08-20
6.8
None Remote Medium Not required Partial Partial Partial
The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.
3840 CVE-2017-18511 352 CSRF 2019-08-14 2019-08-20
6.8
None Remote Medium Not required Partial Partial Partial
The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.
3841 CVE-2017-18510 352 CSRF 2019-08-14 2019-08-20
6.8
None Remote Medium Not required Partial Partial Partial
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
3842 CVE-2017-18504 352 CSRF 2019-08-12 2019-08-16
6.8
None Remote Medium Not required Partial Partial Partial
The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.
3843 CVE-2017-18486 332 2019-08-09 2019-08-19
6.5
None Remote Low Single system Partial Partial Partial
Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote authentication. The shared secret can be used to escalate privileges by forging new tokens for any user. These tokens can be used to automatically log in as the affected user.
3844 CVE-2017-18475 20 2019-08-05 2019-08-12
6.5
None Remote Low Single system Partial Partial Partial
In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204).
3845 CVE-2017-18474 200 +Info 2019-08-05 2019-08-12
6.8
None Remote Low Single system Complete None None
cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201).
3846 CVE-2017-18469 20 Exec Code 2019-08-05 2019-08-08
6.5
None Remote Low Single system Partial Partial Partial
cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).
3847 CVE-2017-18468 94 Exec Code 2019-08-05 2019-08-12
6.5
None Remote Low Single system Partial Partial Partial
cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).
3848 CVE-2017-18447 20 Exec Code 2019-08-02 2019-08-08
6.5
None Remote Low Single system Partial Partial Partial
cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).
3849 CVE-2017-18446 125 2019-08-02 2019-08-14
6.5
None Remote Low Single system Partial Partial Partial
cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).
3850 CVE-2017-18439 20 Exec Code 2019-08-02 2019-08-09
6.5
None Remote Low Single system Partial Partial Partial
cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.