CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 3 and 3.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
4101 CVE-2017-14984 79 XSS 2017-10-03 2021-02-23
3.5
None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the bp_name parameter to /module/admin_bp/add_services.php.
4102 CVE-2017-14983 79 XSS 2017-10-03 2021-02-23
3.5
None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to inject arbitrary web script or HTML via the object parameter to module/admin_conf/index.php.
4103 CVE-2017-14981 79 XSS 2017-10-03 2017-10-11
3.5
None Remote Medium ??? None Partial None
Cross-Site Scripting (XSS) was discovered in ATutor before 2.2.3. The vulnerability exists due to insufficient filtration of data (url in /mods/_standard/rss_feeds/edit_feed.php). An attacker could inject arbitrary HTML and script code into a browser in the context of the vulnerable website.
4104 CVE-2017-14973 79 XSS 2017-10-09 2017-10-27
3.5
None Remote Medium ??? None Partial None
IDenticard Two-Reader Controller Configuration Manager 1.18.8 (396) is vulnerable to Stored Cross-Site Scripting (XSS) via the notes field in /~user_handler?file=logged_in.shtm (aka the edit user page).
4105 CVE-2017-14956 352 CSRF 2017-10-18 2019-05-13
3.5
None Remote Medium ??? Partial None None
AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/ossim/report/wizard_email.php" script. Besides offering an export via a local download, the script also offers the possibility to send out any report via email to a given address (either in PDF or XLS format). Since there is no anti-CSRF token protecting this functionality, it is vulnerable to Cross-Site Request Forgery attacks.
4106 CVE-2017-14953 311 2017-12-01 2019-10-03
3.3
None Local Network Low Not required None Partial None
** DISPUTED ** HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically proximate attackers to trigger association with an arbitrary access point by leveraging a default SSID with no WiFi encryption or authentication. NOTE: Vendor states that this is not a vulnerability, but more an increase to the attack surface of the product.
4107 CVE-2017-14923 79 XSS 2017-09-30 2017-10-05
3.5
None Remote Medium ??? None Partial None
Stored XSS vulnerability via IMG element at "Leadname" of CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.
4108 CVE-2017-14922 79 XSS 2017-09-30 2017-10-05
3.5
None Remote Medium ??? None Partial None
Stored XSS vulnerability via IMG element at "History" of Profile, Calendar, Tasks, and CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.
4109 CVE-2017-14921 79 XSS 2017-09-30 2017-10-05
3.5
None Remote Medium ??? None Partial None
Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.
4110 CVE-2017-14771 20 2017-10-03 2017-10-11
3.6
None Local Low Not required None Partial Partial
Skybox Manager Client Application prior to 8.5.501 is prone to an arbitrary file upload vulnerability due to insufficient input validation of user-supplied files path when uploading files via the application. During a debugger-pause state, a local authenticated attacker can upload an arbitrary file and overwrite existing files within the scope of the affected application.
4111 CVE-2017-14753 79 XSS 2017-09-27 2021-02-23
3.5
None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the filter parameter to module/module_filters/index.php.
4112 CVE-2017-14752 79 Exec Code XSS 2017-10-31 2017-11-13
3.5
None Remote Medium ??? None Partial None
Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous payload, e.g., XSS code, to be saved as their first name, last name, or display name in the profile fields that can cause issues such as escalation of privileges or unknown execution of malicious code when replying to messages in Mahara.
4113 CVE-2017-14748 362 DoS 2017-09-26 2017-10-06
3.5
None Remote Medium ??? None None Partial
Race condition in Blizzard Overwatch 1.15.0.2 allows remote authenticated users to cause a denial of service (season bans and SR losses for other users) by leaving a competitive match at a specific time during the initial loading of that match.
4114 CVE-2017-14740 79 XSS 2018-04-26 2018-05-25
3.5
None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the Menu ID when adding a menu.
4115 CVE-2017-14717 79 XSS 2017-09-22 2017-10-06
3.5
None Remote Medium ??? None Partial None
In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Description parameter.
4116 CVE-2017-14716 79 XSS 2017-09-22 2017-09-28
3.5
None Remote Medium ??? None Partial None
In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Title parameter.
4117 CVE-2017-14715 79 XSS 2017-09-22 2017-09-28
3.5
None Remote Medium ??? None Partial None
In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Alerts Title parameter.
4118 CVE-2017-14714 79 XSS 2017-09-22 2017-09-28
3.5
None Remote Medium ??? None Partial None
In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Subject parameter.
4119 CVE-2017-14713 79 XSS 2017-09-22 2017-09-28
3.5
None Remote Medium ??? None Partial None
In EPESI 1.8.2 rev20170830, there is Stored XSS in the Phonecalls Description parameter.
4120 CVE-2017-14712 79 XSS 2017-09-22 2017-10-06
3.5
None Remote Medium ??? None Partial None
In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Phonecall Notes Title parameter.
4121 CVE-2017-14651 79 XSS 2017-09-21 2020-11-09
3.5
None Remote Medium ??? None Partial None
WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.
4122 CVE-2017-14621 79 XSS 2017-09-20 2017-09-28
3.5
None Remote Medium ??? None Partial None
Portus 2.2.0 has XSS via the Team field, related to typeahead.
4123 CVE-2017-14618 79 XSS 2017-09-20 2017-10-23
3.5
None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action.
4124 CVE-2017-14597 79 XSS 2017-09-19 2017-09-22
3.5
None Remote Medium ??? None Partial None
AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain.
4125 CVE-2017-14587 79 XSS 2017-10-11 2020-11-25
3.5
None Remote Medium ??? None Partial None
The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.
4126 CVE-2017-14536 79 XSS 2018-02-16 2018-03-06
3.5
None Remote Medium ??? None Partial None
trixbox 2.8.0.4 has XSS via the PATH_INFO to /maint/index.php or /user/includes/language/langChooser.php.
4127 CVE-2017-14506 79 XSS 2017-09-25 2019-10-17
3.5
None Remote Medium ??? None Partial None
geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file.
4128 CVE-2017-14379 79 XSS 2017-11-28 2017-12-20
3.5
None Remote Medium ??? None Partial None
EMC RSA Authentication Manager before 8.2 SP1 P6 has a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.
4129 CVE-2017-14370 79 XSS 2017-10-11 2017-10-27
3.5
None Remote Medium ??? None Partial None
RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Source Asset ID field. An authenticated attacker may potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application.
4130 CVE-2017-14363 79 XSS 2017-12-21 2019-10-09
3.5
None Remote Medium ??? None Partial None
Cross-Site Scripting (XSS) vulnerability has been identified in Micro Focus Operations Manager i, versions 10.60, 10.61, 10.62. The vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS).
4131 CVE-2017-14359 79 XSS 2017-11-03 2017-11-17
3.5
None Remote Medium ??? None Partial None
A potential security vulnerability has been identified in HPE Performance Center versions 12.20. The vulnerability could be remotely exploited to allow cross-site scripting.
4132 CVE-2017-14321 79 XSS 2017-09-21 2017-10-04
3.5
None Remote Medium ??? None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) customer name or (2) subject in a ticket.
4133 CVE-2017-14241 79 XSS 2017-09-11 2017-09-18
3.5
None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the Title parameter to htdocs/admin/menus/edit.php.
4134 CVE-2017-14239 79 XSS 2017-09-11 2017-09-19
3.5
None Remote Medium ??? None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2) CompanyAddress, (3) CompanyZip, (4) CompanyTown, (5) Fax, (6) EMail, (7) Web, (8) ManagingDirectors, (9) Note, (10) Capital, (11) ProfId1, (12) ProfId2, (13) ProfId3, (14) ProfId4, (15) ProfId5, or (16) ProfId6 parameter to htdocs/admin/company.php.
4135 CVE-2017-14186 79 XSS 2017-11-29 2019-05-29
3.5
None Remote Medium ??? None Partial None
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack may also be feasible by injecting an external URL via the affected parameter.
4136 CVE-2017-14124 269 2017-09-13 2019-10-03
3.3
None Local Medium Not required Partial Partial None
In eLux RP 5.x before 5.5.1000 LTSR and 5.6.x before 5.6.2 CR when classic desktop mode is used, it is possible to start applications other than defined, even if the user does not have permissions to change application definitions.
4137 CVE-2017-14049 79 XSS 2017-08-31 2017-09-01
3.5
None Remote Medium ??? None Partial None
In BlackCat CMS 1.2, backend/settings/ajax_save_settings.php allows remote authenticated users to conduct XSS attacks via the Website header or Website footer field.
4138 CVE-2017-14018 287 Bypass 2017-12-05 2019-10-09
3.3
None Local Medium Not required None Partial Partial
An improper authentication issue was discovered in Johnson & Johnson Ethicon Endo-Surgery Generator Gen11, all versions released before November 29, 2017. The security authentication mechanism used between the Ethicon Endo-Surgery Generator Gen11 and single-patient use products can be bypassed, allowing for unauthorized devices to be connected to the generator, which could result in a loss of integrity or availability.
4139 CVE-2017-13754 79 XSS 2017-09-07 2018-10-09
3.5
None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in the "advanced settings - time server" module in Wibu-Systems CodeMeter before 6.50b allows remote attackers to inject arbitrary web script or HTML via the "server name" field in actions/ChangeConfiguration.html.
4140 CVE-2017-13724 79 XSS 2017-09-13 2017-09-21
3.5
None Remote Medium ??? None Partial None
On the Axesstel MU553S MU55XS-V1.14, there is a Stored Cross Site Scripting vulnerability in the APN parameter under the "Basic Settings" page.
4141 CVE-2017-13722 125 2017-10-11 2017-11-13
3.6
None Local Low Not required Partial None Partial
In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary check (for PCF files) could be used by local attackers authenticated to an Xserver for a buffer over-read, for information disclosure or a crash of the X server.
4142 CVE-2017-13720 125 DoS 2017-10-11 2017-11-13
3.6
None Local Low Not required Partial None Partial
In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash (denial of service). This occurs because '\0' characters are incorrectly skipped in situations involving ? characters.
4143 CVE-2017-13700 79 XSS 2017-11-17 2017-11-29
3.5
None Remote Medium ??? None Partial None
An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. There is XSS in the administration interface.
4144 CVE-2017-13680 2017-11-06 2019-10-03
3.6
None Local Low Not required None Partial Partial
Prior to SEP 12.1 RU6 MP9 & SEP 14 RU1 Symantec Endpoint Protection Windows endpoint can encounter a situation whereby an attacker could use the product's UI to perform unauthorized file deletes on the resident file system.
4145 CVE-2017-13678 79 XSS 2018-04-11 2018-05-16
3.5
None Remote Medium ??? None Partial None
Stored XSS vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A malicious appliance administrator can inject arbitrary JavaScript code in the management console web client application.
4146 CVE-2017-13668 79 XSS 2019-05-23 2019-05-23
3.5
None Remote Medium ??? None Partial None
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
4147 CVE-2017-13305 125 2018-04-04 2019-10-03
3.6
None Local Low Not required Partial None Partial
A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Versions: Android kernel. Android ID: A-70526974.
4148 CVE-2017-13269 200 +Info 2018-04-04 2018-05-08
3.3
None Local Network Low Not required Partial None None
A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68818034.
4149 CVE-2017-13268 200 +Info 2018-04-04 2018-05-08
3.3
None Local Network Low Not required Partial None None
A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-67058064.
4150 CVE-2017-13262 125 2018-04-04 2018-05-08
3.3
None Local Network Low Not required Partial None None
In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing length decrement operation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-69271284.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.