CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 4 and 4.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-8054 399 DoS 2017-04-22 2017-04-25
4.3
None Remote Medium Not required None None Partial
The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted PDF document.
2 CVE-2017-8053 399 DoS 2017-04-22 2017-04-25
4.3
None Remote Medium Not required None None Partial
PoDoFo 0.9.5 allows denial of service (infinite recursion and stack consumption) via a crafted PDF file in PoDoFo::PdfParser::ReadDocumentStructure (PdfParser.cpp).
3 CVE-2017-8052 79 XSS 2017-04-21 2017-04-26
4.3
None Remote Medium Not required None Partial None
Craft CMS before 2.6.2974 allows XSS attacks.
4 CVE-2017-7994 476 DoS 2017-04-21 2017-04-26
4.3
None Remote Medium Not required None None Partial
The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.
5 CVE-2017-7982 119 DoS Overflow 2017-04-20 2017-04-25
4.3
None Remote Medium Not required None None Partial
Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file.
6 CVE-2017-7962 369 DoS 2017-04-19 2017-04-25
4.3
None Remote Medium Not required None None Partial
The iwgif_read_image function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.
7 CVE-2017-7960 119 DoS Overflow 2017-04-19 2017-04-25
4.3
None Remote Medium Not required None None Partial
The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.
8 CVE-2017-7946 416 DoS 2017-04-18 2017-04-21
4.3
None Remote Medium Not required None None Partial
The get_relocs_64 function in libr/bin/format/mach0/mach0.c in radare2 1.3.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted Mach0 file.
9 CVE-2017-7943 399 2017-04-18 2017-04-24
4.3
None Remote Medium Not required None None Partial
The ReadSVGImage function in svg.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file.
10 CVE-2017-7942 399 2017-04-18 2017-04-21
4.3
None Remote Medium Not required None None Partial
The ReadAVSImage function in avs.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file.
11 CVE-2017-7941 399 2017-04-18 2017-04-21
4.3
None Remote Medium Not required None None Partial
The ReadSGIImage function in sgi.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file.
12 CVE-2017-7940 400 2017-04-18 2017-04-25
4.3
None Remote Medium Not required None None Partial
The iw_read_gif_file function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to consume an amount of available memory via a crafted file.
13 CVE-2017-7939 119 DoS Overflow 2017-04-18 2017-04-25
4.3
None Remote Medium Not required None None Partial
The read_next_pam_token function in imagew-pnm.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (stack-based buffer over-read) via a crafted file.
14 CVE-2017-7897 79 XSS 2017-04-18 2017-04-25
4.3
None Remote Medium Not required None Partial None
A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
15 CVE-2017-7896 79 XSS 2017-04-18 2017-04-24
4.3
None Remote Medium Not required None Partial None
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS.
16 CVE-2017-7891 79 XSS 2017-04-17 2017-04-25
4.3
None Remote Medium Not required None Partial None
sourcebans-pp (SourceBans++) 1.5.4.7 has XSS in admin.comms.php via the rebanid parameter.
17 CVE-2017-7871 79 XSS 2017-04-14 2017-04-24
4.3
None Remote Medium Not required None Partial None
trollepierre/tdm before 2017-04-13 is vulnerable to a reflected XSS in tdm-master/webhook.php (challenge parameter).
18 CVE-2017-7854 119 DoS Overflow 2017-04-13 2017-04-20
4.3
None Remote Medium Not required None None Partial
The consume_init_expr function in wasm.c in radare2 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Web Assembly file.
19 CVE-2017-7742 119 Overflow 2017-04-12 2017-04-20
4.3
None Remote Medium Not required None None Partial
In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with read memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.
20 CVE-2017-7741 119 Overflow 2017-04-12 2017-04-20
4.3
None Remote Medium Not required None None Partial
In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a segmentation violation (with write memory access) via a specially crafted FLAC file during a resample attempt, a similar issue to CVE-2017-7585.
21 CVE-2017-7725 79 XSS 2017-04-13 2017-04-20
4.3
None Remote Medium Not required None Partial None
concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored and allows for arbitrary domains to be set for certain links displayed to subsequent visitors, potentially an XSS vector.
22 CVE-2017-7716 119 DoS Overflow 2017-04-12 2017-04-20
4.3
None Remote Medium Not required None None Partial
The read_u32_leb128 function in libr/util/uleb128.c in radare2 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted Web Assembly file.
23 CVE-2017-7697 119 Overflow 2017-04-11 2017-04-17
4.3
None Remote Medium Not required None None Partial
In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.
24 CVE-2017-7648 798 2017-04-10 2017-04-17
4.3
None Remote Medium Not required Partial None None
Foscam networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
25 CVE-2017-7646 200 +Info 2017-04-10 2017-04-17
4.0
None Remote Low Single system Partial None None
SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to browse the server's filesystem and read the contents of arbitrary files contained within.
26 CVE-2017-7626 79 XSS 2017-04-12 2017-04-20
4.3
None Remote Medium Not required None Partial None
The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php (n_art,type in GET Method).
27 CVE-2017-7624 399 2017-04-10 2017-04-14
4.3
None Remote Medium Not required None None Partial
The iw_read_bmp_file function in imagew-bmp.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to consume an amount of available memory via a crafted file.
28 CVE-2017-7623 119 DoS Overflow 2017-04-10 2017-04-14
4.3
None Remote Medium Not required None None Partial
The iwmiffr_convert_row32 function in imagew-miff.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.
29 CVE-2017-7621 79 XSS 2017-04-11 2017-04-17
4.3
None Remote Medium Not required None Partial None
Cross Site Scripting Vulnerability in core-eMLi in AuroMeera Technometrix Pvt. Ltd. eMLi V1.0 allows an Attacker to send malicious code, generally in the form of a browser-side script, to a different end user via the page parameter to code/student_portal/home.php. The affected versions are eMLi School Management 1.0, eMLi College Campus Management 1.0, and eMLi University Management 1.0.
30 CVE-2017-7613 20 DoS 2017-04-09 2017-04-13
4.3
None Remote Medium Not required None None Partial
elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.
31 CVE-2017-7612 119 DoS Overflow 2017-04-09 2017-04-13
4.3
None Remote Medium Not required None None Partial
The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
32 CVE-2017-7611 119 DoS Overflow 2017-04-09 2017-04-13
4.3
None Remote Medium Not required None None Partial
The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
33 CVE-2017-7610 119 DoS Overflow 2017-04-09 2017-04-13
4.3
None Remote Medium Not required None None Partial
The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
34 CVE-2017-7609 20 DoS 2017-04-09 2017-04-13
4.3
None Remote Medium Not required None None Partial
elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.
35 CVE-2017-7608 119 DoS Overflow 2017-04-09 2017-04-13
4.3
None Remote Medium Not required None None Partial
The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
36 CVE-2017-7607 119 DoS Overflow 2017-04-09 2017-04-13
4.3
None Remote Medium Not required None None Partial
The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
37 CVE-2017-7606 20 DoS 2017-04-09 2017-04-13
4.3
None Remote Medium Not required None None Partial
coders/rle.c in ImageMagick 7.0.5-4 has an "outside the range of representable values of type unsigned char" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.
38 CVE-2017-7598 369 DoS 2017-04-09 2017-04-13
4.3
None Remote Medium Not required None None Partial
tif_dirread.c in LibTIFF 4.0.7 might allow remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.
39 CVE-2017-7595 369 DoS 2017-04-09 2017-04-13
4.3
None Remote Medium Not required None None Partial
The JPEGSetupEncode function in tiff_jpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted image.
40 CVE-2017-7594 400 DoS 2017-04-09 2017-04-13
4.3
None Remote Medium Not required None None Partial
The OJPEGReadHeaderInfoSecTablesDcTable function in tif_ojpeg.c in LibTIFF 4.0.7 allows remote attackers to cause a denial of service (memory leak) via a crafted image.
41 CVE-2017-7593 119 Overflow +Info 2017-04-09 2017-04-13
4.3
None Remote Medium Not required Partial None None
tif_read.c in LibTIFF 4.0.7 does not ensure that tif_rawdata is properly initialized, which might allow remote attackers to obtain sensitive information from process memory via a crafted image.
42 CVE-2017-7591 79 XSS 2017-04-08 2017-04-13
4.3
None Remote Medium Not required None Partial None
OpenIDM through 4.0.0 and 4.5.0 is vulnerable to reflected cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by the _sortKeys parameter to the authzRoles script under managed/user/.
43 CVE-2017-7590 79 XSS 2017-04-08 2017-04-13
4.3
None Remote Medium Not required None Partial None
OpenIDM through 4.0.0 and 4.5.0 is vulnerable to persistent cross-site scripting (XSS) attacks within the Admin UI, as demonstrated by a crafted Managed Object Name.
44 CVE-2017-7589 200 +Info 2017-04-08 2017-04-13
4.0
None Remote Low Single system Partial None None
In OpenIDM through 4.0.0 before 4.5.0, the info endpoint may leak sensitive information upon a request by the "anonymous" user, as demonstrated by responses with a 200 HTTP status code and a JSON object containing IP address strings. This is related to a missing access-control check in bin/defaults/script/info/login.js.
45 CVE-2017-7586 119 Overflow 2017-04-07 2017-04-11
4.3
None Remote Medium Not required None None Partial
In libsndfile before 1.0.28, an error in the "header_read()" function (common.c) when handling ID3 tags can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
46 CVE-2017-7585 119 Overflow 2017-04-07 2017-04-10
4.3
None Remote Medium Not required None None Partial
In libsndfile before 1.0.28, an error in the "flac_buffer_copy()" function (flac.c) can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file.
47 CVE-2017-7583 79 XSS 2017-04-07 2017-04-12
4.3
None Remote Medium Not required None Partial None
ILIAS before 5.2.3 has XSS via SVG documents.
48 CVE-2017-7579 79 XSS 2017-04-07 2017-04-12
4.3
None Remote Medium Not required None Partial None
inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field.
49 CVE-2017-7566 918 Bypass 2017-04-06 2017-04-13
4.0
None Remote Low Single system Partial None None
MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism.
50 CVE-2017-7454 119 DoS Overflow 2017-04-05 2017-04-10
4.3
None Remote Medium Not required None None Partial
The iwgif_record_pixel function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.