Export limit exceeded: 21326 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 23644 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 92275 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (92275 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2017-16602 | 1 Netgain-systems | 1 Enterprise Manager | 2024-11-21 | N/A |
| This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.tools.exec_jsp servlet, which listens on TCP port 8081 by default. When parsing the command parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of Administrator. Was ZDI-CAN-5193. | ||||
| CVE-2017-16557 | 1 K7computing | 5 Antivirus, Endpoint, Internet Security and 2 more | 2024-11-21 | N/A |
| K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way. | ||||
| CVE-2017-16555 | 1 K7computing | 5 Antivirus, Endpoint, Internet Security and 2 more | 2024-11-21 | N/A |
| K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way. | ||||
| CVE-2017-16554 | 1 K7computing | 5 Antivirus, Endpoint, Internet Security and 2 more | 2024-11-21 | N/A |
| K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL calls. | ||||
| CVE-2017-16553 | 1 K7computing | 5 Antivirus, Endpoint, Internet Security and 2 more | 2024-11-21 | N/A |
| K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way. | ||||
| CVE-2017-16552 | 1 K7computing | 5 Antivirus, Endpoint, Internet Security and 2 more | 2024-11-21 | N/A |
| K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL calls. | ||||
| CVE-2017-16551 | 1 K7computing | 5 Antivirus, Endpoint, Internet Security and 2 more | 2024-11-21 | N/A |
| K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way. | ||||
| CVE-2017-16549 | 1 K7computing | 5 Antivirus, Endpoint, Internet Security and 2 more | 2024-11-21 | N/A |
| K7 Antivirus Premium before 15.1.0.53 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a specific set of IOCTL calls. | ||||
| CVE-2017-16514 | 1 Websitebaker | 1 Websitebaker | 2024-11-21 | N/A |
| Multiple persistent stored Cross-Site-Scripting (XSS) vulnerabilities in the files /wb/admin/admintools/tool.php (Droplet Description) and /install/index.php (Site Title) in WebsiteBaker 2.10.0 allow attackers to insert persistent JavaScript code that gets reflected back to users in multiple areas in the application. | ||||
| CVE-2017-16356 | 1 Kubik-rubik | 1 Simple Image Gallery Extended | 2024-11-21 | N/A |
| Reflected XSS in Kubik-Rubik SIGE (aka Simple Image Gallery Extended) before 3.3.0 allows attackers to execute JavaScript in a victim's browser by having them visit a plugins/content/sige/plugin_sige/print.php link with a crafted img, name, or caption parameter. | ||||
| CVE-2017-16254 | 1 Insteon | 2 Hub, Hub Firmware | 2024-11-21 | 8.1 High |
| An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can send an authenticated HTTP request at 0x9d014e4c the value for the flg key is copied using strcpy to the buffer at $sp+0x270. This buffer is 16 bytes large, sending anything longer will cause a buffer overflow. | ||||
| CVE-2017-16253 | 1 Insteon | 2 Hub, Hub Firmware | 2024-11-21 | 8.1 High |
| An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012 for the cc channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can send an authenticated HTTP request At 0x9d014dd8 the value for the id key is copied using strcpy to the buffer at $sp+0x290. This buffer is 32 bytes large, sending anything longer will cause a buffer overflow. | ||||
| CVE-2017-16252 | 1 Insteon | 2 Hub 2245-222, Hub Firmware | 2024-11-21 | 8.1 High |
| Specially crafted commands sent through the PubNub service in Insteon Hub 2245-222 with firmware version 1012 can cause a stack-based buffer overflow overwriting arbitrary data. An attacker should send an authenticated HTTP request to trigger this vulnerability.At 0x9d014cc0 the value for the cmd key is copied using strcpy to the buffer at $sp+0x11c. This buffer is 20 bytes large, sending anything longer will cause a buffer overflow. | ||||
| CVE-2017-16232 | 3 Libtiff, Opensuse, Suse | 5 Libtiff, Leap, Linux Enterprise Desktop and 2 more | 2024-11-21 | N/A |
| LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue | ||||
| CVE-2017-16100 | 1 Dns-sync Project | 1 Dns-sync | 2024-11-21 | N/A |
| dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible. | ||||
| CVE-2017-16043 | 1 Shout Project | 1 Shout | 2024-11-21 | 6.1 Medium |
| Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3. | ||||
| CVE-2017-16042 | 1 Growl Project | 1 Growl | 2024-11-21 | N/A |
| Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution. | ||||
| CVE-2017-16022 | 1 Morris.js Project | 1 Morris.js | 2024-11-21 | N/A |
| Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If control over the labels is obtained, script can be injected. The script will run on the client side whenever that specific graph is loaded. | ||||
| CVE-2017-16019 | 1 Gitbook | 1 Gitbook | 2024-11-21 | N/A |
| GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online reader. | ||||
| CVE-2017-16018 | 1 Restify | 1 Restify | 2024-11-21 | N/A |
| Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can get script to run in some browsers. | ||||