Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (323565 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2017-18013 1 Libtiff 1 Libtiff 2024-11-21 N/A
In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.
CVE-2017-18012 1 Z-url Preview Project 1 Z-url Preview 2024-11-21 N/A
The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter.
CVE-2017-18011 1 Clickbank 1 Affiliate Ads For Clickbank Products 2024-11-21 N/A
The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the text_ads_ajax.php border_color parameter.
CVE-2017-18010 1 E-goi 1 Smart Marketing Sms And Newsletters Forms 2024-11-21 N/A
The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameter.
CVE-2017-18009 1 Opencv 1 Opencv 2024-11-21 N/A
In OpenCV 3.3.1, a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp.
CVE-2017-18008 2 Canonical, Imagemagick 2 Ubuntu Linux, Imagemagick 2024-11-21 N/A
In ImageMagick 7.0.7-17 Q16, there is a Memory Leak in ReadPWPImage in coders/pwp.c.
CVE-2017-17999 1 Fairsketch 1 Rise Ultimate Project Manager 2024-11-21 N/A
SQL injection vulnerability in RISE Ultimate Project Manager 1.9 allows remote attackers to execute arbitrary SQL commands via the search parameter to index.php/knowledge_base/get_article_suggestion/.
CVE-2017-17996 1 Flexense 1 Syncbreeze 2024-11-21 N/A
A buffer overflow vulnerability in "Add command" functionality exists in Flexense SyncBreeze Enterprise <= 10.3.14. The vulnerability can be triggered by an authenticated attacker who submits more than 5000 characters as the command name. It will cause termination of the SyncBreeze Enterprise server and possibly remote command execution with SYSTEM privilege.
CVE-2017-17976 1 Perfexcrm 1 Perfex Crm 2024-11-21 N/A
In Utilities.php in Perfex CRM 1.9.7, Unrestricted file upload can lead to remote code execution.
CVE-2017-17972 1 Archon Project 1 Archon 2024-11-21 N/A
packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open Bug Bounty ID OBB-466362.
CVE-2017-17970 1 Muvikoscript 1 Muviko 2024-11-21 N/A
Multiple SQL injection vulnerabilities in Muviko 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to login.php; the (2) season_id parameter to themes/flixer/ajax/load_season.php; the (3) movie_id parameter to themes/flixer/ajax/get_rating.php; the (4) rating or (5) movie_id parameter to themes/flixer/ajax/update_rating.php; or the (6) id parameter to themes/flixer/ajax/set_player_source.php.
CVE-2017-17947 1 Pulsesecure 1 Pulse Connect Secure 2024-11-21 N/A
A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure (PCS) before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure (PPS) before 5.2R10, 5.3.x before 5.3R9, and 5.4.x before 5.4R3 due to one of the URL parameters not being sanitized. Exploitation does require the user to be logged in as administrator; the issue is not applicable to the end user portal.
CVE-2017-17946 1 Novosoft 1 Handy Password 2024-11-21 N/A
A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data that is mishandled in an "Open from mail box" action.
CVE-2017-17945 1 Asus 2 Hivivo, Vivobaby 2024-11-21 N/A
The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation.
CVE-2017-17944 1 Asus 2 Hivivo, Vivobaby 2024-11-21 N/A
The ASUS Vivobaby application before 1.1.09 for Android has Missing SSL Certificate Validation.
CVE-2017-17902 1 Kliqqi 1 Kliqqi Cms 2024-11-21 N/A
SQL Injection exists in Kliqqi CMS 3.5.2 via the randkey parameter of a new story at the pligg/story.php?title= URI.
CVE-2017-17889 1 Kliqqi 1 Kliqqi Cms 2024-11-21 N/A
Kliqqi CMS 3.5.2 has XSS via a crafted group name in pligg/groups.php, a crafted Homepage string in a profile, or a crafted string in Tags or Description within pligg/submit.php.
CVE-2017-17867 1 Intenogroup 1 Iopsys 2024-11-21 N/A
Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the /etc/uci-defaults directory was not being used to secure the OpenWrt configuration.
CVE-2017-17860 2 Google, Samsung 3 Android, Gear S2, Gear S3 2024-11-21 N/A
In Samsung Gear products, Bluetooth link key is updated to the different key which is same with attacker's link key. It can be attacked without user's intention only if attacker can reveal the Bluetooth address of target device and paired user's smartphone
CVE-2017-17858 1 Artifex 1 Mupdf 2024-11-21 N/A
Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote attacker to potentially execute arbitrary code via a crafted PDF file, because xref subsection object numbers are unrestricted.