CVE-2017-12000 to CVE-2017-12999

126 CVEs with public proof-of-concept exploits.

• CVE-2017-120681 PoCThe Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk…
• CVE-2017-120811 PoCAn exploitable integer overflow exists in the upgrade of a legacy Mesh attribute of the Blender open-source 3d creation suite v2.78c. A…
• CVE-2017-120821 PoCAn exploitable integer overflow exists in the 'CustomData' Mesh loading functionality of the Blender open-source 3d creation suite. A…
• CVE-2017-120861 PoCAn exploitable integer overflow exists in the 'BKE_mesh_calc_normals_tessface' functionality of the Blender open-source 3d creation suite.…
• CVE-2017-120881 PoCAn exploitable denial of service vulnerability exists in the Ethernet functionality of the Allen Bradley Micrologix 1400 Series B FRN 21.2…
• CVE-2017-120891 PoCAn exploitable denial of service vulnerability exists in the program download functionality of Allen Bradley Micrologix 1400 Series B FRN…
• CVE-2017-120901 PoCAn exploitable denial of service vulnerability exists in the processing of snmp-set commands of the Allen Bradley Micrologix 1400 Series B…
• CVE-2017-120921 PoCAn exploitable file write vulnerability exists in the memory module functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and…
• CVE-2017-120931 PoCAn exploitable insufficient resource pool vulnerability exists in the session communication functionality of Allen Bradley Micrologix 1400…
• CVE-2017-120941 PoCAn exploitable vulnerability exists in the WiFi Channel parsing of Circle with Disney running firmware 2.0.1. A specially crafted SSID can…
• CVE-2017-120951 PoCAn exploitable vulnerability exists in the WiFi Access Point feature of Circle with Disney running firmware 2.0.1. A series of WiFi…
• CVE-2017-120961 PoCAn exploitable vulnerability exists in the WiFi management of Circle with Disney. A crafted Access Point with the same name as the…
• CVE-2017-120991 PoCAn exploitable integer overflow exists in the upgrade of the legacy Mesh attribute 'tface' of the Blender open-source 3d creation suite…
• CVE-2017-121001 PoCAn exploitable integer overflow exists in the 'multires_load_old_dm' functionality of the Blender open-source 3d creation suite v2.78c. A…
• CVE-2017-121011 PoCAn exploitable integer overflow exists in the 'modifier_mdef_compact_influences' functionality of the Blender open-source 3d creation…
• CVE-2017-121021 PoCAn exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts curves to polygons. A…
• CVE-2017-121031 PoCAn exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts text rendered as a font…
• CVE-2017-121041 PoCAn exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c draws a Particle object. A…
• CVE-2017-121051 PoCAn exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c applies a particular object…
• CVE-2017-121121 PoCAn exploitable improper authorization vulnerability exists in admin_addPeer API of cpp-ethereum's JSON-RPC (commit…
• CVE-2017-121191 PoCAn exploitable unhandled exception vulnerability exists in multiple APIs of CPP-Ethereum JSON-RPC. Specially crafted JSON requests can…
• CVE-2017-121201 PoCAn exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially…
• CVE-2017-121211 PoCAn exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially…
• CVE-2017-121231 PoCAn exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1…
• CVE-2017-121241 PoCAn exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially…
• CVE-2017-121251 PoCAn exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially…
• CVE-2017-121261 PoCAn exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A…
• CVE-2017-121271 PoCA password storage vulnerability exists in the operating system functionality of Moxa EDR-810 V4.1 build 17030317. An attacker with shell…
• CVE-2017-121281 PoCAn exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317. A…
• CVE-2017-121291 PoCAn exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317.…
• CVE-2017-121301 PoCAn exploitable NULL pointer dereference vulnerability exists in the tinysvcmdns library version 2017-11-05. A specially crafted packet can…
• CVE-2017-121311 PoCThe Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default…
• CVE-2017-121381 PoCXOOPS Core 2.5.8 has a stored URL redirect bypass vulnerability in /modules/profile/index.php because of the URL filter.
• CVE-2017-1214919 PoCsKEVIn Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the…
• CVE-2017-121991 PoCThe Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions:…
• CVE-2017-122431 PoCA vulnerability in the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and…
• CVE-2017-123741 PoCThe ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to…
• CVE-2017-123751 PoCThe ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to…
• CVE-2017-123761 PoCClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause…
• CVE-2017-123771 PoCClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause…
• CVE-2017-123781 PoCClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause…
• CVE-2017-123791 PoCClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause…
• CVE-2017-123801 PoCClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause…
• CVE-2017-124131 PoCAXIS 2100 devices 2.43 have XSS via the URI, possibly related to admin/admin.shtml.
• CVE-2017-124151 PoCOXID eShop Community Edition before 6.0.0 RC2 (development), 4.10.x before 4.10.5 (maintenance), and 4.9.x before 4.9.10 (legacy),…
• CVE-2017-124261 PoCGitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10,…
• CVE-2017-124271 PoCThe ProcessMSLScript function in coders/msl.c in ImageMagick before 6.9.9-5 and 7.x before 7.0.6-5 allows remote attackers to cause a…
• CVE-2017-124391 PoCSocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xml_path HTTP parameter that…
• CVE-2017-124471 PoCGdkPixBuf (aka gdk-pixbuf), possibly 2.32.2, as used by GNOME Nautilus 3.14.3 on Ubuntu 16.04, allows attackers to cause a denial of…
• CVE-2017-124773 PoCsIt was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue…
• CVE-2017-124784 PoCsIt was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input…
• CVE-2017-124791 PoCIt was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable…
• CVE-2017-125001 PoCA Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was…
• CVE-2017-125426 PoCsA authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found.
• CVE-2017-125441 PoCA cross-site scripting vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.
• CVE-2017-125572 PoCsA Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and earlier was found.
• CVE-2017-125612 PoCsA remote code execution vulnerability in HPE intelligent Management Center (iMC) PLAT version Plat 7.3 E0504P4 and earlier was found.
• CVE-2017-125791 PoCAn insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and earlier allows a…
• CVE-2017-125811 PoCGitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all…
• CVE-2017-125832 PoCsDokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php.
• CVE-2017-125841 PoCThere is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile (including the password) can be updated without…
• CVE-2017-125851 PoCSLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAX_lookup_handler.php (tableName and tableFields parameters),…
• CVE-2017-125861 PoCSLiMS 8 Akasia through 8.3.1 has an arbitrary file reading issue because of directory traversal in the url parameter to admin/help.php. It…
• CVE-2017-126116 PoCsIn Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string…
• CVE-2017-1261523 PoCsKEVWhen running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of…
• CVE-2017-1261719 PoCsKEVWhen running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled…
• CVE-2017-126241 PoCApache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message…
• CVE-2017-126297 PoCsRemote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config…
• CVE-2017-1263513 PoCsDue to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x…
• CVE-2017-126368 PoCsCouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating…
• CVE-2017-126372 PoCsKEVDirectory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5…
• CVE-2017-126531 PoC360 Total Security 9.0.0.1202 before 2017-07-07 allows Privilege Escalation via a Trojan horse Shcore.dll file in any directory in the…
• CVE-2017-126921 PoCThe ReadVIFFImage function in coders/viff.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory…
• CVE-2017-126931 PoCThe ReadBMPImage function in coders/bmp.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption)…
• CVE-2017-127171 PoCAn Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A maliciously crafted dll…
• CVE-2017-127181 PoCA Classic Buffer Overflow issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6.…
• CVE-2017-127571 PoCCertain Ambit Technologies Pvt. Ltd products are affected by: SQL Injection. This affects iTech B2B Script 4.42i and Tech Business…
• CVE-2017-127581 PoChttps://www.joomlaextensions.co.in/ Joomla! Component Appointment 1.1 is affected by: SQL Injection. The impact is: Code execution…
• CVE-2017-127591 PoCYnet Interactive - http://demo.ynetinteractive.com/soa/ SOA School Management 3.0 is affected by: SQL Injection. The impact is: Code…
• CVE-2017-127601 PoCYnet Interactive - http://demo.ynetinteractive.com/mobiketa/ Mobiketa 4.0 is affected by: SQL Injection. The impact is: Code execution…
• CVE-2017-127611 PoChttp://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download (remote).…
• CVE-2017-127631 PoCAn unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining…
• CVE-2017-127802 PoCsThe ReadData function in ebmlstring.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (invalid free…
• CVE-2017-127812 PoCsThe EBML_BufferToID function in ebmlelement.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (Null…
• CVE-2017-127822 PoCsThe ReadData function in ebmlmaster.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert fault)…
• CVE-2017-127832 PoCsThe ReadDataFloat function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert…
• CVE-2017-127851 PoCThe novish command-line interface, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, is…
• CVE-2017-127861 PoCNetwork interfaces of the cliengine and noviengine services, included in the NoviWare software distribution through NW400.2.6 and deployed…
• CVE-2017-127871 PoCA network interface of the novi_process_manager_daemon service, included in the NoviWare software distribution through NW400.2.6 and…
• CVE-2017-127881 PoCMultiple cross-site scripting (XSS) vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web…
• CVE-2017-127891 PoCMetinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is:…
• CVE-2017-127901 PoCMetinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is:…
• CVE-2017-127921 PoCMultiple cross-site request forgery (CSRF) vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack the authentication of…
• CVE-2017-127943 PoCsIn Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500…
• CVE-2017-128002 PoCsThe EBML_FindNextElement function in ebmlmain.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (Null…
• CVE-2017-128012 PoCsThe UpdateDataSize function in ebmlmaster.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert…
• CVE-2017-128022 PoCsThe EBML_IntegerValue function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote attackers to cause a denial of service (assert…
• CVE-2017-128041 PoCThe iwgif_init_screen function in imagew-gif.c:510 in ImageWorsener 1.3.2 allows remote attackers to cause a denial of service (hmemory…
• CVE-2017-128051 PoCIn ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which allows attackers to cause a…
• CVE-2017-128061 PoCIn ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which allows attackers to cause a denial…
• CVE-2017-128141 PoCStack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on…
• CVE-2017-128241 PoCSpecial crafted InPage document leads to arbitrary code execution in InPage reader.
• CVE-2017-128391 PoCA heap-based buffer over-read in the getbits function in src/libmpg123/getbits.h in mpg123 through 1.25.5 allows remote attackers to cause…
• CVE-2017-128441 PoCCross-site scripting (XSS) vulnerability in the admin panel in IceWarp Mail Server 10.4.4 allows remote authenticated domain…
• CVE-2017-128531 PoCThe RealTime RWR-3G-100 Router Firmware Version : Ver1.0.56 is affected by CSRF an attack that forces an end user to execute unwanted…
• CVE-2017-128561 PoCCross-site scripting (XSS) vulnerability in C.P.Sub 5.2 allows remote attackers to inject arbitrary web script or HTML via the keyword…
• CVE-2017-129293 PoCsArbitrary File Upload in resource.php of TecnoVISION DLX Spot Player4 version >1.5.10 allows remote authenticated users to upload…
• CVE-2017-129302 PoCsSQL Injection in the admin interface in TecnoVISION DLX Spot Player4 version >1.5.10 allows remote unauthenticated users to access the web…
• CVE-2017-129381 PoCUnRAR before 5.5.7 allows remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the .…
• CVE-2017-129401 PoClibunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function.
• CVE-2017-129411 PoClibunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function.
• CVE-2017-129421 PoClibunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ function.
• CVE-2017-129433 PoCsD-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?REQUIRE_FILE=…
• CVE-2017-129453 PoCsInsufficient validation of user-supplied input for the Solstice Pod before 2.8.4 networking configuration enables authenticated attackers…
• CVE-2017-129501 PoCThe gig::Region::Region function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference…
• CVE-2017-129511 PoCThe gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service…
• CVE-2017-129521 PoCThe LoadString function in helper.h in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and…
• CVE-2017-129531 PoCThe gig::Instrument::UpdateRegionKeyTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service…
• CVE-2017-129541 PoCThe gig::Region::GetSampleFromWavePool function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid…
• CVE-2017-129653 PoCsSession fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
• CVE-2017-129691 PoCBuffer overflow in the ViewerCtrlLib.ViewerCtrl ActiveX control in Avaya IP Office Contact Center before 10.1.1 allows remote attackers to…
• CVE-2017-129703 PoCsCross-site request forgery (CSRF) vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authentication of…
• CVE-2017-129713 PoCsCross-site scripting (XSS) vulnerability in Apache2Triad 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the…
• CVE-2017-129791 PoCDokuWiki through 2017-02-19c has stored XSS when rendering a malicious language name in a code element, in /inc/parser/xhtml.php. An…
• CVE-2017-129801 PoCDokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php. An attacker can create…
• CVE-2017-129841 PoCPHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/message_update.php.