CVE-2017-18517

The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues...

CVE-2017-18398

DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains SEC-331...

CVE-2017-18418

cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations SEC-265...

CVE-2017-17950

Cells Blog 3.5 has SQL Injection via the pubreadpost.php ptid parameter...

CVE-2017-18490

The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues...

CVE-2017-17683

Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c44 \\.\PSMEMDriver DeviceIoControl request...

CVE-2017-18413

In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears SEC-299...

CVE-2017-20167

A vulnerability, which was classified as problematic, was found in Minichan. This affects an unknown part of the file reports.php. The manipulation of the argument headline leads to cross site scripting. It is possible to initiate the attack remotely. The identifier of the patch is...

CVE-2017-20160

A vulnerability was found in flitto express-param up to 0.x. It has been classified as critical. This affects an unknown part of the file lib/fetchParams.js. The manipulation leads to improper handling of extra parameters. It is possible to initiate the attack remotely. Upgrading to version 1.0.0...

CVE-2017-16674

Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary whitelisted command and a secondary non-whitelisted command. This affects Datto Windows Agent DWA 1.0.5.0 and earlier...

CVE-2017-13910

An access issue was addressed with additional sandbox restrictions on applications. This issue is fixed in macOS High Sierra 10.13. An application may be able to access restricted files...

CVE-2017-15645

CSRF exists in Webmin 1.850. By sending a GET request to at/createjob.cgi containing dir=/= in the URI, an attacker to execute arbitrary commands...

CVE-2017-15385

The storeversioninfognuverdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service rreadle16 invalid write and application crash or possibly have unspecified other impact via a crafted ELF file...

CVE-2017-15226

Zyxel NBG6716 V1.00AAKG.9C0 devices allow command injection in the ozkerz component because beginIndex and endIndex are used directly in a popen call...

CVE-2017-15008

PRTG Network Monitor version 17.3.33.2830 is vulnerable to stored Cross-Site Scripting on all sensor titles, related to incorrect error handling for a %00 in the SRC attribute of an IMG element...

CVE-2017-14947

Artifex GSView 6.0 Beta on Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "Read Access Violation on Block Data Move starting at mupdfnet64!mIncrementalSaveFile+0x0000000000193359."...

CVE-2017-14451

An exploitable out-of-bounds read vulnerability exists in libevm Ethereum Virtual Machine of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read which can subsequently trigger an out-of-bounds write resulting in remote code execution. An attacker can create/send...

CVE-2017-14345

SQL Injection exists in tianchoy/blog through 2017-09-12 via the id parameter to view.php...

CVE-2017-14232

The readchunk function in flif-dec.cpp in Free Lossless Image Format FLIF 0.3 allows remote attackers to cause a denial of service invalid memory read and application crash via a crafted flif file...

CVE-2017-14231

GeniXCMS before 1.1.0 allows remote attackers to cause a denial of service account blockage by leveraging the mishandling of certain username substring relationships, such as the admin...