54418 matches found
CVE-2017-18493
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues...
CVE-2017-18448
cPanel before 64.0.21 allows certain file-read operations via a Serverinfomanpage API call SEC-252...
CVE-2017-18565
The updater plugin before 1.35 for WordPress has multiple XSS issues...
CVE-2017-18178
Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the redirection target, if the target is specified using a certain %40 syntax. This is fixed in 10.1...
CVE-2017-18376
An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before 3.3.1 allows users with read-only or read/write access to escalate their privileges to the administrator's privileges. This affects app/controllers/UserCtrl.scala...
CVE-2017-18916
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction...
CVE-2017-18871
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service application crash via an @ character before a JavaScript field name...
CVE-2017-18673
An issue was discovered on Samsung mobile devices with N7.x software. An attacker can disable the Location service on a locked device, making it impossible for the rightful owner to find a stolen device. The Samsung ID is SVE-2017-8524 May 2017...
CVE-2017-18592
The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wpupload directory for file uploads...
CVE-2017-18415
cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering SEC-302...
CVE-2017-18910
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. E-mail notifications can have spoofed links...
CVE-2017-18901
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover a team invite ID by requesting a JSON document...
CVE-2017-18505
The twitter-plugin plugin before 2.55 for WordPress has XSS...
CVE-2017-18406
cPanel before 67.9999.103 allows SQL injection during eximstats processing SEC-276...
CVE-2017-18523
The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book...
CVE-2017-18882
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via OpenGraph data...
CVE-2017-18486
Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote...
CVE-2017-18675
An issue was discovered on Samsung mobile devices with M6.0 and N7.x Exynos7420 or Exynox8890 chipsets software. The Camera application can leak uninitialized memory via ion. The Samsung ID is SVE-2016-6989 April 2017...
CVE-2017-18666
An issue was discovered on Samsung mobile devices with KK4.4, L5.0/5.1, M6.0, and N7.x software. Applications can send arbitrary premium SMS messages. The Samsung ID is SVE-2017-8701 June 2017...