Shortcodes Ultimate <= 5.0.0 - Authenticated Contributor Code Execution

The Shortcodes Ultimate plugin does not sanitize the "filter" argument to the "sumeta", "suuser", and "supost" shortcodes, allowing the filter to be set to the "system" function which runs arbitrary code. This is being exploited in the wild; I discovered this though analysis of modsecurity audit...

CVE-2017-5092

Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page...

UBUNTU-CVE-2017-5078

Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as have an...

UBUNTU-CVE-2017-5071

Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows and Mac, and 59.0.3071.92 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page...

UBUNTU-CVE-2017-5097

Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page...

UBUNTU-CVE-2017-5092

Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page...

CVE-2017-5071

Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows and Mac, and 59.0.3071.92 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page...

CVE-2017-5077

Removed by vendor...

CVE-2017-5088

CVE-2017-5088 refers to an out-of-bounds read vulnerability in the V8 JavaScript engine of Google Chrome/Chromium before version 59.0.3071.104 (Android: 59.0.3071.117). The issue arises from insufficient validation in V8, allowing a remote attacker to read memory via a crafted HTML page. Public a...

VulnCheck KEV: CVE-2017-20206

The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from the wpmudevappointments cookie. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting...

Microsoft .NET Framework Remote Code Execution Vulnerability (KB4040973)

This host is missing a critical security update according to Microsoft Security Updates KB4040973. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Microsoft .NET Framework Remote Code Execution Vulnerability (KB4041086)

This host is missing a critical security update according to Microsoft Security Updates KB4041086. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Cross-Site Request Forgery(CSRF)

drupal/core is vulnerable to cross-site request forgery CSRF attacks. The library does not carry out form token validation early enough, allowing attackers to run the file upload value callbacks with untrusted input...

Description of the Security Only update for the .NET Framework 2.0 SP2 for Windows Server 2008 SP2: September 12, 2017

Description of the Security Only update for the .NET Framework 2.0 SP2 for Windows Server 2008 SP2: September 12, 2017 View products that this article applies to. Summary This security update resolves a vulnerability in the Microsoft .NET Framework that could allow remote code execution when...

Description of the Security Only update for the .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 for Windows 7 SP1 and Windows Server 2008 R2 SP1 and for the .NET Framework 4.6 for Windows Server 2008 SP2: September 12, 2017

None None...

.NET Framework Remote Code Execution Vulnerability

A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input. An attacker who successfully exploited this vulnerability in software using the .NET framework could take control of an affected system. An attacker could then install programs; view, change, or...

Description of the Security Only update for the .NET Framework 3.5 for Windows Server 2012: September 12, 2017

Description of the Security Only update for the .NET Framework 3.5 for Windows Server 2012: September 12, 2017 View products that this article applies to. Summary This security update resolves a vulnerability in the Microsoft .NET Framework that could allow remote code execution when Microsoft...

VulnCheck KEV: CVE-2017-8759

Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system...

Command Injection

Overview Affected versions of dns-sync have an arbitrary command execution vulnerability in the resolve method. Recommendation - Use an alternative dns resolver - Do not allow untrusted input into dns-sync.resolve References - Issue 1 - Commit d9abaae...

Artemis: Deserialization of untrusted input vulnerability

It was found that use of a JMS ObjectMessage does not safely handle user supplied data when deserializing objects. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...