CVE-2017-4946

CVE-2017-4946 affects VMware vRealize Operations for Published Applications/Desktop Agent (V4PA/V4H) 6.x prior to 6.5.1. A privilege escalation vulnerability exists that could allow a local, low-privilege user to escalate to SYSTEM on Windows. The issue is documented in VMware’s VMSA-2018-0003 an...

CVE-2017-5753

CVE-2017-5753 is part of the Spectre family (Variant 1) described in the SPECTRE_MELTDOWN_ADVISORY: it involves speculative execution and a bounds-check bypass that can enable an unprivileged attacker to read privileged memory via cache timing analysis. IBM’s AIX/VIOS advisories and iFixes addres...

CVE-2017-8046

CVE-2017-8046 is a remote code execution vulnerability affecting Spring Data REST before versions 2.6.9 (Ingalls SR9) and 3.0.1 (Kay SR1), and Spring Boot before 1.5.9 or 2.0 M6. When processing specially crafted JSON in PATCH requests, an attacker could execute arbitrary Java code on affected se...

CVE-2017-1000486

CVE-2017-1000486 affects Primetek Primefaces 5.x, with a weak encryption flaw enabling remote code execution. Public details describe a padding oracle issue exploited by attackers; Primefaces versions prior to 5.2.21, 5.3.8, or 6.0 are noted as vulnerable, with patches implied for those lines. Pu...

CVE-2018-3810

CVE-2018-3810 covers the Oturia WordPress Smart Google Code Inserter plugin before 3.5. An authentication bypass allows unauthenticated users to update the sgcgoogleanalytic parameter, causing arbitrary JavaScript/HTML to run on all WordPress pages via saveGoogleCode() which does not verify autho...

CVE-2017-16725

Technical details about CVE-2017-16725 are not publicly available in the provided documents; the connected items reference related flaws (e.g., CVE-2018-10088) but do not disclose specifics for this CVE. Monitor for updates.

CVE-2017-17761

CVE-2017-17761 affects Ichano AtHome IP Camera devices. The issue resides in the bundled noodles service on port 1300, which allows a remote LAN attacker, without authentication, to execute arbitrary commands. The attack relies on the binary accepting a command via a … XML element, with responses...

CVE-2017-17105

CVE-2017-17105 affects Zivif PR115-204-P-RS webcams (notably V2.3.4.2103 and V4.7.4.2121 and potentially intermediate builds). The vulnerability is an unauthenticated, blind remote command injection via CGI scripts used in the web interface, demonstrated by a request such as cgi-bin/iptest.cgi?cm...

CVE-2017-17106

CVE-2017-17106 affects Zivif PR115-204-P-RS V2.3.4.2103 Webcams. The vulnerability arises from a lack of authentication in CGI page requests (specifically /web/cgi-bin/hi3510/param.cgi?cmd=getuser), enabling an unauthenticated remote attacker to obtain credentials. Impact is credential disclosure...

CVE-2017-17562

Embedthis GoAhead before 3.6.5 allows remote code execution when CGI is enabled and a CGI program is dynamically linked. The root cause is the initialization of the CGI environment from untrusted HTTP request parameters in cgi.c, enabling abuse via LD_PRELOAD and similar payloads posted to /proc/...

CVE-2017-17560

CVE-2017-17560 affects Western Digital MyCloud PR4100 devices (2.30.172). The web management component at /web/jquery/uploader/multi_uploadify.php exposes multipart file upload without authentication, enabling an attacker to place arbitrary files anywhere on the device and upload a PHP shell, lea...

CVE-2017-15944

CVE-2017-15944 affects Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6. The issue enables remote code execution via vectors involving the management/web interface, and public advisories describe a chain of bugs that can be exploited to gai...

CVE-2017-16894

CVE-2017-16894 affects Laravel up to version 5.5.21. Affected code path is writeNewEnvironmentFileWith in KeyGenerateCommand.php, which uses file_put_contents without restricting .env permissions, allowing an attacker to disclose the contents of the .env file via a direct request to /.env. The vu...

CVE-2017-1000170

CVE-2017-1000170 affects the WordPress Delightful Downloads plugin’s jqueryFileTree 2.1.5 and older. The connected documents describe a directory traversal/local file inclusion vulnerability in jqueryFileTree, allowing an attacker to include arbitrary local files via the jqueryFileTree.php connec...

CVE-2017-11884

Technical details about CVE-2017-11884 are not publicly provided in the connected documents; no specific affected products, versions, exploit vectors, or remediation are disclosed here. Monitor for updates.

CVE-2017-11882

CVE-2017-11882 is a memory corruption vulnerability in Microsoft Office's Equation Editor that affects Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016. The flaw resides in eqnedt32.exe, an out-of-process COM server, and can lead to remote code execution when a user opens a specially crafted Word do...

CVE-2017-12635

CVE-2017-12635 affects Apache CouchDB versions before 1.7.0 and 2.x before 2.1.1, where differences between the Erlang JSON parser and the JavaScript JSON parser allow a user document to contain duplicate roles keys. The second roles key governs authorization for writing the user, while the first...

CVE-2017-16651

CVE-2017-16651 - Roundcube Webmail file disclosure : Authenticated users can read arbitrary files on the host filesystem via the file-based attachment plugin workflow (_task=settings&_action=upload-display&_from=timezone). Affected versions include Roundcube before 1.1.10, 1.2.x before 1.2.7, and...

CVE-2017-11512

Affected product: ManageEngine ServiceDesk 9.3.9328. Vulnerability: Arbitrary file retrieval/download due to improper restrictions on the pathname in the name parameter of the download-snapshot path. Impact: Unauthenticated remote attacker can download arbitrary files from the server. Root cause:...

CVE-2017-16237

CVE-2017-16237 affects the Vir.IT eXplorer Anti-Virus driver file VIAGLT64.SYS (pre-8.5.42). The vulnerability is an Arbitrary Write caused by input validation failure from IOCTL 0x8273007C, enabling a local attacker to write arbitrary memory. Documented impact in the connected sources: local pri...