| ID | Summary | Flags | Max Score |
|---|---|---|---|
| CVE-2017-18001 | Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary ... | E | |
| CVE-2017-18004 | Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint.... | E | |
| CVE-2017-18005 | Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, rel... | E | |
| CVE-2017-18006 | netpub/server.np in Extensis Portfolio NetPublish has XSS in the quickfind parameter, aka Open Bug B... | | |
| CVE-2017-18008 | In ImageMagick 7.0.7-17 Q16, there is a Memory Leak in ReadPWPImage in coders/pwp.c.... | E | |
| CVE-2017-18009 | In OpenCV 3.3.1, a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature... | | |
| CVE-2017-18010 | The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via th... | E | |
| CVE-2017-18011 | The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the ... | E | |
| CVE-2017-18012 | The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter.... | E | |
| CVE-2017-18013 | In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c TIFFPrintDirectory function... | E S | |
| CVE-2017-18014 | An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.... | E | |
| CVE-2017-18015 | The ILLID Share This Image plugin before 1.04 for WordPress has XSS via the sharer.php url parameter... | E | |
| CVE-2017-18016 | Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtai... | E S | |
| CVE-2017-18017 | The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and ... | S | |
| CVE-2017-18018 | In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a pla... | E | |
| CVE-2017-18019 | In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficie... | | |
| CVE-2017-18020 | On Samsung mobile devices with L(5.x), M(6.x), and N(7.x) software and Exynos chipsets, attackers ca... | | |
| CVE-2017-18021 | It was discovered that QtPass before 1.2.1, when using the built-in password generator, generates po... | E S | |
| CVE-2017-18022 | In ImageMagick 7.0.7-12 Q16, there are memory leaks in MontageImageCommand in MagickWand/montage.c.... | E | |
| CVE-2017-18023 | Office Tracker 11.2.5 has XSS via the logincount parameter to the /otweb/OTPClientLogin URI.... | E | |
| CVE-2017-18024 | AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a para... | E | |
| CVE-2017-18025 | cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allows remote attackers to execute arbitrary ... | E | |
| CVE-2017-18026 | Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --d... | S | |
| CVE-2017-18027 | In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in co... | E | |
| CVE-2017-18028 | In ImageMagick 7.0.7-1 Q16, a memory exhaustion vulnerability was found in the function ReadTIFFImag... | E | |
| CVE-2017-18029 | In ImageMagick 7.0.6-10 Q16, a memory leak vulnerability was found in the function ReadMATImage in c... | E | |
| CVE-2017-18030 | The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privi... | | |
| CVE-2017-18032 | The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_gener... | E | |
| CVE-2017-18033 | The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create n... | | |
| CVE-2017-18034 | The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows a... | | |
| CVE-2017-18035 | The /rest/review-coverage-chart/1.0/data/ | | |
| CVE-2017-18036 | The Github repository importer in Atlassian Bitbucket Server before version 5.3.0 allows remote atta... | | |
| CVE-2017-18037 | The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11... | | |
| CVE-2017-18038 | The repository settings resource in Atlassian Bitbucket Server before version 5.6.0 allows remote at... | | |
| CVE-2017-18039 | The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows re... | | |
| CVE-2017-18040 | The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote att... | | |
| CVE-2017-18041 | The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows r... | | |
| CVE-2017-18042 | The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attac... | | |
| CVE-2017-18043 | Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a deni... | | |
| CVE-2017-18044 | A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11... | E | |
| CVE-2017-18045 | JBMC DirectAdmin before 1.52, when the email_ftp_password_change setting is nonzero, allows remote a... | | |
| CVE-2017-18046 | Buffer overflow on Dasan GPON ONT WiFi Router H640X 12.02-01121 2.77p1-1124 and 3.03p2-1146 devices ... | E | |
| CVE-2017-18047 | Buffer Overflow in the FTP client in LabF nfsAxe 3.7 allows remote FTP servers to execute arbitrary ... | E | |
| CVE-2017-18048 | Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on... | E S | |
| CVE-2017-18049 | In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it... | E | |
| CVE-2017-18050 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18051 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18052 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18053 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18054 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18055 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18056 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | | |
| CVE-2017-18057 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18058 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18059 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18060 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18061 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18062 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18063 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18064 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18065 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18066 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18067 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18068 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | S | |
| CVE-2017-18069 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Li... | | |
| CVE-2017-18070 | In wma_ndp_end_response_event_handler(), the variable len_end_rsp is a uint32 which can be overflowe... | S | |
| CVE-2017-18071 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear ... | | |
| CVE-2017-18072 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear ... | | |
| CVE-2017-18073 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobi... | | |
| CVE-2017-18074 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear ... | | |
| CVE-2017-18075 | crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local us... | S | |
| CVE-2017-18076 | In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected becaus... | S | |
| CVE-2017-18077 | index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDo... | E S | |
| CVE-2017-18078 | systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinke... | E | |
| CVE-2017-18079 | drivers/input/serio/i8042.c in the Linux kernel before 4.12.4 allows attackers to cause a denial of ... | S | |
| CVE-2017-18080 | The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers ... | | |
| CVE-2017-18081 | The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject a... | | |
| CVE-2017-18082 | The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attacker... | | |
| CVE-2017-18083 | The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers ... | | |
| CVE-2017-18084 | The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers ... | | |
| CVE-2017-18085 | The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote ... | | |
| CVE-2017-18086 | Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inje... | | |
| CVE-2017-18087 | The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, ... | | |
| CVE-2017-18088 | Various plugin servlet resources in Atlassian Bitbucket Server before version 5.3.7 (the fixed versi... | | |
| CVE-2017-18089 | The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4... | | |
| CVE-2017-18090 | Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before... | | |
| CVE-2017-18091 | The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed ve... | | |
| CVE-2017-18092 | The print snippet resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) ... | | |
| CVE-2017-18093 | Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.... | | |
| CVE-2017-18094 | Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.... | | |
| CVE-2017-18095 | The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x)... | | |
| CVE-2017-18096 | The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 befor... | | |
| CVE-2017-18097 | The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers wh... | | |
| CVE-2017-18098 | The searchrequest-xml resource in Atlassian Jira before version 7.6.1 allows remote attackers to inj... | | |
| CVE-2017-18100 | The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject ... | | |
| CVE-2017-18101 | Various administrative external system import resources in Atlassian JIRA Server (including JIRA Cor... | | |
| CVE-2017-18102 | The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remo... | | |
| CVE-2017-18103 | The atlassian-http library, as used in various Atlassian products, before version 2.0.2 allows remot... | | |
| CVE-2017-18104 | The Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before version ... | E | |
| CVE-2017-18105 | The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before ver... | | |
| CVE-2017-18106 | The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially co... | | |
| CVE-2017-18107 | Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote... | | |
| CVE-2017-18108 | The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remot... | | |
| CVE-2017-18109 | The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before ... | | |
| CVE-2017-18110 | The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version ... | | |
| CVE-2017-18111 | The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before vers... | | |
| CVE-2017-18112 | Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a reposit... | | |
| CVE-2017-18113 | The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 al... | | |
| CVE-2017-18120 | A double-free bug in the read_gif function in gifread.c in gifsicle 1.90 allows a remote attacker to... | S | |
| CVE-2017-18121 | The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting att... | | |
| CVE-2017-18122 | A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp... | S | |
| CVE-2017-18123 | The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode use... | E S | |
| CVE-2017-18124 | During secure boot, addition is performed on uint8 ptrs which led to overflow issue in Small Cell So... | | |
| CVE-2017-18125 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear ... | | |
| CVE-2017-18126 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear ... | | |
| CVE-2017-18127 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear ... | | |
| CVE-2017-18128 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, impr... | | |
| CVE-2017-18129 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile and Snapdragon M... | | |
| CVE-2017-18130 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobi... | | |
| CVE-2017-18131 | In QTEE, an incorrect fuse value can be blown in Snapdragon Automobile, Snapdragon Mobile, Snapdrago... | | |
| CVE-2017-18132 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile and Snapdragon M... | | |
| CVE-2017-18133 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear ... | | |
| CVE-2017-18134 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, a bu... | | |
| CVE-2017-18135 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9650, MDM9655, SD... | | |
| CVE-2017-18136 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobi... | | |
| CVE-2017-18137 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9640, MDM9645, MD... | | |
| CVE-2017-18138 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear ... | | |
| CVE-2017-18139 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear ... | | |
| CVE-2017-18140 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobi... | | |
| CVE-2017-18141 | When a 3rd party TEE has been loaded it is possible for the non-secure world to create a secure moni... | | |
| CVE-2017-18142 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9650, MDM9655, SD... | | |
| CVE-2017-18143 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, on a... | | |
| CVE-2017-18144 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear ... | | |
| CVE-2017-18145 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear ... | | |
| CVE-2017-18146 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobi... | | |
| CVE-2017-18147 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF ... | | |
| CVE-2017-18153 | Use After Free in WLAN | | |
| CVE-2017-18154 | A crafted binder request can cause an arbitrary unmap in MediaServer in all Android releases from CA... | S | |
| CVE-2017-18155 | While playing HEVC content using HD DMB in Snapdragon Automobile and Snapdragon Mobile in version MS... | | |
| CVE-2017-18156 | While processing camera buffers in camera driver, a use after free condition can occur in Snapdragon... | | |
| CVE-2017-18157 | A Use After Free Condition can occur in Thermal Engine in Snapdragon Automobile, Snapdragon Mobile, ... | | |
| CVE-2017-18158 | Possible buffer overflows and array out of bounds accesses in Android releases from CAF using the li... | S | |
| CVE-2017-18159 | In Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Androi... | S | |
| CVE-2017-18160 | AGPS session failure in GNSS module due to cyphersuites are hardcoded and needed manual update every... | | |
| CVE-2017-18169 | User process can perform the kernel DOS in ashmem when doing cache maintenance operation in all Andr... | S | |
| CVE-2017-18170 | Improper input validation in Bluetooth Controller function can lead to possible memory corruption in... | | |
| CVE-2017-18171 | Improper input validation for GATT data packet received in Bluetooth Controller function can lead to... | | |
| CVE-2017-18172 | In a device, with screen size 1440x2560, the check of contiguous buffer will overflow on certain buf... | | |
| CVE-2017-18173 | In case of using an invalid android verified boot signature with very large length, an integer under... | | |
| CVE-2017-18174 | In the Linux kernel before 4.7, the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls ... | S | |
| CVE-2017-18175 | Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfi... | E | |
| CVE-2017-18176 | Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the sam... | E | |
| CVE-2017-18177 | Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Crea... | E | |
| CVE-2017-18178 | Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication to... | E | |
| CVE-2017-18179 | Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains v... | E | |
| CVE-2017-18183 | An issue was discovered in QPDF before 7.0.0. There is an infinite loop in the QPDFWriter::enqueueOb... | S | |
| CVE-2017-18184 | An issue was discovered in QPDF before 7.0.0. There is a stack-based out-of-bounds read in the funct... | S | |
| CVE-2017-18185 | An issue was discovered in QPDF before 7.0.0. There is a large heap-based out-of-bounds read in the ... | S | |
| CVE-2017-18186 | An issue was discovered in QPDF before 7.0.0. There is an infinite loop due to looping xref tables i... | | |
| CVE-2017-18187 | In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an integer overflow in PSK iden... | S | |
| CVE-2017-18188 | OpenRC opentmpfiles through 0.1.3, when the fs.protected_hardlinks sysctl is turned off, allows loca... | | |
| CVE-2017-18189 | In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifyin... | E | |
| CVE-2017-18190 | A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 a... | E S | |
| CVE-2017-18191 | An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching ... | E S | |
| CVE-2017-18192 | smart/calculator/gallerylock/CalculatorActivity.java in the "Photo,Video Locker-Calculator" applicat... | E | |
| CVE-2017-18193 | fs/f2fs/extent_cache.c in the Linux kernel before 4.13 mishandles extent trees, which allows local u... | S | |
| CVE-2017-18194 | SQL injection vulnerability in users/signup.php in the "signup" component in HamayeshNegar CMS allow... | E | |
| CVE-2017-18195 | An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthent... | E S | |
| CVE-2017-18196 | Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operat... | | |
| CVE-2017-18197 | In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() i... | E | |
| CVE-2017-18198 | print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a d... | | |
| CVE-2017-18199 | realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of s... | E | |
| CVE-2017-18200 | The f2fs implementation in the Linux kernel before 4.14 mishandles reference counts associated with ... | S | |
| CVE-2017-18201 | An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() ... | S | |
| CVE-2017-18202 | The __oom_reap_task_mm function in mm/oom_kill.c in the Linux kernel before 4.14.4 mishandles gather... | S | |
| CVE-2017-18203 | The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local us... | S | |
| CVE-2017-18204 | The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users t... | S | |
| CVE-2017-18205 | In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer derefere... | S | |
| CVE-2017-18206 | In utils.c in zsh before 5.4, symlink expansion had a buffer overflow.... | S | |
| CVE-2017-18207 | The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonz... | | |
| CVE-2017-18208 | The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users t... | | |
| CVE-2017-18209 | In the GetOpenCLCachedFilesDirectory function in magick/opencl.c in ImageMagick 7.0.7, a NULL pointe... | S | |
| CVE-2017-18210 | In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function BenchmarkOp... | S | |
| CVE-2017-18211 | In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function saveBinaryC... | S | |
| CVE-2017-18212 | An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_c... | | |
| CVE-2017-18213 | In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges.... | | |
| CVE-2017-18214 | The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a... | S | |
| CVE-2017-18215 | xvpng.c in xv 3.10a has memory corruption (out-of-bounds write) when decoding PNG comment fields, le... | | |
| CVE-2017-18216 | In fs/ocfs2/cluster/nodemanager.c in the Linux kernel before 4.15, local users can cause a denial of... | S | |
| CVE-2017-18217 | An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web... | E S | |
| CVE-2017-18218 | In drivers/net/ethernet/hisilicon/hns/hns_enet.c in the Linux kernel before 4.13, local users can ca... | S | |
| CVE-2017-18219 | An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in t... | E S | |
| CVE-2017-18220 | The ReadOneJNGImage and ReadJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 allow remote... | E S | |
| CVE-2017-18221 | The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to... | S | |
| CVE-2017-18222 | In the Linux kernel before 4.12, Hisilicon Network Subsystem (HNS) does not consider the ETH_SS_PRIV... | S | |
| CVE-2017-18223 | BMC Remedy AR System before 9.1 SP3, when Remedy AR Authentication is enabled, allows attackers to o... | | |
| CVE-2017-18224 | In the Linux kernel before 4.15, fs/ocfs2/aops.c omits use of a semaphore and consequently has a rac... | S | |
| CVE-2017-18225 | The Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router, ja... | | |
| CVE-2017-18226 | The Gentoo net-im/jabberd2 package through 2.6.1 sets the ownership of /var/run/jabber to the jabber... | | |
| CVE-2017-18227 | TitanHQ WebTitan Gateway has incorrect certificate validation for the TLS interception feature.... | | |
| CVE-2017-18228 | Remedy Mid Tier in BMC Remedy AR System 9.1 allows XSS via the ATTKey parameter in an arsys/servlet/... | | |
| CVE-2017-18229 | An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in t... | E | |
| CVE-2017-18230 | An issue was discovered in GraphicsMagick 1.3.26. A NULL pointer dereference vulnerability was found... | S | |
| CVE-2017-18231 | An issue was discovered in GraphicsMagick 1.3.26. A NULL pointer dereference vulnerability was found... | S | |
| CVE-2017-18232 | The Serial Attached SCSI (SAS) implementation in the Linux kernel through 4.15.9 mishandles a mutex ... | S | |
| CVE-2017-18233 | An issue was discovered in Exempi before 2.4.4. Integer overflow in the Chunk class in XMPFiles/sour... | E S | |
| CVE-2017-18234 | An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of serv... | E S | |
| CVE-2017-18235 | An issue was discovered in Exempi before 2.4.3. The VPXChunk class in XMPFiles/source/FormatSupport/... | E S | |
| CVE-2017-18236 | An issue was discovered in Exempi before 2.4.4. The ASF_Support::ReadHeaderObject function in XMPFil... | E S | |
| CVE-2017-18237 | An issue was discovered in Exempi before 2.4.3. The PostScript_Support::ConvertToDate function in XM... | E S | |
| CVE-2017-18238 | An issue was discovered in Exempi before 2.4.4. The TradQT_Manager::ParseCachedBoxes function in XMP... | E S | |
| CVE-2017-18239 | A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/sca... | S | |
| CVE-2017-18240 | The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to th... | | |
| CVE-2017-18241 | fs/f2fs/segment.c in the Linux kernel before 4.13 allows local users to cause a denial of service (N... | S | |
| CVE-2017-18242 | The apply_dependent_coupling function in libavcodec/aacdec.c in Libav 12.2 allows remote attackers t... | | |
| CVE-2017-18243 | The unpack_parse_unit function in libavcodec/dirac_parser.c in Libav 12.2 allows remote attackers to... | | |
| CVE-2017-18244 | The stereo_processing function in libavcodec/aacps.c in Libav 12.2 allows remote attackers to cause ... | | |
| CVE-2017-18245 | The mpc8_probe function in libavformat/mpc8.c in Libav 12.2 allows remote attackers to cause a denia... | | |
| CVE-2017-18246 | The pcm_encode_frame function in libavcodec/pcm.c in Libav 12.2 allows remote attackers to cause a d... | | |
| CVE-2017-18247 | The av_audio_fifo_size function in libavutil/audio_fifo.c in Libav 12.2 allows remote attackers to c... | | |
| CVE-2017-18248 | The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be ... | E S | |
| CVE-2017-18249 | The add_free_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does not properly track ... | S | |
| CVE-2017-18250 | An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in ... | S | |
| CVE-2017-18251 | An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function ... | S | |
| CVE-2017-18252 | An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c ... | S | |
| CVE-2017-18253 | An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in ... | S | |
| CVE-2017-18254 | An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function ... | S | |
| CVE-2017-18255 | The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.... | S | |
| CVE-2017-18256 | Brave Browser before 0.13.0 allows remote attackers to cause a denial of service (resource consumpti... | E | |
| CVE-2017-18257 | The __get_data_block function in fs/f2fs/data.c in the Linux kernel before 4.11 allows local users t... | S | |
| CVE-2017-18258 | The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of... | S | |
| CVE-2017-18259 | Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.... | E | |
| CVE-2017-18260 | Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via... | E | |
| CVE-2017-18261 | The arch_timer_reg_read_stable macro in arch/arm64/include/asm/arch_timer.h in the Linux kernel befo... | S | |
| CVE-2017-18262 | Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any sign... | | |
| CVE-2017-18263 | Seagate Media Server in Seagate Personal Cloud before 4.3.18.4 has directory traversal in getPhotoPl... | E | |
| CVE-2017-18264 | An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x... | S | |
| CVE-2017-18265 | Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), rela... | S | |
| CVE-2017-18266 | The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before laun... | S | |
| CVE-2017-18267 | The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote atta... | E | |
| CVE-2017-18268 | Symantec IntelligenceCenter 3.3 is vulnerable to the Return of the Bleichenbacher Oracle Threat (ROB... | | |
| CVE-2017-18269 | An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unalign... | | |
| CVE-2017-18270 | In the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl com... | S | |
| CVE-2017-18271 | In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the funct... | | |
| CVE-2017-18272 | In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-25, there is a use-after-free in ReadOneMNGImage in coder... | E S | |
| CVE-2017-18273 | In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the funct... | E | |
| CVE-2017-18274 | While iterating through the models contained in a fixed-size array in the actData structure, which a... | | |
| CVE-2017-18275 | A new account can be inserted into simContacts service using Android command line tool in Snapdragon... | | |
| CVE-2017-18276 | Secure camera logic allows display/secure camera controllers to access HLOS memory during secure dis... | | |
| CVE-2017-18277 | When dynamic memory allocation fails, currently the process sleeps for one second and continues with... | | |
| CVE-2017-18278 | An integer underflow may occur due to lack of check when received data length from font_mgr_qsee_req... | | |
| CVE-2017-18279 | Lack of check of buffer length before copying can lead to buffer overflow in camera module in Small ... | | |
| CVE-2017-18280 | In Snapdragon (Automobile, Mobile, Wear) in version MDM9607, MSM8909W, MSM8996AU, SD 210/SD 212/SD 2... | | |
| CVE-2017-18281 | A bool variable in Video function, which gets typecasted to int before being read could result in an... | S | |
| CVE-2017-18282 | Non-secure SW can cause SDCC to generate secure bus accesses, which may expose RPM access in Snapdra... | | |
| CVE-2017-18283 | Possible memory corruption when Read Val Blob Req is received with invalid parameters in Snapdragon ... | | |
| CVE-2017-18284 | The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the... | | |
| CVE-2017-18285 | The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp dire... | | |
| CVE-2017-18286 | nZEDb v0.7.3.3 has XSS in the 404 error page.... | E | |
| CVE-2017-18287 | An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the POST ... | E | |
| CVE-2017-18288 | An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET g... | E | |
| CVE-2017-18289 | An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exist in ladder/stats.php via the GET ty... | E | |
| CVE-2017-18290 | An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET s... | E | |
| CVE-2017-18291 | An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET u... | E | |
| CVE-2017-18292 | Secure app running in non secure space can restart TZ by calling Widevine app API repeatedly in Snap... | | |
| CVE-2017-18293 | When a particular GPIO is protected by blocking access to the corresponding GPIO resource registers,... | | |
| CVE-2017-18294 | While reading file class type from ELF header, a buffer overread may happen if the ELF file size is ... | | |
| CVE-2017-18295 | Possible buffer overflow if input is not null terminated in DSP Service module in Snapdragon Automob... | | |
| CVE-2017-18296 | Access control on applications is not applied while accessing SafeSwitch services can lead to improp... | | |
| CVE-2017-18297 | Double memory free while closing TEE SE API Session management in Snapdragon Mobile in version SD 42... | | |
| CVE-2017-18298 | Lack of Input Validation in SDMX API can lead to NULL pointer access in Snapdragon Automobile, Snapd... | | |
| CVE-2017-18299 | Improper translation table consolidation logic leads to resource exhaustion and QSEE error in Snapdr... | | |
| CVE-2017-18300 | Secure display content could be accessed by third party trusted application after creating a fault i... | | |
| CVE-2017-18301 | In Small Cell SoC and Snapdragon (Automobile, Mobile, Wear) in version FSM9055, FSM9955, MDM9607, MD... | | |
| CVE-2017-18302 | In Snapdragon (Automobile ,Mobile) in version MSM8996AU, SD 425, SD 427, SD 430, SD 435, SD 450, SD ... | | |
| CVE-2017-18303 | While processing the sensors registry configuration file, if inputs are not validated a buffer overf... | | |
| CVE-2017-18304 | Insufficient memory allocation in boot due to incorrect size being passed could result in out of bou... | | |
| CVE-2017-18305 | XBL sec mem dump system call allows complete control of EL3 by unlocking all XPUs if enable fuse is ... | | |
| CVE-2017-18306 | Information Exposure in Camera Driver | | |
| CVE-2017-18307 | Information Exposure in Kernel | | |
| CVE-2017-18308 | Modem segments are unlocked after authentication, leaving modem segments open to all in Snapdragon M... | | |
| CVE-2017-18309 | A micro-core of QMP transportation may cause a macro-core to read from or write to arbitrary memory ... | | |
| CVE-2017-18310 | ClientEnv exposes services 0-32 to HLOS in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear... | | |
| CVE-2017-18311 | XPU Master privilege escalation is possible due to improper access control of unused configuration x... | | |
| CVE-2017-18312 | While accessing SafeSwitch services, third party can manipulate a given device and perform unauthori... | | |
| CVE-2017-18313 | Under certain mode of operations, HLOS may be able get direct or indirect access through DXE channel... | | |
| CVE-2017-18314 | In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MD... | | |
| CVE-2017-18315 | Buffer over-read vulnerabilities in an older version of ASN.1 parser in Snapdragon Mobile in version... | | |
| CVE-2017-18316 | Secure application can access QSEE kernel memory through Ontario kernel driver in Snapdragon Automob... | | |
| CVE-2017-18317 | Restrictions related to the modem (sim lock, sim kill) can be bypassed by manipulating the system to... | | |
| CVE-2017-18318 | Missing validation check on CRL issuer name in Snapdragon Automobile, Snapdragon Mobile in versions ... | | |
| CVE-2017-18319 | Information leak in UIM API debug messages in snapdragon mobile and snapdragon wear in versions MDM9... | | |
| CVE-2017-18320 | QSEE unload attempt on a 3rd party TEE without previously loading results in a data abort in snapdra... | | |
| CVE-2017-18321 | Security keys used by the terminal and NW for a session could be leaked in snapdragon mobile in vers... | | |
| CVE-2017-18322 | Cryptographic key material leaked in WCDMA debug messages in snapdragon mobile and snapdragon wear i... | | |
| CVE-2017-18323 | Cryptographic key material leaked in TDSCDMA RRC debug messages in snapdragon automobile, snapdragon... | | |
| CVE-2017-18324 | Cryptographic key material leaked in debug messages - GERAN in snapdragon mobile and snapdragon wear... | | |
| CVE-2017-18325 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a... | R | |
| CVE-2017-18326 | Cryptographic keys are printed in modem debug messages in snapdragon mobile and snapdragon wear in v... | | |
| CVE-2017-18327 | Security keys are logged when any WCDMA call is configured or reconfigured in snapdragon automobile,... | | |
| CVE-2017-18328 | Use after free in QSH client rule processing in snapdragon mobile and snapdragon wear in versions MD... | | |
| CVE-2017-18329 | Possible Buffer overflow when transmitting an RTP packet in snapdragon automobile and snapdragon wea... | | |
| CVE-2017-18330 | Buffer overflow in AES-CCM and AES-GCM encryption via initialization vector in snapdragon automobile... | | |
| CVE-2017-18331 | Improper access control on secure display buffers in snapdragon automobile, snapdragon mobile and sn... | | |
| CVE-2017-18332 | Security keys are logged when any WCDMA call is configured or reconfigured in snapdragon automobile,... | | |
| CVE-2017-18333 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a... | R | |
| CVE-2017-18334 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a... | R | |
| CVE-2017-18335 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a... | R | |
| CVE-2017-18336 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a... | R | |
| CVE-2017-18337 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a... | R | |
| CVE-2017-18338 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a... | R | |
| CVE-2017-18339 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a... | R | |
| CVE-2017-18340 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a... | R | |
| CVE-2017-18341 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a... | R | |
| CVE-2017-18342 | In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. ... | S | |
| CVE-2017-18343 | The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x bef... | E S | |
| CVE-2017-18344 | The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.1... | E S | |
| CVE-2017-18345 | The Joomanager component through 2.0.0 for Joomla! has an arbitrary file download issue, resulting i... | E M | |
| CVE-2017-18346 | SQL injection vulnerability in /wbg/core/_includes/authorization.inc.php in CMS Web-Gooroo through 2... | E | |
| CVE-2017-18347 | Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physical... | E | |
| CVE-2017-18348 | Splunk Enterprise 6.6.x, when configured to run as root but drop privileges to a specific non-root a... | E | |
| CVE-2017-18349 | parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products,... | E M | |
| CVE-2017-18350 | bitcoind and Bitcoin-Qt prior to 0.15.1 have a stack-based buffer overflow if an attacker-controlled... | | |
| CVE-2017-18352 | Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URL... | E S | |
| CVE-2017-18353 | Rendertron 1.0.0 includes an _ah/stop route to shutdown the Chrome instance responsible for serving ... | E S | |
| CVE-2017-18354 | Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusi... | E S | |
| CVE-2017-18355 | Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to rea... | E S | |
| CVE-2017-18356 | In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining... | E | |
| CVE-2017-18357 | Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreview... | E | |
| CVE-2017-18358 | LimeSurvey before 2.72.4 has Stored XSS by using the Continue Later (aka Resume later) feature to en... | E S | |
| CVE-2017-18359 | PostGIS 2.x before 2.3.3, as used with PostgreSQL, allows remote attackers to cause a denial of serv... | E S | |
| CVE-2017-18360 | In change_port_settings in drivers/usb/serial/io_ti.c in the Linux kernel before 4.11.3, local users... | S | |
| CVE-2017-18361 | In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinit... | E S | |
| CVE-2017-18362 | ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated r... | KEV E | |
| CVE-2017-18364 | phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user par... | E | |
| CVE-2017-18365 | The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allo... | E | |
| CVE-2017-18366 | Subrion CMS 4.1.5 has CSRF in blog/delete/.... | E | |
| CVE-2017-18367 | libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather tha... | S | |
| CVE-2017-18368 | The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline ... | KEV E | |
| CVE-2017-18369 | The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerab... | E | |
| CVE-2017-18370 | The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injectio... | E | |
| CVE-2017-18371 | The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user account... | E | |
| CVE-2017-18372 | The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command i... | E | |
| CVE-2017-18373 | The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has three user ... | E | |
| CVE-2017-18374 | The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline ... | E | |
| CVE-2017-18375 | Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php.... | E | |
| CVE-2017-18376 | An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before 3.3.1 allows... | S | |
| CVE-2017-18377 | An issue was discovered on Wireless IP Camera (P2P) WIFICAM cameras. There is Command Injection in t... | E | |
| CVE-2017-18378 | In NETGEAR ReadyNAS Surveillance before 1.4.3-17 x86 and before 1.1.4-7 ARM, $_GET['uploaddir'] is n... | E | |
| CVE-2017-18379 | In the Linux kernel before 4.14, an out of boundary access happened in drivers/nvme/target/fc.c.... | S | |
| CVE-2017-18380 | edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which t... | S | |
| CVE-2017-18381 | The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connec... | | |
| CVE-2017-18382 | cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306).... | | |
| CVE-2017-18383 | cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309).... | | |
| CVE-2017-18384 | cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310)... | | |
| CVE-2017-18385 | cPanel before 68.0.15 allows unprivileged users to access restricted directories during account rest... | | |
| CVE-2017-18386 | cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-3... | | |
| CVE-2017-18387 | cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upl... | | |
| CVE-2017-18388 | cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (S... | | |
| CVE-2017-18389 | cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318).... | | |
| CVE-2017-18390 | cPanel before 68.0.15 allows code execution in the context of the root account because of weak permi... | | |
| CVE-2017-18391 | cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a... | | |
| CVE-2017-18392 | cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple acc... | | |
| CVE-2017-18393 | cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of privat... | | |
| CVE-2017-18394 | cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327).... | | |
| CVE-2017-18395 | cPanel before 68.0.15 does not block a username of ssl (SEC-328).... | | |
| CVE-2017-18396 | cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases (SEC-329).... | | |
| CVE-2017-18397 | cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330).... | | |
| CVE-2017-18398 | DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331)... | | |
| CVE-2017-18399 | cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon... | | |
| CVE-2017-18400 | cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333).... | | |
| CVE-2017-18401 | cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SE... | | |
| CVE-2017-18402 | cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336).... | | |
| CVE-2017-18403 | cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archive... | | |
| CVE-2017-18404 | cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341).... | | |
| CVE-2017-18405 | cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modifica... | | |
| CVE-2017-18406 | cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276).... | | |
| CVE-2017-18407 | cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement downl... | | |
| CVE-2017-18408 | cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282).... | | |
| CVE-2017-18409 | In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL data... | | |
| CVE-2017-18410 | In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on t... | | |
| CVE-2017-18411 | The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to t... | | |
| CVE-2017-18412 | cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mi... | | |
| CVE-2017-18413 | In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disapp... | | |
| CVE-2017-18414 | cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300).... | | |
| CVE-2017-18415 | cPanel before 67.9999.103 allows code execution in the context of the mailman account because of inc... | | |
| CVE-2017-18416 | cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schem... | | |
| CVE-2017-18417 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263).... | | |
| CVE-2017-18418 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265).... | | |
| CVE-2017-18419 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266).... | | |
| CVE-2017-18420 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269).... | | |
| CVE-2017-18421 | cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271).... | | |
| CVE-2017-18422 | In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272... | | |
| CVE-2017-18423 | In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).... | | |
| CVE-2017-18424 | In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when... | | |
| CVE-2017-18425 | In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280).... | | |
| CVE-2017-18426 | cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288).... | | |
| CVE-2017-18427 | In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289).... | | |
| CVE-2017-18428 | In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log pro... | | |
| CVE-2017-18429 | In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account ter... | | |
| CVE-2017-18430 | In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_te... | | |
| CVE-2017-18431 | cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-1394... | | |
| CVE-2017-18432 | In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234).... | | |
| CVE-2017-18433 | cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call... | | |
| CVE-2017-18434 | cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_... | | |
| CVE-2017-18435 | cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238).... | | |
| CVE-2017-18436 | cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SE... | | |
| CVE-2017-18437 | cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).... | | |
| CVE-2017-18438 | cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).... | | |
| CVE-2017-18439 | cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (... | | |
| CVE-2017-18440 | cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244).... | | |
| CVE-2017-18441 | cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).... | | |
| CVE-2017-18442 | cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246).... | | |
| CVE-2017-18443 | cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247).... | | |
| CVE-2017-18444 | cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248).... | | |
| CVE-2017-18445 | cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).... | | |
| CVE-2017-18446 | cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPC... | | |
| CVE-2017-18447 | cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-25... | | |
| CVE-2017-18448 | cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252... | | |
| CVE-2017-18449 | cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via s... | | |
| CVE-2017-18450 | cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqli... | | |
| CVE-2017-18451 | cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval up... | | |
| CVE-2017-18452 | cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259).... | | |
| CVE-2017-18453 | cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).... | | |
| CVE-2017-18454 | cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).... | | |
| CVE-2017-18455 | In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).... | | |
| CVE-2017-18456 | cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).... | | |
| CVE-2017-18457 | cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).... | | |
| CVE-2017-18458 | cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219).... | | |
| CVE-2017-18459 | cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220).... | | |
| CVE-2017-18460 | cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221).... | | |
| CVE-2017-18461 | cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (S... | | |
| CVE-2017-18462 | cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-22... | | |
| CVE-2017-18463 | cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRo... | | |
| CVE-2017-18464 | cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (S... | | |
| CVE-2017-18465 | cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).... | | |
| CVE-2017-18466 | cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains... | | |
| CVE-2017-18467 | cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-22... | | |
| CVE-2017-18468 | cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (S... | | |
| CVE-2017-18469 | cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233)... | | |
| CVE-2017-18470 | cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).... | | |
| CVE-2017-18471 | cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).... | | |
| CVE-2017-18472 | cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).... | | |
| CVE-2017-18473 | cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).... | | |
| CVE-2017-18474 | cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201).... | | |
| CVE-2017-18475 | In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when del... | | |
| CVE-2017-18476 | Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).... | | |
| CVE-2017-18477 | In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206... | | |
| CVE-2017-18478 | In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (S... | | |
| CVE-2017-18479 | In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).... | | |
| CVE-2017-18480 | cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-... | | |
| CVE-2017-18481 | cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).... | | |
| CVE-2017-18482 | cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rear... | | |
| CVE-2017-18483 | ANNKE SP1 HD wireless camera 3.4.1.1604071109 devices allow XSS via a crafted SSID.... | E | |
| CVE-2017-18484 | Cognitoys Dino devices allow XSS via the SSID.... | E | |
| CVE-2017-18485 | Cognitoys Dino devices allow profiles_add.html CSRF.... | E | |
| CVE-2017-18486 | Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling o... | E | |
| CVE-2017-18487 | The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18488 | The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18489 | The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.... | | |
| CVE-2017-18490 | The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18491 | The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18492 | The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18493 | The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18494 | The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18495 | The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.... | | |
| CVE-2017-18496 | The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18497 | The liveforms plugin before 3.4.0 for WordPress has XSS.... | | |
| CVE-2017-18498 | The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.... | | |
| CVE-2017-18499 | The simple-membership plugin before 3.5.7 for WordPress has XSS.... | | |
| CVE-2017-18500 | The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18501 | The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18502 | The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18503 | The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.... | | |
| CVE-2017-18504 | The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.... | | |
| CVE-2017-18505 | The twitter-plugin plugin before 2.55 for WordPress has XSS.... | | |
| CVE-2017-18506 | The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or... | | |
| CVE-2017-18507 | The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.... | | |
| CVE-2017-18508 | The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.... | | |
| CVE-2017-18509 | An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific s... | E S | |
| CVE-2017-18510 | The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actio... | | |
| CVE-2017-18511 | The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.... | | |
| CVE-2017-18512 | The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.... | | |
| CVE-2017-18513 | The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin... | | |
| CVE-2017-18514 | The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.... | | |
| CVE-2017-18515 | The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.... | | |
| CVE-2017-18516 | The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18517 | The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18518 | The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18519 | The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.... | | |
| CVE-2017-18520 | The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminIn... | | |
| CVE-2017-18521 | The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=de... | E | |
| CVE-2017-18522 | The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.... | | |
| CVE-2017-18523 | The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.... | | |
| CVE-2017-18524 | The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18525 | The megamenu plugin before 2.4 for WordPress has XSS.... | | |
| CVE-2017-18526 | The moreads-se plugin before 1.4.7 for WordPress has XSS.... | | |
| CVE-2017-18527 | The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18528 | The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18529 | The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18530 | The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18531 | The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-... | | |
| CVE-2017-18532 | The realty plugin before 1.1.0 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18533 | The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.... | | |
| CVE-2017-18534 | The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.... | | |
| CVE-2017-18535 | The smokesignal plugin before 1.2.7 for WordPress has XSS.... | | |
| CVE-2017-18536 | The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.... | | |
| CVE-2017-18537 | The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18538 | The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.... | | |
| CVE-2017-18539 | The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.... | | |
| CVE-2017-18540 | The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.... | | |
| CVE-2017-18541 | The xo-security plugin before 1.5.3 for WordPress has XSS.... | | |
| CVE-2017-18542 | The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18543 | The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based in... | | |
| CVE-2017-18544 | The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.... | | |
| CVE-2017-18545 | The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard a... | | |
| CVE-2017-18546 | The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.... | | |
| CVE-2017-18547 | The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.... | | |
| CVE-2017-18548 | The note-press plugin before 0.1.2 for WordPress has SQL injection.... | | |
| CVE-2017-18549 | An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is... | S | |
| CVE-2017-18550 | An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is... | S | |
| CVE-2017-18551 | An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is... | S | |
| CVE-2017-18552 | An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of boun... | S | |
| CVE-2017-18553 | The ad-buttons plugin before 2.3.2 for WordPress has XSS.... | | |
| CVE-2017-18554 | The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.... | | |
| CVE-2017-18555 | The booking-sms plugin before 1.1.0 for WordPress has XSS.... | | |
| CVE-2017-18556 | The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18557 | The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18558 | The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18559 | The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18560 | The content-audit plugin before 1.9.2 for WordPress has XSS.... | | |
| CVE-2017-18561 | The embed-comment-images plugin before 0.6 for WordPress has XSS.... | | |
| CVE-2017-18562 | The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18563 | The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-lis... | | |
| CVE-2017-18564 | The sender plugin before 1.2.1 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18565 | The updater plugin before 1.35 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18566 | The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18567 | The wp-all-import plugin before 3.4.6 for WordPress has XSS.... | | |
| CVE-2017-18568 | The my-wp-translate plugin before 1.0.4 for WordPress has XSS.... | | |
| CVE-2017-18569 | The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.... | | |
| CVE-2017-18570 | The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete En... | | |
| CVE-2017-18571 | The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x... | | |
| CVE-2017-18572 | The gnucommerce plugin before 1.4.2 for WordPress has XSS.... | | |
| CVE-2017-18573 | The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.... | | |
| CVE-2017-18574 | The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.... | | |
| CVE-2017-18575 | The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.... | | |
| CVE-2017-18576 | The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.... | | |
| CVE-2017-18577 | The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg... | | |
| CVE-2017-18578 | The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.... | | |
| CVE-2017-18579 | The corner-ad plugin before 1.0.8 for WordPress has XSS.... | | |
| CVE-2017-18580 | The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in ... | | |
| CVE-2017-18581 | The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.... | | |
| CVE-2017-18582 | The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18583 | The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.... | | |
| CVE-2017-18584 | The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settin... | | |
| CVE-2017-18585 | The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory travers... | E | |
| CVE-2017-18586 | The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths... | | |
| CVE-2017-18587 | An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers... | | |
| CVE-2017-18588 | An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verificatio... | S | |
| CVE-2017-18589 | An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of ... | | |
| CVE-2017-18590 | The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18591 | The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.... | | |
| CVE-2017-18592 | The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directo... | | |
| CVE-2017-18593 | The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls ... | | |
| CVE-2017-18594 | nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an... | E S | |
| CVE-2017-18595 | An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the funct... | S | |
| CVE-2017-18596 | The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.... | | |
| CVE-2017-18597 | The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-j... | E | |
| CVE-2017-18598 | The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url... | E | |
| CVE-2017-18599 | The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter.... | | |
| CVE-2017-18600 | The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading ... | | |
| CVE-2017-18601 | The examapp plugin 1.0 for WordPress has XSS via exam input text fields.... | E | |
| CVE-2017-18602 | The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserR... | E | |
| CVE-2017-18603 | The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=pos... | E | |
| CVE-2017-18604 | The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an ... | E | |
| CVE-2017-18605 | The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.... | | |
| CVE-2017-18606 | The avada theme before 5.1.5 for WordPress has stored XSS.... | | |
| CVE-2017-18607 | The avada theme before 5.1.5 for WordPress has CSRF.... | | |
| CVE-2017-18608 | The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.... | | |
| CVE-2017-18609 | The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.... | E S | |
| CVE-2017-18610 | The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php c... | E S | |
| CVE-2017-18611 | The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php c... | E S | |
| CVE-2017-18612 | The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter... | E | |
| CVE-2017-18613 | The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page... | E | |
| CVE-2017-18614 | The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter... | E | |
| CVE-2017-18615 | The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.... | | |
| CVE-2017-18634 | The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax... | E | |
| CVE-2017-18635 | An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could injec... | E S | |
| CVE-2017-18636 | CDG through 2017-01-01 allows downloadDocument.jsp?command=download&pathAndName= directory traversal... | E | |
| CVE-2017-18638 | send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable... | E M | |
| CVE-2017-18639 | Progress Sitefinity CMS before 10.1 allows XSS via /Pages Parameter : Page Title, /Content/News Para... | E | |
| CVE-2017-18640 | The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a relate... | E S | |
| CVE-2017-18641 | In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature ch... | S | |
| CVE-2017-18642 | Syska Smart Bulb devices through 2017-08-06 receive RGB parameters over cleartext Bluetooth Low Ener... | | |
| CVE-2017-18643 | An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. There is informat... | | |
| CVE-2017-18644 | An issue was discovered on Samsung mobile devices with L(5.1), M(6.x), and N(7.x) software. There is... | | |
| CVE-2017-18645 | An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) (Qualcomm chipsets) softwar... | | |
| CVE-2017-18646 | An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. An attacker can b... | | |
| CVE-2017-18647 | An issue was discovered on Samsung mobile devices with M(6,x) and N(7.0) software. The TA Scrypto v1... | | |
| CVE-2017-18648 | An issue was discovered on Samsung mobile devices with KK(4.4.x), L(5.x), M(6.x), and N(7.x) softwar... | | |
| CVE-2017-18649 | An issue was discovered on Samsung mobile devices with N(7.x) software. An attacker can boot a devic... | | |
| CVE-2017-18650 | An issue was discovered on Samsung mobile devices with N(7.x) software. There is a WifiStateMachine ... | | |
| CVE-2017-18651 | An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. There is an Integ... | | |
| CVE-2017-18652 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. SVoice allows arb... | | |
| CVE-2017-18653 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) softw... | | |
| CVE-2017-18654 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0, 7.1) software. An unauthent... | | |
| CVE-2017-18655 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. There is a stack-... | | |
| CVE-2017-18656 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. There is a buffer... | | |
| CVE-2017-18657 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. There is an arbit... | | |
| CVE-2017-18658 | An issue was discovered on Samsung mobile devices with M(6.0) software. The multiwindow_facade API a... | | |
| CVE-2017-18659 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) softw... | | |
| CVE-2017-18660 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. There is a buffer... | | |
| CVE-2017-18661 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. There is a buffer... | | |
| CVE-2017-18662 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. Data outside of t... | | |
| CVE-2017-18663 | An issue was discovered on Samsung mobile devices with N(7.x) software. Because of missing Intent ex... | | |
| CVE-2017-18664 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. The... | | |
| CVE-2017-18665 | An issue was discovered on Samsung mobile devices with M(6.0) software. There is a NULL pointer exce... | | |
| CVE-2017-18666 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) softw... | | |
| CVE-2017-18667 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) softw... | | |
| CVE-2017-18668 | An issue was discovered on Samsung mobile devices with M(6.0) software. Attackers can prevent users ... | | |
| CVE-2017-18669 | An issue was discovered on Samsung mobile devices with N(7.x) software. Persona has an unprotected A... | | |
| CVE-2017-18670 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. and... | | |
| CVE-2017-18671 | An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.x) software. Inte... | | |
| CVE-2017-18672 | An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.x) software. Beca... | | |
| CVE-2017-18673 | An issue was discovered on Samsung mobile devices with N(7.x) software. An attacker can disable the ... | | |
| CVE-2017-18674 | An issue was discovered on Samsung mobile devices with N(7.0) software. The time service (aka Timase... | | |
| CVE-2017-18675 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) (Exynos7420 or Exynox8890 c... | | |
| CVE-2017-18676 | An issue was discovered on Samsung mobile devices with N(7.0) (Qualcomm chipsets) software. There is... | | |
| CVE-2017-18677 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. Because of an unp... | | |
| CVE-2017-18678 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) softw... | | |
| CVE-2017-18679 | An issue was discovered on Samsung mobile devices with M(6.0) software. SLocation can cause a system... | | |
| CVE-2017-18680 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) (tablets) software. The... | | |
| CVE-2017-18681 | An issue was discovered on Samsung Galaxy S5 mobile devices with software through 2016-12-20 (Qualco... | | |
| CVE-2017-18682 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) softw... | | |
| CVE-2017-18683 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. SVoice allows... | | |
| CVE-2017-18684 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. SVoice allows... | | |
| CVE-2017-18685 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. The... | | |
| CVE-2017-18686 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) software. Contact informati... | | |
| CVE-2017-18687 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) softw... | | |
| CVE-2017-18688 | An issue was discovered on Samsung mobile devices with L(5.1), M(6.0), and N(7.0) software. There is... | | |
| CVE-2017-18689 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (Exynos5433, Exynos7420, or... | | |
| CVE-2017-18690 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) (Exyn... | | |
| CVE-2017-18691 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (Exynos8890 chipsets) softw... | | |
| CVE-2017-18692 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (MSM8939, MSM8996, MSM8998,... | | |
| CVE-2017-18693 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) softw... | | |
| CVE-2017-18694 | An issue was discovered on Samsung mobile devices with software through 2016-10-25 (Exynos5 chipsets... | | |
| CVE-2017-18695 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) softw... | | |
| CVE-2017-18696 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (Exynos7420, Exynos8890, or... | | |
| CVE-2017-18697 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This... | | |
| CVE-2017-18698 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This... | | |
| CVE-2017-18699 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This... | | |
| CVE-2017-18700 | Certain NETGEAR devices are affected by stored XSS. This affects D6400 before 1.0.0.60, D7000 before... | | |
| CVE-2017-18701 | Certain NETGEAR devices are affected by reflected XSS. This affects R6700 before 1.0.1.36 and R6900 ... | | |
| CVE-2017-18702 | NETGEAR R6220 devices before 1.1.0.60 are affected by incorrect configuration of security settings.... | | |
| CVE-2017-18703 | Certain NETGEAR devices are affected by CSRF. This affects D1500 before 1.0.0.25, D500 before 1.0.0.... | | |
| CVE-2017-18704 | Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects ... | | |
| CVE-2017-18705 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D... | | |
| CVE-2017-18706 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R... | | |
| CVE-2017-18707 | Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R83... | | |
| CVE-2017-18708 | Certain NETGEAR devices are affected by CSRF. This affects R8300 before 1.0.2.94 and R8500 before 1.... | | |
| CVE-2017-18709 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R... | | |
| CVE-2017-18710 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects R8300 befo... | | |
| CVE-2017-18711 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D... | | |
| CVE-2017-18712 | Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects ... | | |
| CVE-2017-18713 | Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects ... | | |
| CVE-2017-18714 | NETGEAR WNDR4500v3 devices before 1.0.0.48 are affected by denial of service.... | | |
| CVE-2017-18715 | Certain NETGEAR devices are affected by reflected XSS. This affects EX3700 before 1.0.0.66, EX3800 b... | | |
| CVE-2017-18716 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18717 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18718 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18719 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18720 | Certain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.24, ... | | |
| CVE-2017-18721 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18722 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18723 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18724 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18725 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18726 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18727 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18728 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18729 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18730 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18731 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R... | | |
| CVE-2017-18732 | Certain NETGEAR devices are affected by authentication bypass. This affects R6300v2 before 1.0.4.8, ... | | |
| CVE-2017-18733 | Certain NETGEAR devices are affected by authentication bypass. This affects D6220 before 1.0.0.28, D... | | |
| CVE-2017-18734 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affec... | | |
| CVE-2017-18735 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affec... | | |
| CVE-2017-18736 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affec... | | |
| CVE-2017-18737 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affec... | | |
| CVE-2017-18738 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18739 | Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affec... | | |
| CVE-2017-18740 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D... | | |
| CVE-2017-18741 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R... | | |
| CVE-2017-18742 | Certain NETGEAR devices are affected by CSRF. This affects JR6150 before 1.0.1.10, R6050 before 1.0.... | | |
| CVE-2017-18743 | Certain NETGEAR devices are affected by authentication bypass. This affects R6300v2 before 1.0.4.8, ... | | |
| CVE-2017-18744 | Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affec... | | |
| CVE-2017-18745 | Certain NETGEAR devices are affected by stored XSS. This affects R6400 before 1.0.1.14, R6700 before... | | |
| CVE-2017-18746 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects E... | | |
| CVE-2017-18747 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects E... | | |
| CVE-2017-18748 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects E... | | |
| CVE-2017-18749 | Certain NETGEAR devices are affected by CSRF. This affects JNR1010v2 before 1.1.0.44, JR6150 before ... | | |
| CVE-2017-18750 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18751 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker... | | |
| CVE-2017-18752 | Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects ... | | |
| CVE-2017-18753 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-20734, CVE-2017-18864. Reaso... | R | |
| CVE-2017-18754 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WND... | | |
| CVE-2017-18755 | Certain NETGEAR devices are affected by CSRF. This affects R6300v2 before 1.0.4.8, R6400v2 before 1.... | | |
| CVE-2017-18756 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D... | | |
| CVE-2017-18757 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D... | | |
| CVE-2017-18758 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This... | | |
| CVE-2017-18759 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This... | | |
| CVE-2017-18760 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-20732, CVE-2017-18865. Reaso... | R | |
| CVE-2017-18761 | NETGEAR R8000 devices before 1.0.4.2 are affected by a stack-based buffer overflow by an authenticat... | | |
| CVE-2017-18762 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affec... | | |
| CVE-2017-18763 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects J... | | |
| CVE-2017-18764 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affec... | | |
| CVE-2017-18765 | Certain NETGEAR devices are affected by denial of service. This affects R6300v2 before 1.0.4.8, R640... | | |
| CVE-2017-18766 | Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects ... | | |
| CVE-2017-18767 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D78... | | |
| CVE-2017-18768 | Certain NETGEAR devices are affected by CSRF. This affects EX6100 before 1.0.2.16_1.1.130, EX6100v2 ... | | |
| CVE-2017-18769 | Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects ... | | |
| CVE-2017-18770 | Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R78... | | |
| CVE-2017-18771 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-20738, CVE-2017-18866. Reaso... | R | |
| CVE-2017-18772 | Certain NETGEAR devices are affected by authentication bypass. This affects EX3700 before 1.0.0.64, ... | | |
| CVE-2017-18773 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D61... | | |
| CVE-2017-18774 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-21139, CVE-2017-18867. Reaso... | R | |
| CVE-2017-18775 | Certain NETGEAR devices are affected by CSRF. This affects R6100 before 1.0.1.12, R7500 before 1.0.0... | | |
| CVE-2017-18776 | Certain NETGEAR devices are affected by authentication bypass. This affects D6100 before V1.0.0.55, ... | | |
| CVE-2017-18777 | Certain NETGEAR devices are affected by administrative password disclosure. This affects D6220 befor... | | |
| CVE-2017-18778 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D... | | |
| CVE-2017-18779 | Certain NETGEAR devices are affected by a buffer overflow. This affects D6200 before 1.1.00.24, D700... | | |
| CVE-2017-18780 | Certain NETGEAR devices are affected by denial of service. This affects D6200 before 1.1.00.24, D700... | | |
| CVE-2017-18781 | Certain NETGEAR devices are affected by CSRF. This affects D6200 before 1.1.00.24, D7000 before 1.0.... | | |
| CVE-2017-18782 | Certain NETGEAR devices are affected by CSRF. This affects D6200 before 1.1.00.24, D7000 before 1.0.... | | |
| CVE-2017-18783 | Certain NETGEAR devices are affected by XSS. This affects D6200 before 1.1.00.24, D7000 before 1.0.1... | | |
| CVE-2017-18784 | Certain NETGEAR devices are affected by XSS. This affects D6200 before 1.1.00.24, D7000 before 1.0.1... | | |
| CVE-2017-18785 | Certain NETGEAR devices are affected by XSS. This affects D3600 before 1.0.0.67, D6000 before 1.0.0.... | | |
| CVE-2017-18786 | Certain NETGEAR devices are affected by command injection. This affects D6200 before 1.1.00.24, JNR1... | | |
| CVE-2017-18787 | Certain NETGEAR devices are affected by command injection. This affects D6200 before 1.1.00.24, JNR1... | | |
| CVE-2017-18788 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D36... | | |
| CVE-2017-18789 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects R6250 befo... | | |
| CVE-2017-18790 | Certain NETGEAR devices are affected by disclosure of sensitive information. This affects R6700 befo... | | |
| CVE-2017-18791 | Certain NETGEAR devices are affected by CSRF. This affects R6050/JR6150 before 1.0.1.7, PR2000 befor... | | |
| CVE-2017-18792 | NETGEAR D6100 devices before 1.0.0.50_0.0.50 are affected by command injection.... | | |
| CVE-2017-18793 | NETGEAR R7800 devices before 1.0.2.36 are affected by command injection.... | | |
| CVE-2017-18794 | Certain NETGEAR devices are affected by command injection. This affects R6300v2 before 1.0.4.8_10.0.... | | |
| CVE-2017-18795 | Certain NETGEAR devices are affected by command injection. This affects D6220 before 1.0.0.28 and D6... | | |
| CVE-2017-18796 | Certain NETGEAR devices are affected by command injection. This affects R6400 before 1.0.1.24, R6700... | | |
| CVE-2017-18797 | Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects ... | | |
| CVE-2017-18798 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R... | | |
| CVE-2017-18799 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R... | | |
| CVE-2017-18800 | Certain NETGEAR devices are affected by reflected XSS. This affects R6700v2 before 1.1.0.42 and R680... | | |
| CVE-2017-18801 | Certain NETGEAR devices are affected by command injection. This affects R6220 before 1.1.0.50, R6700... | | |
| CVE-2017-18802 | Certain NETGEAR devices are affected by command injection. This affects R6100 before 1.0.1.14, R7500... | | |
| CVE-2017-18803 | NETGEAR R7800 devices before 1.0.2.30 are affected by incorrect configuration of security settings.... | | |
| CVE-2017-18804 | Certain NETGEAR devices are affected by command injection. This affects R7800 before 1.0.2.16 and R9... | | |
| CVE-2017-18805 | Certain NETGEAR devices are affected by command injection. This affects WAC510 before 1.3.0.10, WAC1... | | |
| CVE-2017-18806 | Certain NETGEAR devices are affected by command injection. This affects WAC510 before 1.3.0.10, WAC1... | | |
| CVE-2017-18807 | NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS... | S | |
| CVE-2017-18808 | NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by incorrect ... | S | |
| CVE-2017-18809 | NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS... | S | |
| CVE-2017-18810 | NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS... | S | |
| CVE-2017-18811 | NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS... | S | |
| CVE-2017-18812 | NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS... | S | |
| CVE-2017-18813 | NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS... | S | |
| CVE-2017-18814 | NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS... | S | |
| CVE-2017-18815 | NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by stored XS... | S | |
| CVE-2017-18816 | NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by stored XS... | S | |
| CVE-2017-18819 | NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by incorrect... | S | |
| CVE-2017-18820 | NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS... | S | |
| CVE-2017-18821 | Certain NETGEAR devices are affected by stored XSS. This affects M4300-28G before 12.0.2.15, M4300-5... | | |
| CVE-2017-18822 | Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before... | | |
| CVE-2017-18823 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects M... | | |
| CVE-2017-18824 | Certain NETGEAR devices are affected by directory traversal. This affects M4300-28G before 12.0.2.15... | | |
| CVE-2017-18825 | Certain NETGEAR devices are affected by stored XSS. This affects M4300-28G before 12.0.2.15, M4300-5... | | |
| CVE-2017-18826 | Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before... | | |
| CVE-2017-18827 | Certain NETGEAR devices are affected by stored XSS. This affects M4300-28G before 12.0.2.15, M4300-5... | | |
| CVE-2017-18828 | Certain NETGEAR devices are affected by stored XSS. This affects M4300-28G before 12.0.2.15, M4300-5... | | |
| CVE-2017-18829 | Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before... | | |
| CVE-2017-18830 | Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before... | | |
| CVE-2017-18831 | Certain NETGEAR devices are affected by stored XSS. This affects M4300-28G before 12.0.2.15, M4300-5... | | |
| CVE-2017-18832 | Certain NETGEAR devices are affected by stored XSS. This affects M4300-28G before 12.0.2.15, M4300-5... | | |
| CVE-2017-18833 | Certain NETGEAR devices are affected by reflected XSS. This affects M4300-28G before 12.0.2.15, M430... | | |
| CVE-2017-18834 | Certain NETGEAR devices are affected by reflected XSS. This affects M4300-28G before 12.0.2.15, M430... | | |
| CVE-2017-18835 | Certain NETGEAR devices are affected by reflected XSS. This affects M4300-28G before 12.0.2.15, M430... | | |
| CVE-2017-18836 | Certain NETGEAR devices are affected by denial of service. This affects M4300-28G before 12.0.2.15, ... | | |
| CVE-2017-18837 | Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before... | | |
| CVE-2017-18838 | Certain NETGEAR devices are affected by privilege escalation. This affects M4300-28G before 12.0.2.1... | | |
| CVE-2017-18839 | Certain NETGEAR devices are affected by stored XSS. This affects M4300-28G before 12.0.2.15, M4300-5... | | |
| CVE-2017-18840 | Certain NETGEAR devices are affected by denial of service. This affects M4300-28G before 12.0.2.15, ... | | |
| CVE-2017-18841 | Certain NETGEAR devices are affected by command injection. This affects R6220 before 1.1.0.46, R6700... | | |
| CVE-2017-18842 | Certain NETGEAR devices are affected by CSRF. This affects R7300 before 1.0.0.54, R8500 before 1.0.2... | | |
| CVE-2017-18843 | Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700... | | |
| CVE-2017-18844 | Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700... | | |
| CVE-2017-18845 | Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700... | | |
| CVE-2017-18846 | Certain NETGEAR devices are affected by a stack-based buffer overflow. This affects R6250 before 1.0... | | |
| CVE-2017-18847 | Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects ... | | |
| CVE-2017-18848 | Certain NETGEAR devices are affected by CSRF. This affects R6300v2 before 1.0.0.36, AC1450 before 1.... | | |
| CVE-2017-18849 | Certain NETGEAR devices are affected by command injection. This affects D6220 before 1.0.0.26, D6400... | | |
| CVE-2017-18850 | Certain NETGEAR devices are affected by authentication bypass. This affects D6220 before 1.0.0.26, D... | | |
| CVE-2017-18851 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D85... | | |
| CVE-2017-18852 | Certain NETGEAR devices are affected by CSRF and authentication bypass. This affects R7300DST before... | | |
| CVE-2017-18853 | Certain NETGEAR devices are affected by password recovery and file access. This affects D8500 1.0.3.... | | |
| CVE-2017-18854 | NETGEAR ReadyNAS 6.6.1 and earlier is affected by command injection.... | | |
| CVE-2017-18855 | NETGEAR WNR854T devices before 1.5.2 are affected by command execution.... | | |
| CVE-2017-18856 | NETGEAR ReadyNAS devices before 6.6.1 are affected by command injection.... | | |
| CVE-2017-18857 | The NETGEAR Insight application before 2.42 for Android and iOS is affected by password mismanagemen... | | |
| CVE-2017-18858 | Certain NETGEAR devices are affected by command execution. This affects M4200-10MG-POE+ 12.0.2.11 an... | | |
| CVE-2017-18859 | Certain NETGEAR devices are affected by slowdown/stoppage. This affects C6300 before 2017-05-30, CM4... | | |
| CVE-2017-18860 | Certain NETGEAR devices are affected by debugging command execution. This affects FS752TP 5.4.2.19 a... | | |
| CVE-2017-18861 | Certain NETGEAR devices are affected by CSRF. This affects ReadyNAS Surveillance 1.4.3-15-x86 and ea... | | |
| CVE-2017-18862 | Certain NETGEAR devices are affected by authentication bypass. This affects JGS516PE before 2017-05-... | | |
| CVE-2017-18863 | Certain NETGEAR devices are affected by command execution via a PHP form. This affects WN604 3.3.3 a... | | |
| CVE-2017-18864 | Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affec... | | |
| CVE-2017-18865 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This... | | |
| CVE-2017-18866 | Certain NETGEAR devices are affected by stored XSS. This affects R9000 before 1.0.2.40, R6100 before... | | |
| CVE-2017-18867 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D... | | |
| CVE-2017-18868 | Digi XBee 2 devices do not have an effective protection mechanism against remote AT commands, becaus... | | |
| CVE-2017-18869 | A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to ... | E | |
| CVE-2017-18870 | An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook a... | | |
| CVE-2017-18871 | An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attack... | | |
| CVE-2017-18872 | An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an ... | | |
| CVE-2017-18873 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to ... | | |
| CVE-2017-18874 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for f... | | |
| CVE-2017-18875 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for f... | | |
| CVE-2017-18876 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for f... | | |
| CVE-2017-18877 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur... | | |
| CVE-2017-18878 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ... | | |
| CVE-2017-18879 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the... | | |
| CVE-2017-18880 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the... | | |
| CVE-2017-18881 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a g... | | |
| CVE-2017-18882 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via OpenG... | | |
| CVE-2017-18883 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAut... | | |
| CVE-2017-18884 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to ... | | |
| CVE-2017-18885 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to ... | | |
| CVE-2017-18886 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of r... | | |
| CVE-2017-18887 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team c... | | |
| CVE-2017-18888 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection... | | |
| CVE-2017-18889 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could creat... | | |
| CVE-2017-18890 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker t... | | |
| CVE-2017-18891 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing beca... | | |
| CVE-2017-18892 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can ha... | | |
| CVE-2017-18893 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS... | | |
| CVE-2017-18894 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2... | | |
| CVE-2017-18895 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to ... | | |
| CVE-2017-18896 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to ... | | |
| CVE-2017-18897 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2... | | |
| CVE-2017-18898 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts... | | |
| CVE-2017-18899 | An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based ... | | |
| CVE-2017-18900 | An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injectio... | | |
| CVE-2017-18901 | An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to... | | |
| CVE-2017-18902 | An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to... | | |
| CVE-2017-18903 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS... | | |
| CVE-2017-18904 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an u... | | |
| CVE-2017-18905 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth ... | | |
| CVE-2017-18906 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OA... | | |
| CVE-2017-18907 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a ... | | |
| CVE-2017-18908 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset reque... | | |
| CVE-2017-18909 | An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signatur... | | |
| CVE-2017-18910 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. E-mail notifications ca... | | |
| CVE-2017-18911 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate v... | | |
| CVE-2017-18912 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker t... | | |
| CVE-2017-18913 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a lin... | | |
| CVE-2017-18914 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can oc... | | |
| CVE-2017-18915 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a se... | | |
| CVE-2017-18916 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access con... | | |
| CVE-2017-18917 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used f... | | |
| CVE-2017-18918 | An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can plac... | | |
| CVE-2017-18919 | An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for u... | | |
| CVE-2017-18920 | An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the... | | |
| CVE-2017-18921 | An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an ... | | |
| CVE-2017-18922 | It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain ... | S | |
| CVE-2017-18923 | beroNet VoIP Gateways before 3.0.16 have a PHP script that allows downloading arbitrary files, inclu... | | |
| CVE-2017-18924 | oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not ... | E S | |
| CVE-2017-18925 | opentmpfiles through 0.3.1 allows local users to take ownership of arbitrary files because d entries... | E | |
| CVE-2017-18926 | raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15 mi... | E S |