Search

Expected end of text, found '.' (at char 30), (line:1, col:31)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (334636 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2017-15691 2 Apache, Redhat 5 Uima-as, Uimaducc, Uimafit and 2 more 2024-11-21 N/A
In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content.
CVE-2017-15686 1 Craftercms 1 Crafter Cms 2024-11-21 6.1 Medium
Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.
CVE-2017-15685 1 Craftercms 1 Crafter Cms 2024-11-21 8.6 High
Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
CVE-2017-15684 1 Craftercms 1 Crafter Cms 2024-11-21 7.5 High
Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.
CVE-2017-15683 1 Craftercms 1 Crafter Cms 2024-11-21 8.6 High
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
CVE-2017-15682 1 Craftercms 1 Crafter Cms 2024-11-21 6.1 Medium
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.
CVE-2017-15681 1 Craftercms 1 Crafter Cms 2024-11-21 9.8 Critical
In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead to RCE.
CVE-2017-15680 1 Craftercms 1 Crafter Cms 2024-11-21 6.5 Medium
In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.
CVE-2017-15665 1 Flexense 1 Diskboss 2024-11-21 N/A
In Flexense DiskBoss Enterprise 8.5.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 8094.
CVE-2017-15664 1 Flexense 1 Syncbreeze 2024-11-21 N/A
In Flexense Sync Breeze Enterprise v10.1.16, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9121.
CVE-2017-15663 1 Flexense 1 Disk Pulse 2024-11-21 N/A
In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9120.
CVE-2017-15662 1 Flexense 1 Vx Search 2024-11-21 N/A
In Flexense VX Search Enterprise v10.1.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9123.
CVE-2017-15656 1 Asus 1 Asuswrt 2024-11-21 N/A
Password are stored in plaintext in nvram in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt.
CVE-2017-15655 1 Asus 1 Asuswrt 2024-11-21 N/A
Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version <=3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but this vulnerability was not previously disclosed. Some end-of-life routers have this version as the newest and thus are vulnerable at this time. This vulnerability allows for RCE with administrator rights when the administrator visits several pages.
CVE-2017-15654 1 Asus 1 Asuswrt 2024-11-21 N/A
Highly predictable session tokens in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt allow gaining administrative router access.
CVE-2017-15653 1 Asus 1 Asuswrt 2024-11-21 N/A
Improper administrator IP validation after his login in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt allows an unauthorized user to execute any action knowing administrator session token by using a specific User-Agent string.
CVE-2017-15652 1 Artifex 1 Ghostscript 2024-11-21 N/A
Artifex Ghostscript 9.22 is affected by: Obtain Information. The impact is: obtain sensitive information. The component is: affected source code file, affected function, affected executable, affected libga (imagemagick used that). The attack vector is: Someone must open a postscript file though ghostscript. Because of imagemagick also use libga, so it was affected as well.
CVE-2017-15640 1 Phpipam 1 Phpipam 2024-11-21 N/A
app/sections/user-menu.php in phpIPAM before 1.3.1 has XSS via the ip parameter.
CVE-2017-15637 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable in the pptp_server.lua file.
CVE-2017-15636 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-time variable in the webfilter.lua file.