Exploit Intelligence Platform

CVE-2017-12413 6.1 MEDIUM EPSS 0.00

AXIS 2100 devices 2.43 have XSS via the URI, possibly related to admin/admin.shtml.

CWE-79 Aug 04, 2017

CVE-2017-12434 6.5 MEDIUM EPSS 0.00

In ImageMagick 7.0.6-1, a missing NULL check vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service (assertion failure) in DestroyImageInfo in image.c.

CWE-617 Aug 04, 2017

CVE-2017-12433 6.5 MEDIUM EPSS 0.00

In ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadPESImage in coders/pes.c, which allows attackers to cause a denial of service, related to ResizeMagickMemory in memory.c.

CWE-772 Aug 04, 2017

CVE-2017-12432 6.5 MEDIUM EPSS 0.01

In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadPCXImage in coders/pcx.c, which allows attackers to cause a denial of service.

CWE-770 Aug 04, 2017

CVE-2017-12431 6.5 MEDIUM EPSS 0.00

In ImageMagick 7.0.6-1, a use-after-free vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service.

CWE-416 Aug 04, 2017

CVE-2017-12427 6.5 MEDIUM 1 Writeup EPSS 0.01

The ProcessMSLScript function in coders/msl.c in ImageMagick before 6.9.9-5 and 7.x before 7.0.6-5 allows remote attackers to cause a denial of service (memory leak) via a crafted file, related to the WriteMSLImage function.

CWE-772 Aug 04, 2017

CVE-2017-1504 6.5 MEDIUM EPSS 0.00

IBM WebSphere Application Server version 9.0.0.4 could provide weaker than expected security after using the PasswordUtil command to enable AES password encryption. IBM X-Force ID: 129579.

Aug 03, 2017

CVE-2017-1327 6.1 MEDIUM EPSS 0.00

IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126062.

CWE-79 Aug 03, 2017

CVE-2017-1199 5.4 MEDIUM EPSS 0.00

IBM InfoSphere Master Data Management Server 10.0, 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123674.

CWE-79 Aug 03, 2017

CVE-2017-11320 6.1 MEDIUM 1 PoC Analysis EPSS 0.00

Persistent XSS through the SSID of nearby Wi-Fi devices on Technicolor TC7337 routers 08.89.17.20.00 allows an attacker to cause DNS Poisoning and steal credentials from the router.

CWE-79 Aug 03, 2017

CVE-2017-9770 5.5 MEDIUM EPSS 0.00

A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse that can cause an out of bounds read operation to occur due to a field within the IOCTL data being used as a length.

CWE-125 Aug 02, 2017

CVE-2017-9467 6.1 MEDIUM EPSS 0.01

Cross-site scripting (XSS) vulnerability in the GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Aug 02, 2017

CVE-2017-9459 6.1 MEDIUM EPSS 0.01

Cross-site scripting (XSS) vulnerability in the management web interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Aug 02, 2017

CVE-2017-9244 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in the Trello app before 4.0.8 for iOS might allow remote attackers to inject arbitrary web script or HTML by uploading and attaching a crafted photo to a Card.

CWE-79 Aug 02, 2017

CVE-2017-7890 6.5 MEDIUM EPSS 0.25

The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.

CWE-200 Aug 02, 2017

CVE-2017-11438 6.3 MEDIUM EPSS 0.00

GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add themselves to any project that is inside a subgroup.

CWE-269 Aug 02, 2017

CVE-2017-11437 6.5 MEDIUM EPSS 0.00

GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirroring feature to potentially read repositories belonging to other users.

CWE-732 Aug 02, 2017

CVE-2017-11356 6.5 MEDIUM 1 PoC Analysis EPSS 0.03

The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privileges to obtain sensitive configuration information by leveraging a missing access control.

CWE-200 Aug 02, 2017

CVE-2017-11355 6.1 MEDIUM 1 PoC Analysis EPSS 0.03

Multiple cross-site scripting (XSS) vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to the main page; the (2) beanReference parameter to the JavaBean viewer page; or the (3) pyTableName to the System database schema modification page.

CWE-79 Aug 02, 2017

CVE-2017-11334 4.4 MEDIUM EPSS 0.00

The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area.

CWE-125 Aug 02, 2017