Exploit Intelligence Platform

CVE-2017-1332 6.1 MEDIUM EPSS 0.00

IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126234.

CWE-79 Jul 31, 2017

CVE-2017-1303 6.1 MEDIUM EPSS 0.00

IBM WebSphere Portal and Web Content Manager 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125457.

CWE-79 Jul 31, 2017

CVE-2016-9719 5.7 MEDIUM EPSS 0.00

IBM InfoSphere Master Data Management Server 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 119733.

CWE-20 Jul 31, 2017

CVE-2016-9718 5.4 MEDIUM EPSS 0.00

IBM InfoSphere Master Data Management Server 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119732.

CWE-79 Jul 31, 2017

CVE-2016-9717 6.5 MEDIUM EPSS 0.00

HTTP Parameter Override is identified in the IBM Infosphere Master Data Management (MDM) 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 product. It enables attackers by exposing the presence of duplicated parameters which may produce an anomalous behavior in the application that can be potentially exploited.

CWE-20 Jul 31, 2017

CVE-2016-9715 5.4 MEDIUM EPSS 0.00

IBM InfoSphere Master Data Management Server 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119728.

CWE-79 Jul 31, 2017

CVE-2017-11551 5.5 MEDIUM EPSS 0.01

The id3_field_parse function in field.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (OOM) via a crafted MP3 file.

CWE-119 Jul 31, 2017

CVE-2017-11550 5.5 MEDIUM EPSS 0.00

The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.

CWE-476 Jul 31, 2017

CVE-2017-11549 5.5 MEDIUM EPSS 0.00

The play_midi function in playmidi.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service (large loop and CPU consumption) via a crafted mid file. NOTE: CPU consumption might be relevant when using the --background option.

CWE-834 Jul 31, 2017

CVE-2017-11548 5.5 MEDIUM 1 PoC Analysis EPSS 0.02

The _tokenize_matrix function in audio_out.c in Xiph.Org libao 1.2.0 allows remote attackers to cause a denial of service (memory corruption) via a crafted MP3 file.

CWE-119 Jul 31, 2017

CVE-2017-11547 5.5 MEDIUM EPSS 0.00

The resample_gauss function in resample.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted mid file. NOTE: a crash might be relevant when using the --background option. NOTE: the TiMidity++ README.alsaseq documentation suggests a setuid-root installation.

CWE-125 Jul 31, 2017

CVE-2017-11546 5.5 MEDIUM EPSS 0.00

The insert_note_steps function in readmidi.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted mid file. NOTE: a crash might be relevant when using the --background option.

CWE-369 Jul 31, 2017

CVE-2017-11359 5.5 MEDIUM 1 PoC Analysis EPSS 0.04

The wavwritehdr function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted snd file, during conversion to a wav file.

CWE-369 Jul 31, 2017

CVE-2017-11358 5.5 MEDIUM 1 PoC Analysis EPSS 0.05

The read_samples function in hcom.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted hcom file.

CWE-125 Jul 31, 2017

CVE-2017-11333 5.5 MEDIUM 1 PoC Analysis EPSS 0.02

The vorbis_analysis_wrote function in lib/block.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service (OOM) via a crafted wav file.

CWE-476 Jul 31, 2017

CVE-2017-11332 5.5 MEDIUM 1 PoC Analysis EPSS 0.05

The startread function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted wav file.

CWE-369 Jul 31, 2017

CVE-2017-11331 5.5 MEDIUM 1 PoC Analysis EPSS 0.02

The wav_open function in oggenc/audio.c in Xiph.Org vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (memory allocation error) via a crafted wav file.

CWE-119 Jul 31, 2017

CVE-2017-11330 5.5 MEDIUM 1 PoC Analysis EPSS 0.03

The DivFixppCore::avi_header_fix function in DivFix++Core.cpp in DivFix++ v0.34 allows remote attackers to cause a denial of service (invalid memory write and application crash) via a crafted avi file.

CWE-787 Jul 31, 2017

CVE-2017-11119 5.5 MEDIUM EPSS 0.00

The chk_mem_access function in cpu/nes6502/nes6502.c in libnosefart.a in Nosefart 2.9-mls allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted nsf file.

CWE-125 Jul 31, 2017

CVE-2017-11118 5.5 MEDIUM EPSS 0.00

The ExifImageFile::readImage function in ExifImageFileRead.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted jpg file.

CWE-835 Jul 31, 2017