Exploit Intelligence Platform

CVE-2017-11682 6.1 MEDIUM EPSS 0.00

Stored Cross-site scripting vulnerability in Hashtopussy 0.4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) version, (2) url, or (3) rootdir parameter in hashcat.php.

CWE-79 Jul 27, 2017

CVE-2017-11677 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in Hashtopus 1.5g allows remote attackers to inject arbitrary web script or HTML via the query string to admin.php.

CWE-79 Jul 27, 2017

CVE-2017-11674 5.5 MEDIUM EPSS 0.00

Reporter.exe in Acunetix 8 allows remote attackers to cause a denial of service (application crash) via a malformed PRE file, related to a "Read Access Violation starting at reporter!madTraceProcess."

CWE-119 Jul 27, 2017

CVE-2017-11671 4.0 MEDIUM EPSS 0.00

Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation.

CWE-338 Jul 26, 2017

CVE-2017-11666 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in js/ViewerPanel.js in the file previewer plugin in Kopano WebApp versions 3.3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a specially crafted previewable file.

CWE-79 Jul 26, 2017

CVE-2017-11612 6.1 MEDIUM EPSS 0.00

In Joomla! before 3.7.4, inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components.

CWE-79 Jul 26, 2017

CVE-2017-11654 5.9 MEDIUM EPSS 0.01

An out-of-bounds read and write flaw was found in the way SIPcrack 0.2 processed SIP traffic, because 0x00 termination of a payload array was mishandled. A remote attacker could potentially use this flaw to crash the sipdump process by generating specially crafted SIP traffic.

CWE-125 Jul 26, 2017

CVE-2017-11651 6.1 MEDIUM EPSS 0.00

NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag.

CWE-79 Jul 26, 2017

CVE-2017-11644 6.5 MEDIUM EPSS 0.00

When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the ReadMATImage() function in coders/mat.c.

CWE-772 Jul 26, 2017

CVE-2017-11640 6.5 MEDIUM EPSS 0.01

When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to an address access exception in the WritePTIFImage() function in coders/tiff.c.

CWE-119 Jul 26, 2017

CVE-2017-11639 6.5 MEDIUM EPSS 0.00

When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteCIPImage() function in coders/cip.c, related to the GetPixelLuma function in MagickCore/pixel-accessor.h.

CWE-125 Jul 26, 2017

CVE-2017-11629 6.1 MEDIUM NUCLEI EPSS 0.00

dayrui FineCms through 5.0.10 has Cross Site Scripting (XSS) in controllers/api.php via the function parameter in a c=api&m=data2 request.

CWE-79 Jul 26, 2017

CVE-2017-11613 6.5 MEDIUM EPSS 0.00

In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer.

CWE-20 Jul 26, 2017

CVE-2017-11627 5.5 MEDIUM EPSS 0.00

A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the PointerHolder function in PointerHolder.hh, aka an "infinite loop."

CWE-835 Jul 25, 2017

CVE-2017-11626 5.5 MEDIUM EPSS 0.00

A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."

CWE-835 Jul 25, 2017

CVE-2017-11625 5.5 MEDIUM EPSS 0.00

A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDF::resolveObjectsInStream function in QPDF.cc, aka an "infinite loop."

CWE-835 Jul 25, 2017

CVE-2017-11624 5.5 MEDIUM EPSS 0.00

A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after two consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."

CWE-835 Jul 25, 2017

CVE-2016-6133 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in Ektron Content Management System before 9.1.0.184SP3(9.1.0.184.3.127) allows remote attackers to inject arbitrary web script or HTML via the rptStatus parameter in a Report action to WorkArea/SelectUserGroup.aspx.

CWE-79 Jul 25, 2017

CVE-2017-6755 6.1 MEDIUM EPSS 0.00

A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning (PCP) Tool could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCvc90312. Known Affected Releases: 12.1.

CWE-79 Jul 25, 2017

CVE-2017-6749 5.4 MEDIUM EPSS 0.00

A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88865. Known Affected Releases: 10.1.0-204.

CWE-79 Jul 25, 2017