Exploit Intelligence Platform

CVE-2016-5648 5.3 MEDIUM EPSS 0.01

Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack via a crafted SSL certificate.

CWE-295 Jun 08, 2017

CVE-2016-3095 5.5 MEDIUM EPSS 0.00

server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.

CWE-200 Jun 08, 2017

CVE-2016-3111 5.5 MEDIUM EPSS 0.00

pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp consumers in a directory that is world-readable before later modifying the permissions, which might allow local users to read the generated RSA keys via reading the key files while the installation process is running.

CWE-200 Jun 08, 2017

CVE-2016-3107 5.5 MEDIUM EPSS 0.00

The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" directory, which allows local users to gain access to sensitive data.

CWE-284 Jun 08, 2017

CVE-2017-9330 5.6 MEDIUM EPSS 0.00

QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value, a different vulnerability than CVE-2017-6505.

CWE-835 Jun 08, 2017

CVE-2017-9310 5.6 MEDIUM EPSS 0.00

QEMU (aka Quick Emulator), when built with the e1000e NIC emulation support, allows local guest OS privileged users to cause a denial of service (infinite loop) via vectors related to setting the initial receive / transmit descriptor head (TDH/RDH) outside the allocated descriptor buffer.

CWE-835 Jun 08, 2017

CVE-2015-2255 5.9 MEDIUM EPSS 0.00

Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board reset) via vectors involving a large amount of traffic from the GE port to the FE port.

CWE-19 Jun 08, 2017

CVE-2015-2253 5.0 MEDIUM EPSS 0.00

The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensitive information via a crafted XML document.

CWE-200 Jun 08, 2017

CVE-2014-6031 4.9 MEDIUM EPSS 0.00

Buffer overflow in the mcpq daemon in F5 BIG-IP systems 10.x before 10.2.4 HF12, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x before 11.4.1 HF9, 11.5.x before 11.5.2 HF1, and 11.6.0 before HF4, and Enterprise Manager 2.1.0 through 2.3.0 and 3.x before 3.1.1 HF5 allows remote authenticated administrators to cause a denial of service via unspecified vectors.

CWE-119 Jun 08, 2017

CVE-2014-4843 5.3 MEDIUM EPSS 0.00

Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.5 iFix5 allows remote attackers to obtain sensitive information about internal caseworker usernames via vectors related to a URL.

CWE-358 Jun 08, 2017

CVE-2017-9520 5.5 MEDIUM 1 Writeup EPSS 0.00

The r_config_set function in libr/config/config.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted DEX file.

CWE-416 Jun 08, 2017

CVE-2017-9516 5.4 MEDIUM 1 PoC Analysis EPSS 0.01

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

CWE-79 Jun 08, 2017

CVE-2015-3295 5.3 MEDIUM 1 Writeup EPSS 0.01

markdown-it before 4.1.0 does not block data: URLs.

CWE-284 Jun 07, 2017

CVE-2014-9310 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress.

CWE-79 Jun 07, 2017

CVE-2015-8538 6.5 MEDIUM EPSS 0.00

dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).

CWE-20 Jun 07, 2017

CVE-2015-6959 5.4 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in Vindula 1.9.

CWE-79 Jun 07, 2017

CVE-2015-6540 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in Intellect Design Arena Intellect Core banking software.

CWE-79 Jun 07, 2017

CVE-2017-4905 5.5 MEDIUM 1 PoC Analysis EPSS 0.04

VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch ESXi600-201703402-SG, 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro / Fusion 8.x prior to 8.5.6 have uninitialized memory usage. This issue may lead to an information leak.

CWE-908 Jun 07, 2017

CVE-2017-4900 5.5 MEDIUM EPSS 0.00

VMware Workstation Pro/Player 12.x before 12.5.3 contains a NULL pointer dereference vulnerability that exists in the SVGA driver. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs.

CWE-476 Jun 07, 2017

CVE-2017-4899 4.7 MEDIUM EPSS 0.00

VMware Workstation Pro/Player 12.x before 12.5.3 contains a security vulnerability that exists in the SVGA driver. An attacker may exploit this issue to crash the VM or trigger an out-of-bound read. Note: This issue can be triggered only when the host has no graphics card or no graphics drivers are installed.

CWE-125 Jun 07, 2017