Exploit Intelligence Platform

CVE-2017-9404 6.5 MEDIUM EPSS 0.01

In LibTIFF 4.0.7, a memory leak vulnerability was found in the function OJPEGReadHeaderInfoSecTablesQTable in tif_ojpeg.c, which allows attackers to cause a denial of service via a crafted file.

CWE-772 Jun 02, 2017

CVE-2017-9403 6.5 MEDIUM EPSS 0.01

In LibTIFF 4.0.7, a memory leak vulnerability was found in the function TIFFReadDirEntryLong8Array in tif_dirread.c, which allows attackers to cause a denial of service via a crafted file.

CWE-772 Jun 02, 2017

CVE-2017-0896 6.5 MEDIUM 1 Writeup EPSS 0.00

Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this.

CWE-862 Jun 02, 2017

CVE-2017-9378 6.5 MEDIUM 1 Writeup EPSS 0.00

BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks (such as data backups) to complete before a user is deleted.

CWE-863 Jun 02, 2017

CVE-2017-6039 5.3 MEDIUM EPSS 0.00

A Use of Hard-Coded Password issue was discovered in Phoenix Broadband PowerAgent SC3 BMS, all versions prior to v6.87. Use of a hard-coded password may allow unauthorized access to the device.

CWE-259 Jun 02, 2017

CVE-2017-9366 4.8 MEDIUM EPSS 0.00

Telaxus EPESI 1.8.2 and earlier has a Stored Cross-site Scripting (XSS) vulnerability in modules/Base/Dashboard/Dashboard_0.php, which allows remote attackers to inject arbitrary web script or HTML via a crafted tab_name parameter.

CWE-79 Jun 02, 2017

CVE-2017-9361 6.1 MEDIUM EPSS 0.00

WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php.

CWE-79 Jun 02, 2017

CVE-2017-9060 5.5 MEDIUM EPSS 0.00

Memory leak in the virtio_gpu_set_scanout function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (memory consumption) via a large number of "VIRTIO_GPU_CMD_SET_SCANOUT:" commands.

CWE-401 Jun 01, 2017

CVE-2017-7999 6.5 MEDIUM EPSS 0.00

Atlassian Eucalyptus before 4.4.1, when in EDGE mode, allows remote authenticated users with certain privileges to cause a denial of service (E2 service outage) via unspecified vectors.

Jun 01, 2017

CVE-2017-7384 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in FlipBuilder Flip PDF allows remote attackers to inject arbitrary web script or HTML via the currentHTMLURL parameter.

CWE-79 Jun 01, 2017

CVE-2017-6512 5.9 MEDIUM EPSS 0.01

Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.

CWE-362 Jun 01, 2017

CVE-2017-3127 6.1 MEDIUM EPSS 0.00

A Cross-Site Scripting vulnerability in Fortinet FortiGate 5.2.0 through 5.2.10 allows attacker to execute unauthorized code or commands via the srcintf parameter during Firewall Policy Creation.

CWE-79 Jun 01, 2017

CVE-2017-9337 6.1 MEDIUM EPSS 0.00

The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post.

CWE-79 Jun 01, 2017

CVE-2017-9336 6.1 MEDIUM EPSS 0.00

The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post.

CWE-79 Jun 01, 2017

CVE-2017-9331 5.4 MEDIUM EPSS 0.00

The Agenda component in Telaxus EPESI 1.8.2 and earlier has a Stored Cross-site Scripting (XSS) vulnerability in modules/Utils/RecordBrowser/RecordBrowserCommon_0.php, which allows remote attackers to inject arbitrary web script or HTML via a crafted meeting description parameter.

CWE-79 Jun 01, 2017

CVE-2017-5688 6.7 MEDIUM EPSS 0.00

There is an escalation of privilege vulnerability in the Intel Solid State Drive Toolbox versions before 3.4.5 which allow a local administrative attacker to load and execute arbitrary code.

May 31, 2017

CVE-2017-4897 5.5 MEDIUM EPSS 0.00

VMware Horizon DaaS before 7.0.0 contains a vulnerability that exists due to insufficient validation of data. An attacker may exploit this issue by tricking DaaS client users into connecting to a malicious server and sharing all their drives and devices. Successful exploitation of this vulnerability requires a victim to download a specially crafted RDP file through DaaS client by clicking on a malicious link.

CWE-20 May 31, 2017

CVE-2017-9307 6.5 MEDIUM EPSS 0.00

SSRF vulnerability in remotedownload.php in Allen Disk 1.6 allows remote authenticated users to conduct port scans and access intranet servers via a crafted file parameter.

CWE-918 May 31, 2017

CVE-2017-9306 6.1 MEDIUM EPSS 0.01

inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of an "<svg/onload=" substring instead of an "<svg onload=" substring.

CWE-79 May 31, 2017

CVE-2017-9305 6.1 MEDIUM 1 Writeup EPSS 0.00

lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batch_send_newsletter.php.

CWE-79 May 31, 2017