CVE & Exploit Intelligence Database

CVE-2017-6905 6.1 MEDIUM 1 Writeup EPSS 0.00

An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (disable_choose) passed to the "concrete5-legacy-master/web/concrete/tools/files/search_dialog.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

CWE-79 Mar 15, 2017

CVE-2017-3899 6.5 MEDIUM EPSS 0.01

SQL injection vulnerability in Intel Security Advanced Threat Defense (ATD) Linux 3.6.0 and earlier allows remote authenticated users to obtain product information via a crafted HTTP request parameter.

CWE-89 Mar 14, 2017

CVE-2016-8025 6.2 MEDIUM 1 PoC Analysis EPSS 0.02

SQL injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to obtain product information via a crafted HTTP request parameter.

CWE-89 Mar 14, 2017

CVE-2016-8021 5.0 MEDIUM 1 PoC Analysis EPSS 0.03

Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to spoof update server and execute arbitrary code via a crafted input file.

CWE-347 Mar 14, 2017

CVE-2016-8019 6.1 MEDIUM 1 PoC Analysis EPSS 0.01

Cross-site scripting (XSS) vulnerability in attributes in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows unauthenticated remote attackers to inject arbitrary web script or HTML via a crafted user input.

CWE-79 Mar 14, 2017

CVE-2016-8018 4.3 MEDIUM 1 PoC Analysis EPSS 0.00

Cross-site request forgery (CSRF) vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to execute unauthorized commands via a crafted user input.

CWE-352 Mar 14, 2017

CVE-2016-8017 4.1 MEDIUM 1 PoC Analysis EPSS 0.14

Special element injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to read files on the webserver via a crafted user input.

CWE-20 Mar 14, 2017

CVE-2016-8011 6.1 MEDIUM EPSS 0.00

Cross-site scripting vulnerability in Intel Security McAfee Endpoint Security (ENS) Web Control before 10.2.0.408.10 allows attackers to inject arbitrary web script or HTML via a crafted web site.

CWE-79 Mar 14, 2017

CVE-2016-8007 6.3 MEDIUM 1 PoC Analysis EPSS 0.00

Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services (HIPS) 8.0 Patch 7 and earlier allows authenticated users to manipulate the product's registry keys via specific conditions.

CWE-284 Mar 14, 2017

CVE-2016-8005 6.5 MEDIUM EPSS 0.00

File extension filtering vulnerability in Intel Security McAfee Email Gateway (MEG) before 7.6.404h1128596 allows attackers to fail to identify the file name properly via scanning an email with a forged attached filename that uses a null byte within the filename extension.

CWE-264 Mar 14, 2017

CVE-2015-8987 5.3 MEDIUM EPSS 0.00

Man-in-the-middle (MitM) attack vulnerability in non-Mac OS agents in McAfee (now Intel Security) Agent (MA) 4.8.0 patch 2 and earlier allows attackers to make a McAfee Agent talk with another, possibly rogue, ePO server via McAfee Agent migration to another ePO server.

CWE-284 Mar 14, 2017

CVE-2015-8986 5.5 MEDIUM EPSS 0.00

Sandbox detection evasion vulnerability in hardware appliances in McAfee (now Intel Security) Advanced Threat Defense (MATD) 3.4.2.32 and earlier allows attackers to detect the sandbox environment, then bypass proper malware detection resulting in failure to detect a malware file (false-negative) via specially crafted malware.

CWE-254 Mar 14, 2017

CVE-2014-9920 5.9 MEDIUM EPSS 0.00

Unauthorized execution of binary vulnerability in McAfee (now Intel Security) McAfee Application Control (MAC) 6.0.0 before hotfix 9726, 6.0.1 before hotfix 9068, 6.1.0 before hotfix 692, 6.1.1 before hotfix 399, 6.1.2 before hotfix 426, and 6.1.3 before hotfix 357 and earlier allows attackers to create a malformed Windows binary that is considered non-executable and is not protected through the whitelisting protection feature via a specific set of circumstances.

CWE-284 Mar 14, 2017

CVE-2013-7461 5.5 MEDIUM EPSS 0.00

A write protection and execution bypass vulnerability in McAfee (now Intel Security) Change Control (MCC) 6.1.0 for Linux and earlier allows authenticated users to change files that are part of write protection rules via specific conditions.

CWE-284 Mar 14, 2017

CVE-2013-7460 5.5 MEDIUM EPSS 0.00

A write protection and execution bypass vulnerability in McAfee (now Intel Security) Application Control (MAC) 6.1.0 for Linux and earlier allows authenticated users to change binaries that are part of the Application Control whitelist and allows execution of binaries via specific conditions.

CWE-284 Mar 14, 2017

CVE-2017-6516 6.7 MEDIUM 3 PoCs Analysis EPSS 0.21

A Local Privilege Escalation Vulnerability in MagniComp's Sysinfo before 10-H64 for Linux and UNIX platforms could allow a local attacker to gain elevated privileges. Parts of SysInfo require setuid-to-root access in order to access restricted system files and make restricted kernel calls. This access could be exploited by a local attacker to gain a root shell prompt using the right combination of environment variables and command line arguments.

CWE-20 Mar 14, 2017

CVE-2017-3000 6.5 MEDIUM 1 PoC Analysis EPSS 0.17

Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number generator used for constant blinding. Successful exploitation could lead to information disclosure.

Mar 14, 2017

CVE-2017-6335 5.5 MEDIUM EPSS 0.00

The QuantumTransferMode function in coders/tiff.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a small samples per pixel value in a CMYKA TIFF file.

CWE-125 Mar 14, 2017

CVE-2017-5957 5.5 MEDIUM EPSS 0.00

Stack-based buffer overflow in the vrend_decode_set_framebuffer_state function in vrend_decode.c in virglrenderer before 926b9b3460a48f6454d8bbe9e44313d86a65447f, as used in Quick Emulator (QEMU), allows a local guest users to cause a denial of service (application crash) via the "nr_cbufs" argument.

CWE-787 Mar 14, 2017

CVE-2016-10172 5.5 MEDIUM EPSS 0.00

The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.

CWE-125 Mar 14, 2017