Browse CVE records published in July 2017, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 1427 matching CVEs · Page 9 of 29.
Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parent_id parameter to tree.php and drp_action parameter to data_sources.php.
Published Jul 13, 2017 · Updated Aug 5, 2024
GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulnerable to a password manager sweep attack resulting in the remote exfiltration of stored passwords for a selected set of websites.
Published Jul 13, 2017 · Updated Aug 5, 2024
Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data parser.
Published Jul 13, 2017 · Updated Aug 5, 2024
Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using ".." in tar archive entries
Published Jul 13, 2017 · Updated Aug 5, 2024
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters
Published Jul 13, 2017 · Updated Aug 5, 2024
CSRF in Bitly oauth2_proxy 2.1 during authentication flow
Published Jul 13, 2017 · Updated Aug 5, 2024
Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure vulnerability, that makes it possible to provide an unauthenticated attacker plain text password of administrative user and grant access to the web-based administration interface.
Published Jul 13, 2017 · Updated Aug 5, 2024
Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in the context on the current user.
Published Jul 13, 2017 · Updated Aug 5, 2024
Linux foundation ONOS 1.9.0 allows unauthenticated use of websockets.
Published Jul 13, 2017 · Updated Aug 5, 2024
Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission
Published Jul 13, 2017 · Updated Aug 5, 2024
Linux foundation ONOS 1.9.0 is vulnerable to a DoS.
Published Jul 13, 2017 · Updated Aug 5, 2024
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.
Published Jul 13, 2017 · Updated Aug 5, 2024
LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document.
Published Jul 13, 2017 · Updated Aug 5, 2024
Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided Javascript code in the session of other users.
Published Jul 13, 2017 · Updated Aug 5, 2024
Mautic 2.6.1 and earlier fails to set flags on session cookies
Published Jul 13, 2017 · Updated Aug 5, 2024
The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in the disclosure of sensitive information.
Published Jul 13, 2017 · Updated Aug 5, 2024
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.
Published Jul 13, 2017 · Updated Aug 5, 2024
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server.
Published Jul 13, 2017 · Updated Aug 5, 2024
systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rather than the user intended.
Published Jul 7, 2017 · Updated Aug 5, 2024
Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution
Published Jul 13, 2017 · Updated Aug 5, 2024
Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code execution.
Published Jul 13, 2017 · Updated Aug 5, 2024
xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service
Published Jul 13, 2017 · Updated Aug 5, 2024
kittoframework kitto version 0.5.1 is vulnerable to memory exhaustion in the router resulting in DoS
Published Jul 13, 2017 · Updated Aug 5, 2024
Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.
Published Jul 13, 2017 · Updated Aug 5, 2024
SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and graph_template_id parameters.
Published Jul 13, 2017 · Updated Aug 5, 2024
gtk-vnc 0.4.2 and older doesn't check framebuffer boundaries correctly when updating framebuffer which may lead to memory corruption when rendering
Published Jul 13, 2017 · Updated Aug 5, 2024
Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem.
Published Jul 13, 2017 · Updated Aug 5, 2024
Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON Name.
Published Jul 13, 2017 · Updated Aug 5, 2024
Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravity_value resulting potentially leading to modification of unexpected memory locations
Published Jul 13, 2017 · Updated Aug 5, 2024
WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected site
Published Jul 13, 2017 · Updated Aug 5, 2024
Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Management(Users) functionality allows attackers to inject arbitrary web scripts and execute malicious scripts within an authenticated client's browser.
Published Jul 13, 2017 · Updated Aug 5, 2024
SYN Flood or FIN Flood attack in ECos 1 and other versions embedded devices results in web Authentication Bypass. "eCos Embedded Web Servers used by Multiple Routers and Home devices, while sending SYN Flood or FIN Flood packets fails to validate and handle the packets and does not ask for any sign of authentication resulting in Authentication Bypass. An attacker can take complete advantage of this bug and take over the device remotely or locally. The bug has been successfully tested and reproduced in some versions of SOHO Routers manufactured by TOTOLINK, GREATEK and others."
Published Jul 13, 2017 · Updated Aug 5, 2024
LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents.
Published Jul 13, 2017 · Updated Aug 5, 2024
kittoframework kitto 0.5.1 is vulnerable to directory traversal in the router resulting in remote code execution
Published Jul 13, 2017 · Updated Aug 5, 2024
EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root
Published Jul 13, 2017 · Updated Aug 5, 2024
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.
Published Jul 13, 2017 · Updated Aug 5, 2024
RVM automatically loads environment variables from files in $PWD resulting in command execution RVM vulnerable to command injection when automatically loading environment variables from files in $PWD RVM automatically executes hooks located in $PWD resulting in code execution RVM automatically installs gems as specified by files in $PWD resulting in code execution RVM automatically does "bundle install" on a Gemfile specified by .versions.conf in $PWD resulting in code execution
Published Jul 13, 2017 · Updated Aug 5, 2024
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploited by issuing a specially crafted HTTP GET request.
Published Jul 13, 2017 · Updated Aug 5, 2024
Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user web login function resulting in unauthorized account access.
Published Jul 13, 2017 · Updated Aug 5, 2024
TestTrack Server versions 1.0 and earlier are vulnerable to an authentication flaw in the split disablement feature resulting in the ability to disable arbitrary running splits and cause denial of service to clients in the field.
Published Jul 13, 2017 · Updated Aug 5, 2024
Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack
Published Jul 13, 2017 · Updated Aug 5, 2024
phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name
Published Jul 13, 2017 · Updated Aug 5, 2024
rbenv (all current versions) is vulnerable to Directory Traversal in the specification of Ruby version resulting in arbitrary code execution
Published Jul 13, 2017 · Updated Aug 5, 2024
Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible to include arbitrary files on the server, this vulnerability can be exploited without any prior authentication.
Published Jul 13, 2017 · Updated Aug 5, 2024
kittoframework kitto version 0.5.1 is vulnerable to an XSS in the 404 page resulting in information disclosure
Published Jul 13, 2017 · Updated Aug 5, 2024
A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18.
Published Jul 13, 2017 · Updated Aug 5, 2024
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality
Published Jul 13, 2017 · Updated Aug 5, 2024
Audacity 2.1.2 through 2.3.2 is vulnerable to Dll HIjacking in the avformat-55.dll resulting arbitrary code execution.
Published Jul 13, 2017 · Updated Aug 5, 2024
LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalation.
Published Jul 13, 2017 · Updated Aug 5, 2024
phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server
Published Jul 13, 2017 · Updated Aug 5, 2024
