CVEs

128,962 total · page 2440 of 2,580

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	KEV	Published	Description
CVE-2016-8951	IBM Emptoris Strategic Supply Management	Hig	0.49	7.5	0.03		Jul 13, 2017	IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to a denial of service attack. An attacker can exploit a vulnerability in the authentication features that could log out users and flood user accounts with emails. IBM X-Force ID: 118838.
CVE-2017-7529	Nginx Nginx	Hig	0.54	7.5	0.63		Jul 13, 2017	Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
CVE-2017-11103	Heimdal Heimdal	Hig	0.53	8.1	0.05		Jul 13, 2017	Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification. In _krb5_extract_ticket() the KDC-REP service name must be obtained from the…
CVE-2017-11173	Rack Cors Project Rack Cors	Hig	0.50	8.8	0.02		Jul 13, 2017	Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then…
CVE-2017-11200	Finecms Project Finecms	Hig	0.57	8.8	0.01		Jul 13, 2017	SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitor_ip parameter.
CVE-2017-11196	Pulsesecure Pulse Connect Secure	Hig	0.57	8.8	0.01		Jul 12, 2017	Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to logout a user by making them visit a malicious web page.
CVE-2017-11193	Pulsesecure Pulse Connect Secure	Hig	0.57	8.8	0.01		Jul 12, 2017	Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, traceroute6, nslookup, arp, and Portprobe. These functions do not have any protections against CSRF. That can allow an attacker…
CVE-2017-2863	Iceni Infix	Hig	0.51	7.8	0.01		Jul 12, 2017	An out-of-bounds write vulnerability exists in the PDF parsing functionality of Infix 7.1.5. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific PDF file to trigger this vulnerability.
CVE-2017-2820	Xorg Poppler	Hig	0.58	8.8	0.04		Jul 12, 2017	An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary…
CVE-2017-2818	Xorg Poppler	Hig	0.49	7.5	0.02		Jul 12, 2017	An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted PDF can cause an overly large number of color components during image rendering, resulting in heap corruption. An attacker controlled PDF file can be…
CVE-2017-2814	Xorg Poppler	Hig	0.49	7.5	0.03		Jul 12, 2017	An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted pdf can cause an image resizing after allocation has already occurred, resulting in heap corruption which can lead to code execution. An attacker…
CVE-2017-9977	AVG Technologies Antivirus	Hig	0.49	7.5	0.01		Jul 12, 2017	AVG AntiVirus for MacOS with scan engine before 4668 might allow remote attackers to bypass malware detection by leveraging failure to scan inside disk image (aka DMG) files.
CVE-2017-9845	SAP Netweaver	Hig	0.49	7.5	0.03		Jul 12, 2017	disp+work 7400.12.21.30308 in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request, aka SAP Security Note 2405918.
CVE-2017-9844	SAP Netweaver	Hig	0.49	7.5	0.05		Jul 12, 2017	SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. NOTE: The vendor states that the devserver package of…
CVE-2017-11190	unrar-free unrar-free	Hig	0.51	7.8	0.01		Jul 12, 2017	unrarlib.c in unrar-free 0.0.1, when _DEBUG_LOG mode is enabled, might allow remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via an RAR archive containing a long filename.
CVE-2017-4057	McAfee Advanced Threat Defense	Hig	0.57	8.8	0.01		Jul 12, 2017	Privilege Escalation vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated users to gain elevated privileges via the GUI or GUI terminal commands.
CVE-2017-4055	McAfee Advanced Threat Defense	Hig	0.49	7.5	0.01		Jul 12, 2017	Exploitation of Authentication vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to bypass ATD detection via loose enforcement of authentication and authorization.
CVE-2017-4054	McAfee Advanced Threat Defense	Hig	0.57	8.8	0.03		Jul 12, 2017	Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated users to execute a command of their choice via a crafted HTTP request parameter.
CVE-2017-11188	ImageMagick Imagemagick	Hig	0.49	7.5	0.02		Jul 12, 2017	The ReadDPXImage function in coders\dpx.c in ImageMagick 7.0.6-0 has a large loop vulnerability that can cause CPU exhaustion via a crafted DPX file, related to lack of an EOF check.
CVE-2017-11178	Finecms Project Finecms	Hig	0.49	7.5	0.01		Jul 12, 2017	In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. For example, this can be used to overwrite a .php file because the file extension is not…
CVE-2017-11176	Linux Kernel	Hig	0.54	7.8	0.04		Jul 11, 2017	The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other…
CVE-2017-8619	Microsoft Edge	Hig	0.50	7.5	0.16		Jul 11, 2017	Microsoft Edge on Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability in the way affected Microsoft scripting engines render when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE…
CVE-2017-8618	Microsoft Internet Explorer	Hig	0.56	7.5	0.58		Jul 11, 2017	Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 Internet Explorer in the way affected Microsoft scripting engines render when…
CVE-2017-8617	Microsoft Edge	Hig	0.50	7.5	0.11		Jul 11, 2017	Microsoft Edge in Windows 10 1703 Microsoft Edge allows a remote code execution vulnerability in the way affected Microsoft scripting engines render when handling objects in memory, aka "Microsoft Edge Remote Code Execution Vulnerability."
CVE-2017-8610	Microsoft Edge	Hig	0.49	7.5	0.09		Jul 11, 2017	Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This…
CVE-2017-8609	Microsoft Edge	Hig	0.49	7.5	0.09		Jul 11, 2017	Microsoft Internet Explorer in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Internet…
CVE-2017-8608	Microsoft Internet Explorer	Hig	0.50	7.5	0.09		Jul 11, 2017	Microsoft browsers in Microsoft Windows Server 2008 and R2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the…
CVE-2017-8607	Microsoft Internet Explorer	Hig	0.50	7.5	0.09		Jul 11, 2017	Microsoft browsers in Microsoft Windows 7, Windows Server 2008 and R2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when…
CVE-2017-8606	Microsoft Internet Explorer	Hig	0.50	7.5	0.09		Jul 11, 2017	Microsoft browsers in Microsoft Windows 7, Windows Server 2008 and R2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when…
CVE-2017-8605	Microsoft Edge	Hig	0.49	7.5	0.09		Jul 11, 2017	Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting…
CVE-2017-8604	Microsoft Edge	Hig	0.49	7.5	0.09		Jul 11, 2017	Microsoft Edge in Microsoft Windows 10 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine…
CVE-2017-8603	Microsoft Edge	Hig	0.49	7.5	0.09		Jul 11, 2017	Microsoft Edge in Microsoft Windows 10 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine…
CVE-2017-8601	Microsoft Edge	Hig	0.57	7.5	0.67		Jul 11, 2017	Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting…
CVE-2017-8598	Microsoft Edge	Hig	0.49	7.5	0.09		Jul 11, 2017	Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting…
CVE-2017-8596	Microsoft Edge	Hig	0.49	7.5	0.06		Jul 11, 2017	Microsoft Edge in Microsoft Windows 10 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine…
CVE-2017-8595	Microsoft Edge	Hig	0.49	7.5	0.08		Jul 11, 2017	Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting…
CVE-2017-8594	Microsoft Internet Explorer	Hig	0.56	7.5	0.50		Jul 11, 2017	Internet Explorer on Microsoft Windows 8.1 and Windows RT 8.1, and Windows Server 2012 R2 allows an attacker to execute arbitrary code in the context of the current user when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption…
CVE-2017-8590	Microsoft Windows Server 2008	Hig	0.57	8.8	0.01		Jul 11, 2017	Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to the way that the Windows Common Log File…
CVE-2017-8588	Microsoft Windows Server 2008	Hig	0.47	7.0	0.17		Jul 11, 2017	Microsoft WordPad in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability due to the way it parses specially…
CVE-2017-8585	Microsoft .net Framework	Hig	0.50	7.5	0.10		Jul 11, 2017	Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service, aka .NET Denial of Service Vulnerability.
CVE-2017-8584	Microsoft Windows Server 2016	Hig	0.49	7.5	0.04		Jul 11, 2017	Windows 10 1607 and Windows Server 2016 allow an attacker to execute code remotely via a specially crafted WiFi packet aka "HoloLens Remote Code Execution Vulnerability."
CVE-2017-8581	Microsoft Windows Server 2008	Hig	0.46	7.0	0.01		Jul 11, 2017	Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle…
CVE-2017-8580	Microsoft Windows Server 2008	Hig	0.46	7.0	0.01		Jul 11, 2017	Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle…
CVE-2017-8578	Microsoft Windows Server 2008	Hig	0.51	7.8	0.06		Jul 11, 2017	Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle…
CVE-2017-8577	Microsoft Windows Server 2008	Hig	0.46	7.0	0.01		Jul 11, 2017	Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle…
CVE-2017-8574	Microsoft Windows Server 2016	Hig	0.46	7.0	0.01		Jul 11, 2017	Graphics in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Microsoft Graphics Component Elevation of Privilege Vulnerability". This CVE ID is unique from…
CVE-2017-8573	Microsoft Windows Server 2008	Hig	0.46	7.0	0.01		Jul 11, 2017	Graphics in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle…
CVE-2017-8570	Microsoft Office	Hig	0.73	7.8	0.90	KEV	Jul 11, 2017	Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0243.
CVE-2017-8569	Microsoft Sharepoint Server	Hig	0.58	8.8	0.05		Jul 11, 2017	Microsoft SharePoint Server allows an elevation of privilege vulnerability due to the way that it sanitizes a specially crafted web request to an affected SharePoint server, aka "SharePoint Server XSS Vulnerability".
CVE-2017-8566	Microsoft Windows Server 2016	Hig	0.46	7.0	0.01		Jul 11, 2017	Microsoft Windows 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to Windows Input Method Editor (IME) improperly handling parameters in a method of a DCOM class, aka "Windows IME Elevation of Privilege Vulnerability".

CVE-2016-8951HigJul 13, 2017
IBM
Emptoris Strategic Supply Management
risk 0.49cvss 7.5epss 0.03
IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to a denial of service attack. An attacker can exploit a vulnerability in the authentication features that could log out users and flood user accounts with emails. IBM X-Force ID: 118838.
CVE-2017-7529HigJul 13, 2017
Nginx
Nginx
risk 0.54cvss 7.5epss 0.63
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
CVE-2017-11103HigJul 13, 2017
Heimdal
Heimdal
risk 0.53cvss 8.1epss 0.05
Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification. In _krb5_extract_ticket() the KDC-REP service name must be obtained from the…
CVE-2017-11173HigJul 13, 2017
Rack Cors Project
Rack Cors
risk 0.50cvss 8.8epss 0.02
Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then…
CVE-2017-11200HigJul 13, 2017
Finecms Project
Finecms
risk 0.57cvss 8.8epss 0.01
SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitor_ip parameter.
CVE-2017-11196HigJul 12, 2017
Pulsesecure
Pulse Connect Secure
risk 0.57cvss 8.8epss 0.01
Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to logout a user by making them visit a malicious web page.
CVE-2017-11193HigJul 12, 2017
Pulsesecure
Pulse Connect Secure
risk 0.57cvss 8.8epss 0.01
Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, traceroute6, nslookup, arp, and Portprobe. These functions do not have any protections against CSRF. That can allow an attacker…
CVE-2017-2863HigJul 12, 2017
Iceni
Infix
risk 0.51cvss 7.8epss 0.01
An out-of-bounds write vulnerability exists in the PDF parsing functionality of Infix 7.1.5. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific PDF file to trigger this vulnerability.
CVE-2017-2820HigJul 12, 2017
Xorg
Poppler
risk 0.58cvss 8.8epss 0.04
An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF file can lead to an integer overflow causing out of bounds memory overwrite on the heap resulting in potential arbitrary…
CVE-2017-2818HigJul 12, 2017
Xorg
Poppler
risk 0.49cvss 7.5epss 0.02
An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted PDF can cause an overly large number of color components during image rendering, resulting in heap corruption. An attacker controlled PDF file can be…
CVE-2017-2814HigJul 12, 2017
Xorg
Poppler
risk 0.49cvss 7.5epss 0.03
An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted pdf can cause an image resizing after allocation has already occurred, resulting in heap corruption which can lead to code execution. An attacker…
CVE-2017-9977HigJul 12, 2017
AVG Technologies
Antivirus
risk 0.49cvss 7.5epss 0.01
AVG AntiVirus for MacOS with scan engine before 4668 might allow remote attackers to bypass malware detection by leveraging failure to scan inside disk image (aka DMG) files.
CVE-2017-9845HigJul 12, 2017
SAP
Netweaver
risk 0.49cvss 7.5epss 0.03
disp+work 7400.12.21.30308 in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request, aka SAP Security Note 2405918.
CVE-2017-9844HigJul 12, 2017
SAP
Netweaver
risk 0.49cvss 7.5epss 0.05
SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in a request to metadatauploader, aka SAP Security Note 2399804. NOTE: The vendor states that the devserver package of…
CVE-2017-11190HigJul 12, 2017
unrar-free
unrar-free
risk 0.51cvss 7.8epss 0.01
unrarlib.c in unrar-free 0.0.1, when _DEBUG_LOG mode is enabled, might allow remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via an RAR archive containing a long filename.
CVE-2017-4057HigJul 12, 2017
McAfee
Advanced Threat Defense
risk 0.57cvss 8.8epss 0.01
Privilege Escalation vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated users to gain elevated privileges via the GUI or GUI terminal commands.
CVE-2017-4055HigJul 12, 2017
McAfee
Advanced Threat Defense
risk 0.49cvss 7.5epss 0.01
Exploitation of Authentication vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to bypass ATD detection via loose enforcement of authentication and authorization.
CVE-2017-4054HigJul 12, 2017
McAfee
Advanced Threat Defense
risk 0.57cvss 8.8epss 0.03
Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated users to execute a command of their choice via a crafted HTTP request parameter.
CVE-2017-11188HigJul 12, 2017
ImageMagick
Imagemagick
risk 0.49cvss 7.5epss 0.02
The ReadDPXImage function in coders\dpx.c in ImageMagick 7.0.6-0 has a large loop vulnerability that can cause CPU exhaustion via a crafted DPX file, related to lack of an EOF check.
CVE-2017-11178HigJul 12, 2017
Finecms Project
Finecms
risk 0.49cvss 7.5epss 0.01
In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. For example, this can be used to overwrite a .php file because the file extension is not…
CVE-2017-11176HigJul 11, 2017
Linux
Kernel
risk 0.54cvss 7.8epss 0.04
The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other…
CVE-2017-8619HigJul 11, 2017
Microsoft
Edge
risk 0.50cvss 7.5epss 0.16
Microsoft Edge on Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability in the way affected Microsoft scripting engines render when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE…
CVE-2017-8618HigJul 11, 2017
Microsoft
Internet Explorer
risk 0.56cvss 7.5epss 0.58
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 Internet Explorer in the way affected Microsoft scripting engines render when…
CVE-2017-8617HigJul 11, 2017
Microsoft
Edge
risk 0.50cvss 7.5epss 0.11
Microsoft Edge in Windows 10 1703 Microsoft Edge allows a remote code execution vulnerability in the way affected Microsoft scripting engines render when handling objects in memory, aka "Microsoft Edge Remote Code Execution Vulnerability."
CVE-2017-8610HigJul 11, 2017
Microsoft
Edge
risk 0.49cvss 7.5epss 0.09
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability". This…
CVE-2017-8609HigJul 11, 2017
Microsoft
Edge
risk 0.49cvss 7.5epss 0.09
Microsoft Internet Explorer in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Internet…
CVE-2017-8608HigJul 11, 2017
Microsoft
Internet Explorer
risk 0.50cvss 7.5epss 0.09
Microsoft browsers in Microsoft Windows Server 2008 and R2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the…
CVE-2017-8607HigJul 11, 2017
Microsoft
Internet Explorer
risk 0.50cvss 7.5epss 0.09
Microsoft browsers in Microsoft Windows 7, Windows Server 2008 and R2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when…
CVE-2017-8606HigJul 11, 2017
Microsoft
Internet Explorer
risk 0.50cvss 7.5epss 0.09
Microsoft browsers in Microsoft Windows 7, Windows Server 2008 and R2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when…
CVE-2017-8605HigJul 11, 2017
Microsoft
Edge
risk 0.49cvss 7.5epss 0.09
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting…
CVE-2017-8604HigJul 11, 2017
Microsoft
Edge
risk 0.49cvss 7.5epss 0.09
Microsoft Edge in Microsoft Windows 10 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine…
CVE-2017-8603HigJul 11, 2017
Microsoft
Edge
risk 0.49cvss 7.5epss 0.09
Microsoft Edge in Microsoft Windows 10 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine…
CVE-2017-8601HigJul 11, 2017
Microsoft
Edge
risk 0.57cvss 7.5epss 0.67
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting…
CVE-2017-8598HigJul 11, 2017
Microsoft
Edge
risk 0.49cvss 7.5epss 0.09
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting…
CVE-2017-8596HigJul 11, 2017
Microsoft
Edge
risk 0.49cvss 7.5epss 0.06
Microsoft Edge in Microsoft Windows 10 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting Engine…
CVE-2017-8595HigJul 11, 2017
Microsoft
Edge
risk 0.49cvss 7.5epss 0.08
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render when handling objects in memory in Microsoft Edge, aka "Scripting…
CVE-2017-8594HigJul 11, 2017
Microsoft
Internet Explorer
risk 0.56cvss 7.5epss 0.50
Internet Explorer on Microsoft Windows 8.1 and Windows RT 8.1, and Windows Server 2012 R2 allows an attacker to execute arbitrary code in the context of the current user when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption…
CVE-2017-8590HigJul 11, 2017
Microsoft
Windows Server 2008
risk 0.57cvss 8.8epss 0.01
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to the way that the Windows Common Log File…
CVE-2017-8588HigJul 11, 2017
Microsoft
Windows Server 2008
risk 0.47cvss 7.0epss 0.17
Microsoft WordPad in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability due to the way it parses specially…
CVE-2017-8585HigJul 11, 2017
Microsoft
.net Framework
risk 0.50cvss 7.5epss 0.10
Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service, aka .NET Denial of Service Vulnerability.
CVE-2017-8584HigJul 11, 2017
Microsoft
Windows Server 2016
risk 0.49cvss 7.5epss 0.04
Windows 10 1607 and Windows Server 2016 allow an attacker to execute code remotely via a specially crafted WiFi packet aka "HoloLens Remote Code Execution Vulnerability."
CVE-2017-8581HigJul 11, 2017
Microsoft
Windows Server 2008
risk 0.46cvss 7.0epss 0.01
Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle…
CVE-2017-8580HigJul 11, 2017
Microsoft
Windows Server 2008
risk 0.46cvss 7.0epss 0.01
Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle…
CVE-2017-8578HigJul 11, 2017
Microsoft
Windows Server 2008
risk 0.51cvss 7.8epss 0.06
Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle…
CVE-2017-8577HigJul 11, 2017
Microsoft
Windows Server 2008
risk 0.46cvss 7.0epss 0.01
Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle…
CVE-2017-8574HigJul 11, 2017
Microsoft
Windows Server 2016
risk 0.46cvss 7.0epss 0.01
Graphics in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in memory, aka "Microsoft Graphics Component Elevation of Privilege Vulnerability". This CVE ID is unique from…
CVE-2017-8573HigJul 11, 2017
Microsoft
Windows Server 2008
risk 0.46cvss 7.0epss 0.01
Graphics in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle…
CVE-2017-8570HigKEVJul 11, 2017
Microsoft
Office
risk 0.73cvss 7.8epss 0.90
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0243.
CVE-2017-8569HigJul 11, 2017
Microsoft
Sharepoint Server
risk 0.58cvss 8.8epss 0.05
Microsoft SharePoint Server allows an elevation of privilege vulnerability due to the way that it sanitizes a specially crafted web request to an affected SharePoint server, aka "SharePoint Server XSS Vulnerability".
CVE-2017-8566HigJul 11, 2017
Microsoft
Windows Server 2016
risk 0.46cvss 7.0epss 0.01
Microsoft Windows 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to Windows Input Method Editor (IME) improperly handling parameters in a method of a DCOM class, aka "Windows IME Elevation of Privilege Vulnerability".