CVEs

401,567 total · page 6334 of 8,032

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2017-7644	Paloaltonetworks Panos	Med	0.42	6.5	0.01	Apr 29, 2017	The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, and 7.1.x before 7.1.9 allows remote authenticated users to obtain sensitive information by leveraging incorrect permission validation, aka PAN-SA-2017-0013 and PAN-70541.
CVE-2017-6250	Nvidia Geforce Experience	Hig	0.57	8.8	0.00	Apr 28, 2017	NVIDIA GeForce Experience contains a vulnerability in NVIDIA Web Helper.exe, where untrusted script execution may lead to violation of application execution policy and local code execution.
CVE-2016-8593	Trend Micro Threat Discovery Appliance	Hig	0.58	8.8	0.07	Apr 28, 2017	Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. (dot dot) in the dID parameter.
CVE-2016-8592	Trend Micro Threat Discovery Appliance	Hig	0.58	8.8	0.06	Apr 28, 2017	log_query_system.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
CVE-2016-8591	Trend Micro Threat Discovery Appliance	Hig	0.58	8.8	0.06	Apr 28, 2017	log_query.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
CVE-2016-8590	Trend Micro Threat Discovery Appliance	Hig	0.58	8.8	0.06	Apr 28, 2017	log_query_dlp.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
CVE-2016-8589	Trend Micro Threat Discovery Appliance	Hig	0.58	8.8	0.06	Apr 28, 2017	log_query_dae.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
CVE-2016-8588	Trend Micro Threat Discovery Appliance	Hig	0.48	7.3	0.02	Apr 28, 2017	The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.
CVE-2016-8587	Trend Micro Threat Discovery Appliance	Hig	0.48	7.3	0.02	Apr 28, 2017	dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to /eng_ptn_stores/prod/sensorSDK/data/ or /eng_ptn_stores/prod/sensorSDK/backup_pol/.
CVE-2016-8586	Trend Micro Threat Discovery Appliance	Hig	0.58	8.8	0.06	Apr 28, 2017	detected_potential_files.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
CVE-2016-8585	Trend Micro Threat Discovery Appliance	Hig	0.58	8.8	0.07	Apr 28, 2017	admin_sys_time.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the timezone parameter.
CVE-2016-8584	Trend Micro Threat Discovery Appliance	Cri	0.64	9.8	0.06	Apr 28, 2017	Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which allows remote attackers to bypass authentication by guessing the value.
CVE-2017-1194	IBM Websphere Application Server	Hig	0.57	8.8	0.01	Apr 28, 2017	IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 123669.
CVE-2017-1141	IBM Insights Foundation For Energy	Med	0.28	4.3	0.01	Apr 28, 2017	IBM Insights Foundation for Energy 1.0, 1.5, and 1.6 could allow an authenticated user to obtain sensitive information from error messages. IBM X-Force ID: 121907.
CVE-2017-2156	Vivaldi Vivaldi Installer For Windows	Hig	0.51	7.8	0.03	Apr 28, 2017	Untrusted search path vulnerability in Vivaldi installer for Windows prior to version 1.7.735.48 allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory.
CVE-2017-2155	Hoozin Viewer	Hig	0.57	8.8	0.03	Apr 28, 2017	Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage.
CVE-2017-2154	Hanako Hanako 2017	Hig	0.51	7.8	0.01	Apr 28, 2017	Untrusted search path vulnerability in Hanako 2017, Hanako 2016, Hanako 2015, Hanako Pro 3, JUST Office 3 [Standard], JUST Office 3 [Eco Print Package], JUST Office 3 & Tri-De DataProtect Package, JUST Government 3, JUST Jump Class 2, JUST Frontier 3, JUST School 6 Premium,…
CVE-2017-2153	Seil SEIL/x86 Fuji	Hig	0.49	7.5	0.02	Apr 28, 2017	SEIL/x86 Fuji 1.70 to 5.62, SEIL/BPV4 5.00 to 5.62, SEIL/X1 1.30 to 5.62, SEIL/X2 1.30 to 5.62, SEIL/B1 1.00 to 5.62 allows remote attackers to cause a denial of service via specially crafted IPv4 UDP packets.
CVE-2017-2152	WNC WNC01WH	Med	0.44	6.8	0.01	Apr 28, 2017	WNC01WH firmware 1.0.0.9 and earlier allows authenticated attackers to execute arbitrary OS commands via unspecified vectors.
CVE-2017-2151	Wpdevart Booking Calendar	Med	0.40	6.1	0.01	Apr 28, 2017	Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2150	Booking Calendar Booking Calendar	Med	0.35	5.3	0.02	Apr 28, 2017	Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captcha_chalange parameter.
CVE-2017-2149	Toshiba Flashair	Hig	0.57	8.8	0.03	Apr 28, 2017	Untrusted search path vulnerability in installers of the software for SDHC/SDXC Memory Card with embedded NFC functionality Software Update Tool V1.00.03 and earlier, SDHC Memory Card with embedded wireless LAN functionality FlashAir Configuration Software V3.0.2 and earlier,…
CVE-2017-2148	WN AC1167GR WN-AC1167GR	Med	0.35	5.4	0.01	Apr 28, 2017	Cross-site scripting vulnerability in WN-AC1167GR firmware version 1.04 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2147	Wp Statistics Wp Statistics	Med	0.40	6.1	0.01	Apr 28, 2017	Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2143	Office Ocx CS-Cart Japanese Edition	Med	0.35	5.3	0.01	Apr 28, 2017	CS-Cart Japanese Edition v4.3.10-jp-1 and earlier, CS-Cart Multivendor Japanese Edition v4.3.10-jp-1 and earlier allows remote attackers to bypass access restriction to create a request to return a customer purchased item via rma.post.php.
CVE-2017-2142	I-O DATA WN-G300R3	Cri	0.64	9.8	0.03	Apr 28, 2017	Buffer overflow in WN-G300R3 firmware Ver.1.03 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVE-2017-2141	I-O DATA WN-G300R3	Hig	0.47	7.2	0.02	Apr 28, 2017	WN-G300R3 firmware 1.03 and earlier allows attackers with administrator rights to execute arbitrary OS commands via unspecified vectors.
CVE-2017-2140	Tablacus Explorer	Hig	0.57	8.8	0.01	Apr 28, 2017	Tablacus Explorer 17.3.30 and earlier allows arbitrary scripts to be executed in the context of the application due to specially crafted directory.
CVE-2017-2139	Office Ocx CS-Cart Japanese Edition	Med	0.35	5.3	0.01	Apr 28, 2017	CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to bypass access restriction to obtain customer information via orders.pre.php.
CVE-2017-2137	Netgear Prosafe Plus Configuration Utility	Low	0.24	3.7	0.01	Apr 28, 2017	ProSAFE Plus Configuration Utility prior to 2.3.29 allows remote attackers to bypass access restriction and change configurations of the switch via SOAP requests.
CVE-2017-2136	Wp Statistics Wp Statistics	Med	0.40	6.1	0.03	Apr 28, 2017	Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.
CVE-2017-2135	Wp Statistics Wp Statistics	Med	0.40	6.1	0.02	Apr 28, 2017	Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2134	ASSETBASE ASSETBASE	Med	0.40	6.1	0.01	Apr 28, 2017	Cross-site scripting vulnerability in ASSETBASE 8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2130	PhishWall Client PhishWall Client	Hig	0.51	7.8	0.02	Apr 28, 2017	Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer version Ver. 3.7.13 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2017-2128	Information Technology Promotion Agency Introduction To Safe Website Operation	Hig	0.57	8.8	0.02	Apr 28, 2017	Security guide for website operators allows remote attackers to execute arbitrary OS commands via specially crafted saved data.
CVE-2017-2127	Yop Poll Yop Poll	Med	0.35	5.4	0.01	Apr 28, 2017	Cross-site scripting vulnerability in YOP Poll versions prior to 5.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2125	Allied Telesis CentreCOM AR260S V2	Hig	0.57	8.8	0.02	Apr 28, 2017	Privilege escalation vulnerability in CentreCOM AR260S V2 remote authenticated attackers to gain privileges via the guest account.
CVE-2017-2124	Onethird CMS	Med	0.40	6.1	0.01	Apr 28, 2017	Cross-site scripting vulnerability in OneThird CMS v1.73 Heaven's Door and earlier allows remote attackers to inject arbitrary web script or HTML via contact.php.
CVE-2017-2123	Onethird CMS	Med	0.40	6.1	0.01	Apr 28, 2017	Cross-site scripting vulnerability in OneThird CMS v1.73 Heaven's Door and earlier allows remote attackers to inject arbitrary web script or HTML via language.php.
CVE-2017-2120	Wbce Wbce CMS	Hig	0.47	7.2	0.01	Apr 28, 2017	SQL injection vulnerability in the WBCE CMS 1.1.10 and earlier allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.
CVE-2017-2119	Wbce Wbce CMS	Hig	0.56	8.6	0.04	Apr 28, 2017	Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
CVE-2017-2118	Wbce Wbce CMS	Med	0.40	6.1	0.01	Apr 28, 2017	Cross-site scripting vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2117	Cubecart Cubecart	Med	0.32	4.9	0.02	Apr 28, 2017	Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via unspecified vectors.
CVE-2017-2116	Cybozu Office	Med	0.28	4.3	0.01	Apr 28, 2017	Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors.
CVE-2017-2115	Cybozu Office	Med	0.28	4.3	0.01	Apr 28, 2017	Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to obtain "customapp" information via unspecified vectors.
CVE-2017-2114	Cybozu Office	Med	0.35	5.4	0.01	Apr 28, 2017	Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2113	I-O DATA TS-WLC2	Hig	0.57	8.8	0.02	Apr 28, 2017	Buffer overflow in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18 and earlier,…
CVE-2017-2112	I-O DATA TS-WLC2	Hig	0.57	8.8	0.02	Apr 28, 2017	TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18 and earlier, TS-PTCAM/POE firmware…
CVE-2017-2111	I-O DATA TS-WLC2	Med	0.40	6.1	0.01	Apr 28, 2017	HTTP header injection vulnerability in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18…
CVE-2017-2110	Access CX App Access CX App	Med	0.38	5.9	0.01	Apr 28, 2017	The Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2017-7644MedApr 29, 2017
Paloaltonetworks
Panos
risk 0.42cvss 6.5epss 0.01
The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, and 7.1.x before 7.1.9 allows remote authenticated users to obtain sensitive information by leveraging incorrect permission validation, aka PAN-SA-2017-0013 and PAN-70541.
CVE-2017-6250HigApr 28, 2017
Nvidia
Geforce Experience
risk 0.57cvss 8.8epss 0.00
NVIDIA GeForce Experience contains a vulnerability in NVIDIA Web Helper.exe, where untrusted script execution may lead to violation of application execution policy and local code execution.
CVE-2016-8593HigApr 28, 2017
Trend Micro
Threat Discovery Appliance
risk 0.58cvss 8.8epss 0.07
Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. (dot dot) in the dID parameter.
CVE-2016-8592HigApr 28, 2017
Trend Micro
Threat Discovery Appliance
risk 0.58cvss 8.8epss 0.06
log_query_system.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
CVE-2016-8591HigApr 28, 2017
Trend Micro
Threat Discovery Appliance
risk 0.58cvss 8.8epss 0.06
log_query.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
CVE-2016-8590HigApr 28, 2017
Trend Micro
Threat Discovery Appliance
risk 0.58cvss 8.8epss 0.06
log_query_dlp.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
CVE-2016-8589HigApr 28, 2017
Trend Micro
Threat Discovery Appliance
risk 0.58cvss 8.8epss 0.06
log_query_dae.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
CVE-2016-8588HigApr 28, 2017
Trend Micro
Threat Discovery Appliance
risk 0.48cvss 7.3epss 0.02
The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.
CVE-2016-8587HigApr 28, 2017
Trend Micro
Threat Discovery Appliance
risk 0.48cvss 7.3epss 0.02
dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to /eng_ptn_stores/prod/sensorSDK/data/ or /eng_ptn_stores/prod/sensorSDK/backup_pol/.
CVE-2016-8586HigApr 28, 2017
Trend Micro
Threat Discovery Appliance
risk 0.58cvss 8.8epss 0.06
detected_potential_files.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
CVE-2016-8585HigApr 28, 2017
Trend Micro
Threat Discovery Appliance
risk 0.58cvss 8.8epss 0.07
admin_sys_time.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the timezone parameter.
CVE-2016-8584CriApr 28, 2017
Trend Micro
Threat Discovery Appliance
risk 0.64cvss 9.8epss 0.06
Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which allows remote attackers to bypass authentication by guessing the value.
CVE-2017-1194HigApr 28, 2017
IBM
Websphere Application Server
risk 0.57cvss 8.8epss 0.01
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 123669.
CVE-2017-1141MedApr 28, 2017
IBM
Insights Foundation For Energy
risk 0.28cvss 4.3epss 0.01
IBM Insights Foundation for Energy 1.0, 1.5, and 1.6 could allow an authenticated user to obtain sensitive information from error messages. IBM X-Force ID: 121907.
CVE-2017-2156HigApr 28, 2017
Vivaldi
Vivaldi Installer For Windows
risk 0.51cvss 7.8epss 0.03
Untrusted search path vulnerability in Vivaldi installer for Windows prior to version 1.7.735.48 allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory.
CVE-2017-2155HigApr 28, 2017
Hoozin
Viewer
risk 0.57cvss 8.8epss 0.03
Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code via specially crafted webpage.
CVE-2017-2154HigApr 28, 2017
Hanako
Hanako 2017
risk 0.51cvss 7.8epss 0.01
Untrusted search path vulnerability in Hanako 2017, Hanako 2016, Hanako 2015, Hanako Pro 3, JUST Office 3 [Standard], JUST Office 3 [Eco Print Package], JUST Office 3 & Tri-De DataProtect Package, JUST Government 3, JUST Jump Class 2, JUST Frontier 3, JUST School 6 Premium,…
CVE-2017-2153HigApr 28, 2017
Seil
SEIL/x86 Fuji
risk 0.49cvss 7.5epss 0.02
SEIL/x86 Fuji 1.70 to 5.62, SEIL/BPV4 5.00 to 5.62, SEIL/X1 1.30 to 5.62, SEIL/X2 1.30 to 5.62, SEIL/B1 1.00 to 5.62 allows remote attackers to cause a denial of service via specially crafted IPv4 UDP packets.
CVE-2017-2152MedApr 28, 2017
WNC
WNC01WH
risk 0.44cvss 6.8epss 0.01
WNC01WH firmware 1.0.0.9 and earlier allows authenticated attackers to execute arbitrary OS commands via unspecified vectors.
CVE-2017-2151MedApr 28, 2017
Wpdevart
Booking Calendar
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2150MedApr 28, 2017
Booking Calendar
Booking Calendar
risk 0.35cvss 5.3epss 0.02
Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captcha_chalange parameter.
CVE-2017-2149HigApr 28, 2017
Toshiba
Flashair
risk 0.57cvss 8.8epss 0.03
Untrusted search path vulnerability in installers of the software for SDHC/SDXC Memory Card with embedded NFC functionality Software Update Tool V1.00.03 and earlier, SDHC Memory Card with embedded wireless LAN functionality FlashAir Configuration Software V3.0.2 and earlier,…
CVE-2017-2148MedApr 28, 2017
WN AC1167GR
WN-AC1167GR
risk 0.35cvss 5.4epss 0.01
Cross-site scripting vulnerability in WN-AC1167GR firmware version 1.04 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2147MedApr 28, 2017
Wp Statistics
Wp Statistics
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2143MedApr 28, 2017
Office Ocx
CS-Cart Japanese Edition
risk 0.35cvss 5.3epss 0.01
CS-Cart Japanese Edition v4.3.10-jp-1 and earlier, CS-Cart Multivendor Japanese Edition v4.3.10-jp-1 and earlier allows remote attackers to bypass access restriction to create a request to return a customer purchased item via rma.post.php.
CVE-2017-2142CriApr 28, 2017
I-O DATA
WN-G300R3
risk 0.64cvss 9.8epss 0.03
Buffer overflow in WN-G300R3 firmware Ver.1.03 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVE-2017-2141HigApr 28, 2017
I-O DATA
WN-G300R3
risk 0.47cvss 7.2epss 0.02
WN-G300R3 firmware 1.03 and earlier allows attackers with administrator rights to execute arbitrary OS commands via unspecified vectors.
CVE-2017-2140HigApr 28, 2017
Tablacus
Explorer
risk 0.57cvss 8.8epss 0.01
Tablacus Explorer 17.3.30 and earlier allows arbitrary scripts to be executed in the context of the application due to specially crafted directory.
CVE-2017-2139MedApr 28, 2017
Office Ocx
CS-Cart Japanese Edition
risk 0.35cvss 5.3epss 0.01
CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to bypass access restriction to obtain customer information via orders.pre.php.
CVE-2017-2137LowApr 28, 2017
Netgear
Prosafe Plus Configuration Utility
risk 0.24cvss 3.7epss 0.01
ProSAFE Plus Configuration Utility prior to 2.3.29 allows remote attackers to bypass access restriction and change configurations of the switch via SOAP requests.
CVE-2017-2136MedApr 28, 2017
Wp Statistics
Wp Statistics
risk 0.40cvss 6.1epss 0.03
Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.
CVE-2017-2135MedApr 28, 2017
Wp Statistics
Wp Statistics
risk 0.40cvss 6.1epss 0.02
Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2134MedApr 28, 2017
ASSETBASE
ASSETBASE
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in ASSETBASE 8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2130HigApr 28, 2017
PhishWall Client
PhishWall Client
risk 0.51cvss 7.8epss 0.02
Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer version Ver. 3.7.13 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2017-2128HigApr 28, 2017
Information Technology Promotion Agency
Introduction To Safe Website Operation
risk 0.57cvss 8.8epss 0.02
Security guide for website operators allows remote attackers to execute arbitrary OS commands via specially crafted saved data.
CVE-2017-2127MedApr 28, 2017
Yop Poll
Yop Poll
risk 0.35cvss 5.4epss 0.01
Cross-site scripting vulnerability in YOP Poll versions prior to 5.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2125HigApr 28, 2017
Allied Telesis
CentreCOM AR260S V2
risk 0.57cvss 8.8epss 0.02
Privilege escalation vulnerability in CentreCOM AR260S V2 remote authenticated attackers to gain privileges via the guest account.
CVE-2017-2124MedApr 28, 2017
Onethird
CMS
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in OneThird CMS v1.73 Heaven's Door and earlier allows remote attackers to inject arbitrary web script or HTML via contact.php.
CVE-2017-2123MedApr 28, 2017
Onethird
CMS
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in OneThird CMS v1.73 Heaven's Door and earlier allows remote attackers to inject arbitrary web script or HTML via language.php.
CVE-2017-2120HigApr 28, 2017
Wbce
Wbce CMS
risk 0.47cvss 7.2epss 0.01
SQL injection vulnerability in the WBCE CMS 1.1.10 and earlier allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.
CVE-2017-2119HigApr 28, 2017
Wbce
Wbce CMS
risk 0.56cvss 8.6epss 0.04
Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
CVE-2017-2118MedApr 28, 2017
Wbce
Wbce CMS
risk 0.40cvss 6.1epss 0.01
Cross-site scripting vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2117MedApr 28, 2017
Cubecart
Cubecart
risk 0.32cvss 4.9epss 0.02
Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via unspecified vectors.
CVE-2017-2116MedApr 28, 2017
Cybozu
Office
risk 0.28cvss 4.3epss 0.01
Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors.
CVE-2017-2115MedApr 28, 2017
Cybozu
Office
risk 0.28cvss 4.3epss 0.01
Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to obtain "customapp" information via unspecified vectors.
CVE-2017-2114MedApr 28, 2017
Cybozu
Office
risk 0.35cvss 5.4epss 0.01
Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-2113HigApr 28, 2017
I-O DATA
TS-WLC2
risk 0.57cvss 8.8epss 0.02
Buffer overflow in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18 and earlier,…
CVE-2017-2112HigApr 28, 2017
I-O DATA
TS-WLC2
risk 0.57cvss 8.8epss 0.02
TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18 and earlier, TS-PTCAM/POE firmware…
CVE-2017-2111MedApr 28, 2017
I-O DATA
TS-WLC2
risk 0.40cvss 6.1epss 0.01
HTTP header injection vulnerability in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18…
CVE-2017-2110MedApr 28, 2017
Access CX App
Access CX App
risk 0.38cvss 5.9epss 0.01
The Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.