Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-28 14:19Z
2017-12-11
2017-12-11 06:29Z
HIGH

CVE-2017-17512 — Sensible-utils_project Sensible-utils: sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-17512

sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument. CVSSv3.1 8.8 (HIGH) · EPSS 82th percentile

CWECWE 74VNDSensible Utils ProjectTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2017-11-23
2017-11-23 21:29Z
CRIT

CVE-2017-16931 — Xmlsoft Libxml2: parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-16931

parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name. CVSSv3.1 9.8 (CRITICAL) · EPSS 91th percentile

CWECWE 119VNDXmlsoftTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2017-11-17
2017-11-17 05:29Z
CRIT

CVE-2017-1000158 — Python Python: CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-1000158

CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution) CVSSv3.1 9.8 (CRITICAL) · EPSS 95th percentile

CWECWE 190VNDCpythonTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2017-11-16
2017-11-16 21:29Z
HIGH

CVE-2017-16715 — Moxa Nport_5110_firmware: An attacker may be able to exploit a flaw in the handling of Ethernet

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-16715

An Information Exposure issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior. An attacker may be able to exploit a flaw in the handling of Ethernet frame padding that may allow for information exposure. CVSSv3.1 8.6 (HIGH) · EPSS 48th percentile

CWECWE 200VNDInformationVNDMoxaTYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2017-11-16
2017-11-16 07:29Z
HIGH

CVE-2017-12350 — Cisco Umbrella_virtual_appliance: A vulnerability in Cisco Umbrella Insights Virtual Appliances 2.1.0 and earlier could allow an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-12350

A vulnerability in Cisco Umbrella Insights Virtual Appliances 2.1.0 and earlier could allow an authenticated, local attacker to log in to an affected virtual appliance with root privileges. The vulnerability is due to the presence of default, static user credentials for an affected virtual appliance. An attacker could exploit this vulnerability by using the hypervisor console to connect locally to an affected system and then using the static credentials to log in to an affect CVSSv3.1 8.2 (HIGH) · EPSS 27th percentile

CWECWE 798VNDCiscoTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2017-11-02
2017-11-02 17:29Z
HIGH

CVE-2017-11508 — Tenable Security_center: SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-11508

SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient privileges to run diagnostic scans. An attacker could exploit this vulnerability by entering a crafted SQL query into the password field of a diagnostic scan within SecurityCenter. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access. CVSSv3.1 8.8 (HIGH) · EPSS 66th percentile

CWECWE 89VNDTenableVNDSecuritycenterTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-10-19
2017-10-19 17:29Z
HIGH

CVE-2017-10271 — Oracle Weblogic_server: Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-10271in the wild

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Ve CVSSv3.1 7.5 (HIGH) · EPSS 100th percentile

CWECWE 306VNDOracleVNDVulnerabilityTYPVulnerabilitySTAitw exploited
7.5
CVSS v3.1
100
Edit Score
728 × 90 / responsive · programmatic ad slot
2017-10-04
2017-10-04 21:01Z
CRIT

CVE-2017-12149 — Redhat Jboss_enterprise_application_platform: In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-12149in the wild

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 502VNDJbossTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2017-10-04
2017-10-04 01:29Z
HIGH

CVE-2017-12617 — Apache Tomcat: When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-12617in the wild

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. CVSSv3.1 8.1 (HIGH) · EPSS 100th percentile

CWECWE 434VNDApacheVNDCanonicalTYPVulnerabilitySTAitw exploited
8.1
CVSS v3.1
100
Edit Score
2017-09-19
2017-09-19 13:29Z
HIGH

CVE-2017-12616 — Apache Tomcat: When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-12616

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request. CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile

CWECWE 200VNDApacheVNDVirtualdircontextTYPVulnerability
7.5
CVSS v3.1
100
Edit Score
2017-09-19
2017-09-19 13:29Z
HIGH

CVE-2017-12615 — Apache Tomcat: When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-12615in the wild

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. CVSSv3.1 8.1 (HIGH) · EPSS 100th percentile

CWECWE 434VNDApacheVNDNetappTYPVulnerabilitySTAitw exploited
8.1
CVSS v3.1
100
Edit Score
2017-08-30
2017-08-30 20:29Z
HIGH

CVE-2017-14032 — Arm Mbed_tls: mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-14032

ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected. CVSSv3.1 8.1 (HIGH) · EPSS 51th percentile

CWECWE 287VNDArmTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2017-08-10
2017-08-10 16:29Z
CRIT

CVE-2016-5018 — Apache Tomcat: In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-5018

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications. CVSSv3.1 9.1 (CRITICAL) · EPSS 96th percentile

VNDApacheTYPVulnerability
9.1
CVSS v3.1
99
Edit Score
2017-08-09
2017-08-09 18:29Z
HIGH

CVE-2015-2291 — Intel Ethernet_diagnostics_driver_iqvw32.sys: (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-2291in the wild

(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call. CVSSv3.1 7.8 (HIGH) · EPSS 95th percentile

CWECWE 20VNDIntelVNDIqvw32TYPVulnerabilitySTAitw exploited
7.8
CVSS v3.1
92
Edit Score
2017-07-25
2017-07-25 20:29Z
HIGH

CVE-2017-9233 — Libexpat_project Libexpat: XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-9233

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD. CVSSv3.1 7.5 (HIGH) · EPSS 95th percentile

CWECWE 611CWECWE 835VNDLibexpat ProjectTYPVulnerability
7.5
CVSS v3.1
90
Edit Score
2017-07-17
2017-07-17 13:18Z
CRIT

CVE-2017-11349 — Thermofisher Dt8x_firmware: dataTaker DT8x dEX 1.72.007 allows remote attackers to compose programs or schedules, for purposes

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-11349

dataTaker DT8x dEX 1.72.007 allows remote attackers to compose programs or schedules, for purposes such as sending e-mail messages or making outbound connections to FTP servers for uploading data. CVSSv3.1 9.8 (CRITICAL) · EPSS 70th percentile

CWECWE 522VNDThermofisherVNDDt8xTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-07-12
2017-07-12 12:29Z
CRIT

CVE-2017-11165 — Thermofisher Dt80_dex_firmware: dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-11165

dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 200VNDThermofisherVNDDt80TYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2017-06-30
2017-06-30 03:29Z
CRIT

CVE-2017-7903 — Rockwellautomation 1763-l16awa_series_a: A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-7903

A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and CVSSv3.1 9.8 (CRITICAL) · EPSS 46th percentile

CWECWE 326CWECWE 521VNDWeakVNDRockwellautomationTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-06-30
2017-06-30 03:29Z
CRIT

CVE-2017-7898 — Rockwellautomation 1763-l16awa_series_a: There are no penalties for repeatedly entering incorrect passwords.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-7898

An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic contro CVSSv3.1 9.8 (CRITICAL) · EPSS 79th percentile

CWECWE 307VNDRockwellautomationTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-06-30
2017-06-30 03:29Z
CRIT

CVE-2017-6034 — Schneider-electric Modbus_firmware: An Authentication Bypass by Capture-Replay issue was discovered in Schneider Electric Modicon Modbus Protocol.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-6034

An Authentication Bypass by Capture-Replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the following commands: run, stop, upload, and download. CVSSv3.1 9.8 (CRITICAL) · EPSS 32th percentile

CWECWE 287CWECWE 294VNDSchneider ElectricTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-06-29
2017-06-29 23:29Z
CRIT

CVE-2017-10685 — Invisible-island Ncurses: A crafted input will lead to a remote arbitrary code execution attack.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-10685

In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack. CVSSv3.1 9.8 (CRITICAL) · EPSS 90th percentile

CWECWE 134VNDInvisible IslandTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2017-06-29
2017-06-29 23:29Z
CRIT

CVE-2017-10684 — Invisible-island Ncurses: In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-10684

In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack. CVSSv3.1 9.8 (CRITICAL) · EPSS 91th percentile

CWECWE 119VNDInvisible IslandTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2017-06-15
2017-06-15 01:29Z
MED

CVE-2017-8529 — Microsoft Internet_explorer: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-8529

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to detect specific files on the user's computer when affected Microsoft scripting engines do not properly handle objects in memory, aka "Microsoft Browser Information Disclosure Vulnerability". CVSSv3.1 6.5 (MEDIUM) · EPSS 97th percentile

CWECWE 119VNDMicrosoftVNDInternetTYPVulnerability
6.5
CVSS v3.1
87
Edit Score
2017-06-15
2017-06-15 01:29Z
HIGH

CVE-2017-8512 — Microsoft Office: A remote code execution vulnerability exists in Microsoft Office when the software fails to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-8512

A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8509, CVE-2017-8510, CVE-2017-8511, CVE-2017-0260, and CVE-2017-8506. CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile

VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
100
Edit Score
2017-06-15
2017-06-15 01:29Z
HIGH

CVE-2017-8509 — Microsoft Office: A remote code execution vulnerability exists in Microsoft Office when the software fails to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-8509

A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8510, CVE-2017-8511, CVE-2017-8512, CVE-2017-0260, and CVE-2017-8506. CVSSv3.1 8.8 (HIGH) · EPSS 97th percentile

VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
99
Edit Score