Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-28 15:02Z
2017-06-30
2017-06-30 03:29Z
CRIT

CVE-2017-7903 — Rockwellautomation 1763-l16awa_series_a: A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-7903

A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and CVSSv3.1 9.8 (CRITICAL) · EPSS 46th percentile

CWECWE 326CWECWE 521VNDWeakVNDRockwellautomationTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-06-30
2017-06-30 03:29Z
CRIT

CVE-2017-7898 — Rockwellautomation 1763-l16awa_series_a: There are no penalties for repeatedly entering incorrect passwords.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-7898

An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic contro CVSSv3.1 9.8 (CRITICAL) · EPSS 79th percentile

CWECWE 307VNDRockwellautomationTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-06-30
2017-06-30 03:29Z
CRIT

CVE-2017-6034 — Schneider-electric Modbus_firmware: An Authentication Bypass by Capture-Replay issue was discovered in Schneider Electric Modicon Modbus Protocol.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-6034

An Authentication Bypass by Capture-Replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the following commands: run, stop, upload, and download. CVSSv3.1 9.8 (CRITICAL) · EPSS 32th percentile

CWECWE 287CWECWE 294VNDSchneider ElectricTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-06-29
2017-06-29 23:29Z
CRIT

CVE-2017-10685 — Invisible-island Ncurses: A crafted input will lead to a remote arbitrary code execution attack.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-10685

In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack. CVSSv3.1 9.8 (CRITICAL) · EPSS 90th percentile

CWECWE 134VNDInvisible IslandTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2017-06-29
2017-06-29 23:29Z
CRIT

CVE-2017-10684 — Invisible-island Ncurses: In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-10684

In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack. CVSSv3.1 9.8 (CRITICAL) · EPSS 91th percentile

CWECWE 119VNDInvisible IslandTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2017-06-15
2017-06-15 01:29Z
MED

CVE-2017-8529 — Microsoft Internet_explorer: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-8529

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to detect specific files on the user's computer when affected Microsoft scripting engines do not properly handle objects in memory, aka "Microsoft Browser Information Disclosure Vulnerability". CVSSv3.1 6.5 (MEDIUM) · EPSS 97th percentile

CWECWE 119VNDMicrosoftVNDInternetTYPVulnerability
6.5
CVSS v3.1
87
Edit Score
2017-06-15
2017-06-15 01:29Z
HIGH

CVE-2017-8512 — Microsoft Office: A remote code execution vulnerability exists in Microsoft Office when the software fails to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-8512

A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8509, CVE-2017-8510, CVE-2017-8511, CVE-2017-0260, and CVE-2017-8506. CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile

VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
100
Edit Score
728 × 90 / responsive · programmatic ad slot
2017-06-15
2017-06-15 01:29Z
HIGH

CVE-2017-8509 — Microsoft Office: A remote code execution vulnerability exists in Microsoft Office when the software fails to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-8509

A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8510, CVE-2017-8511, CVE-2017-8512, CVE-2017-0260, and CVE-2017-8506. CVSSv3.1 8.8 (HIGH) · EPSS 97th percentile

VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
99
Edit Score
2017-06-13
2017-06-13 06:29Z
MED

CVE-2017-4971 — Broadcom Spring_web_flow: Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-4971

An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. CVSSv3.1 5.9 (MEDIUM) · EPSS 96th percentile

CWECWE 1188VNDBroadcomVNDPivotalTYPVulnerability
5.9
CVSS v3.1
83
Edit Score
2017-06-07
2017-06-07 15:29Z
HIGH

CVE-2017-7563 — Trustedfirmware Trusted_firmware-a: In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-7563

In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT_EXECUTE_NEVER protection mechanism. This issue occurs because of inconsistency in the number of execute-never bits (one bit versus two bits). CVSSv3.1 8.1 (HIGH) · EPSS 57th percentile

CWECWE 732VNDArmVNDTrustedfirmwareTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2017-06-06
2017-06-06 14:29Z
HIGH

CVE-2017-5664 — Apache Tomcat: Depending on the original request this could lead to unexpected and undesirable results for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-5664

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Defaul CVSSv3.1 7.5 (HIGH) · EPSS 97th percentile

CWECWE 755VNDApacheTYPVulnerability
7.5
CVSS v3.1
92
Edit Score
2017-05-23
2017-05-23 04:29Z
HIGH

CVE-2016-9842 — Zlib Zlib: The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9842

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers. CVSSv3.1 8.8 (HIGH) · EPSS 91th percentile

CWECWE 1335VNDZlibTYPVulnerability
8.8
CVSS v3.1
96
Edit Score
2017-05-23
2017-05-23 04:29Z
CRIT

CVE-2016-9841 — Zlib Zlib: inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9841

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVSSv3.1 9.8 (CRITICAL) · EPSS 94th percentile

VNDZlibTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2017-05-23
2017-05-23 04:29Z
HIGH

CVE-2016-9840 — Boost Boost: inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9840

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVSSv3.1 8.8 (HIGH) · EPSS 91th percentile

VNDBoostVNDZlibTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2017-05-12
2017-05-12 14:29Z
HIGH

CVE-2017-0281 — Microsoft Office: 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-0281

Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web Apps 2013 SP1, Project Server 2013 SP1, SharePoint Enterprise Server 2013 SP1, SharePoint Enterprise Server 2016, SharePoint Foundation 2013 SP1, Sharepoint Server 2010 SP2, Word 2016, and Skype for Business 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code CVSSv3.1 7.8 (HIGH) · EPSS 97th percentile

VNDMicrosoftTYPVulnerability
7.8
CVSS v3.1
94
Edit Score
2017-04-20
2017-04-20 18:59Z
HIGH

CVE-2017-2784 — Trustedfirmware Mbed_tls: A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-2784

An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vu CVSSv3.1 8.1 (HIGH) · EPSS 72th percentile

CWECWE 295VNDTrustedfirmwareTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2017-04-17
2017-04-17 21:59Z
CRIT

CVE-2017-5645 — Apache Log4j: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-5645

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 502VNDApacheVNDNetappTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2017-04-17
2017-04-17 16:59Z
CRIT

CVE-2017-5648 — Apache Tomcat: While investigating bug 60718, it was noticed that some calls to application listeners in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-5648

While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web app CVSSv3.1 9.1 (CRITICAL) · EPSS 96th percentile

CWECWE 668VNDApacheTYPVulnerability
9.1
CVSS v3.1
99
Edit Score
2017-04-11
2017-04-11 18:59Z
CRIT

CVE-2016-1908 — Openbsd Openssh: The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-1908

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server. CVSSv3.1 9.8 (CRITICAL) · EPSS 84th percentile

CWECWE 287VNDOracleVNDOpensshTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2017-04-06
2017-04-06 21:59Z
CRIT

CVE-2017-7575 — Schneider-electric Modicon_tm221ce16r_firmware: Schneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection password

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-7575

Schneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection password via a \x00\x01\x00\x00\x00\x05\x01\x5a\x00\x03\x00 request to the Modbus port (502/tcp). Subsequently the application may be arbitrarily downloaded, modified, and uploaded. CVSSv3.1 9.8 (CRITICAL) · EPSS 80th percentile

CWECWE 200VNDSchneider ElectricVNDSchneiderTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-04-06
2017-04-06 21:59Z
CRIT

CVE-2017-7574 — Schneider-electric Modicon_tm221ce16r_firmware: The Project Protection feature is used to prevent unauthorized users from opening an XML

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-7574

Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password ca CVSSv3.1 9.8 (CRITICAL) · EPSS 50th percentile

CWECWE 798CWECWE 321VNDSchneider ElectricVNDSchneiderTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-04-06
2017-04-06 21:59Z
CRIT

CVE-2016-8735 — Apache Tomcat: Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-8735in the wild

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

VNDApacheTYPVulnerabilitySTAitw exploited
9.8
CVSS v3.1
100
Edit Score
2017-04-06
2017-04-06 17:59Z
HIGH

CVE-2017-6884 — Zyxel Emg2926_firmware: A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-6884

A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI. CVSSv3.1 8.8 (HIGH)

CWECWE 78VNDZyxelTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-04-02
2017-04-02 20:59Z
HIGH

CVE-2015-8671 — Huawei Logcenter: V100R001C10 could allow an authenticated attacker to tamper with requests using a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-8671

Huawei LogCenter V100R001C10 could allow an authenticated attacker to tamper with requests using a tool and submit a request to the server for privilege escalation, affecting some system functions. CVSSv3.1 8.8 (HIGH)

CWECWE 264VNDHuaweiTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-04-02
2017-04-02 20:59Z
HIGH

CVE-2014-9696 — Huawei Tecal_e9000_chassis_firmware: The Hyper Module Management (HMM) software of Huawei Tecal E9000 Chassis V100R001C00SPC160 and earlier

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2014-9696

The Hyper Module Management (HMM) software of Huawei Tecal E9000 Chassis V100R001C00SPC160 and earlier versions allows the operator to modify the user configuration of iMana through privilege escalation. CVSSv3.1 8.8 (HIGH)

CWECWE 264VNDHuaweiVNDHyperTYPVulnerability
8.8
CVSS v3.1
94
Edit Score