Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-29 02:13Z
2017-03-09
2017-03-09 09:59Z
HIGH

CVE-2017-6549 — Asus Rt-ac53_firmware: Session hijack vulnerability in httpd on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-6549

Session hijack vulnerability in httpd on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC68P, RT-N11P, RT-N12+, RT-N12E B1, RT-AC3200, RT-AC53U, RT-AC1750, RT-AC1900P, RT-N300, and RT-AC750 routers with firmware before 3.0.0.4.380.7378; RT-AC68W routers with firmware before 3.0.0.4.380.7266; and RT-N600, RT-N12+ B1, RT-N11P B1, RT-N12VP B1, RT-N12E C1, RT-N300 B1, and RT-N12+ Pro routers with firmwa CVSSv3.1 8.8 (HIGH)

CWECWE 287VNDAsusTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-03-09
2017-03-09 09:59Z
CRIT

CVE-2017-6548 — Asus Rt-ac53_firmware: Buffer overflows in networkmap on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-6548

Buffer overflows in networkmap on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC68P, RT-N11P, RT-N12+, RT-N12E B1, RT-AC3200, RT-AC53U, RT-AC1750, RT-AC1900P, RT-N300, and RT-AC750 routers with firmware before 3.0.0.4.380.7378; RT-AC68W routers with firmware before 3.0.0.4.380.7266; and RT-N600, RT-N12+ B1, RT-N11P B1, RT-N12VP B1, RT-N12E C1, RT-N300 B1, and RT-N12+ Pro routers with firmware befo CVSSv3.1 9.8 (CRITICAL)

CWECWE 119VNDAsusVNDBufferTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-08
2017-03-08 08:59Z
CRIT

CVE-2017-5178 — Schneider-electric Tableau_desktop: The default system account could be used to gain unauthorized access.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-5178

An issue was discovered in Schneider Electric Tableau Server/Desktop Versions 7.0 to 10.1.3 in Wonderware Intelligence Versions 2014R3 and prior. These versions contain a system account that is installed by default. The default system account is difficult to configure with non-default credentials after installation, and changing the default credentials in the embedded Tableau Server is not documented. If Tableau Server is used with Windows integrated security (Active Director CVSSv3.1 9.8 (CRITICAL)

CWECWE 1188VNDSchneider ElectricVNDSchneiderTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-07
2017-03-07 17:59Z
HIGH

CVE-2016-9727 — Ibm Qradar_incident_forensics: QRadar 7.2 could allow a remote authenticated attacker to execute arbitrary commands on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9727

IBM QRadar 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM Reference #: 1999542. CVSSv3.1 8.5 (HIGH)

CWECWE 20VNDIbmTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2017-03-07
2017-03-07 17:59Z
HIGH

CVE-2016-9726 — Ibm Qradar_incident_forensics: QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9726

IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM Reference #: 1999542. CVSSv3.1 8.8 (HIGH)

CWECWE 20VNDIbmTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-03-07
2017-03-07 17:59Z
HIGH

CVE-2016-9724 — Ibm Qradar_security_information_and_event_manager: QRadar 7.2 is vulnerable to a denial of service, caused by an XML

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9724

IBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1999537. CVSSv3.1 8.1 (HIGH)

CWECWE 611VNDIbmTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2017-03-07
2017-03-07 17:59Z
HIGH

CVE-2016-8940 — Ibm Tivoli_storage_manager: The access of these product specific database tables may allow access to passwords or

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-8940

IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3, and 7.1 does not perform sufficient authority checking on SQL queries. As a result, an attacker is able to submit SQL queries that access database tables that are not intended for access or use by administrators. The access of these product specific database tables may allow access to passwords or other sensitive information for the product. IBM Reference #: 1998946. CVSSv3.1 8.8 (HIGH)

CWECWE 200VNDIbmTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2017-03-07
2017-03-07 16:59Z
CRIT

CVE-2016-9087 — Exponentcms Exponent_cms: SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9087

SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the fileid parameter. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDExponentcmsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-07
2017-03-07 16:59Z
CRIT

CVE-2016-9020 — Exponentcms Exponent_cms: SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9020

SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDExponentcmsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-07
2017-03-07 16:59Z
CRIT

CVE-2016-9019 — Exponentcms Exponent_cms: SQL injection vulnerability in the activate_address function in framework/modules/addressbook/controllers/addressController.php in Exponent CMS 2.3.9 and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-9019

SQL injection vulnerability in the activate_address function in framework/modules/addressbook/controllers/addressController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the is_what parameter. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDExponentcmsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-07
2017-03-07 16:59Z
CRIT

CVE-2016-8863 — Libupnp_project Libupnp: Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-8863

Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an SUBSCRIBE request. CVSSv3.1 9.8 (CRITICAL)

CWECWE 119VNDHeapVNDLibupnp ProjectTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-07
2017-03-07 16:59Z
CRIT

CVE-2016-7789 — Exponentcms Exponent_cms: SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-7789

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the apikey parameter. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDExponentcmsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-07
2017-03-07 16:59Z
CRIT

CVE-2016-7788 — Exponentcms Exponent_cms: SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-7788

SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDExponentcmsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-07
2017-03-07 16:59Z
CRIT

CVE-2016-7784 — Exponentcms Exponent_cms: SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-7784

SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the section parameter. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDExponentcmsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-07
2017-03-07 16:59Z
CRIT

CVE-2016-7783 — Exponentcms Exponent_cms: SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-7783

SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDExponentcmsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-07
2017-03-07 16:59Z
CRIT

CVE-2016-7782 — Exponentcms Exponent_cms: SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-7782

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the src parameter. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDExponentcmsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-07
2017-03-07 16:59Z
CRIT

CVE-2016-7781 — Exponentcms Exponent_cms: SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-7781

SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the author parameter. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDExponentcmsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-07
2017-03-07 16:59Z
CRIT

CVE-2016-7780 — Exponentcms Exponent_cms: SQL injection vulnerability in cron/find_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-7780

SQL injection vulnerability in cron/find_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter. CVSSv3.1 9.8 (CRITICAL)

CWECWE 89VNDExponentcmsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-07
2017-03-07 15:59Z
CRIT

CVE-2017-3159 — Apache Camel: Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-3159

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws. CVSSv3.1 9.8 (CRITICAL)

CWECWE 502VNDApacheTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-07
2017-03-07 15:59Z
CRIT

CVE-2016-7145 — Nefarious2_project Nefarious2: The m_authenticate function in ircd/m_authenticate.c in nefarious2 allows remote attackers to spoof certificate fingerprints

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-7145

The m_authenticate function in ircd/m_authenticate.c in nefarious2 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter. CVSSv3.1 9.8 (CRITICAL)

CWECWE 287VNDNefarious2 ProjectTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-06
2017-03-06 06:59Z
HIGH

CVE-2017-6411 — Dlink Dsl-2730u_firmware: Cross Site Request Forgery (CSRF) on D-Link DSL-2730U C1 IN_1.00 devices allows remote attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-6411

Cross Site Request Forgery (CSRF) on D-Link DSL-2730U C1 IN_1.00 devices allows remote attackers to change the DNS or firewall configuration or any password. CVSSv3.1 8.8 (HIGH)

CWECWE 352VNDDlinkTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2017-03-06
2017-03-06 06:59Z
HIGH

CVE-2017-5633 — D-link Di-524_firmware: Multiple cross-site request forgery (CSRF) vulnerabilities on the D-Link DI-524 Wireless Router with firmware

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-5633

Multiple cross-site request forgery (CSRF) vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to (1) change the admin password, (2) reboot the device, or (3) possibly have unspecified other impact via crafted requests to CGI programs. CVSSv3.1 8.0 (HIGH)

CWECWE 352VNDD LinkVNDCsrfTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2017-03-06
2017-03-06 02:59Z
CRIT

CVE-2017-6416 — Flexense Sysgauge: A buffer overflow vulnerability in SMTP connection verification leads to arbitrary code execution.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-6416

An issue was discovered in SysGauge 1.5.18. A buffer overflow vulnerability in SMTP connection verification leads to arbitrary code execution. The attack vector is a crafted SMTP daemon that sends a long 220 (aka "Service ready") string. CVSSv3.1 9.8 (CRITICAL)

CWECWE 119VNDSysgaugeVNDFlexenseTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2017-03-06
2017-03-06 02:59Z
HIGH

CVE-2017-6351 — Wepresent Wipg-1500_firmware: The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-6351

The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password. Once the device is set to DEBUG mode, an attacker can connect to the device using the telnet protocol and log into the device with the 'abarco' hardcoded manufacturer account. This account is not documented, nor is the DEBUG feature or the use of telnetd on port tcp/5885. CVSSv3.1 8.1 (HIGH)

CWECWE 798VNDWepresentTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2017-03-05
2017-03-05 20:59Z
HIGH

CVE-2017-6445 — Openelec Openelec: The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and 8.0.4

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2017-6445

The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and 8.0.4 uses neither encrypted connections nor signed updates. A man-in-the-middle attacker could manipulate the update packages to gain root access remotely. CVSSv3.1 8.1 (HIGH)

CWECWE 347CWECWE 311VNDOpenelecTYPVulnerability
8.1
CVSS v3.1
91
Edit Score