2017 CVEs (page 46)
Page 46 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-17623 | Critical | 9.8 | 2017-12-13 | Opensource Classified Ads Script 3.2 has SQL Injection via the advance_result.php keyword parameter. |
CVE-2017-17622 | Critical | 9.8 | 2017-12-13 | Online Exam Test Application Script 1.6 has SQL Injection via the exams.php sort parameter. |
CVE-2017-17621 | Critical | 9.8 | 2017-12-13 | Multivendor Penny Auction Clone Script 1.0 has SQL Injection via the PATH_INFO to the /detail URI. |
CVE-2017-17620 | Critical | 9.8 | 2017-12-13 | Lawyer Search Script 1.1 has SQL Injection via the /lawyer-list city parameter. |
CVE-2017-17619 | Critical | 9.8 | 2017-12-13 | Laundry Booking Script 1.0 has SQL Injection via the /list city parameter. |
CVE-2017-17618 | Critical | 9.8 | 2017-12-13 | Kickstarter Clone Script 2.0 has SQL Injection via the investcalc.php projid parameter. |
CVE-2017-17617 | Critical | 9.8 | 2017-12-13 | Foodspotting Clone Script 1.0 has SQL Injection via the quicksearch.php q parameter. |
CVE-2017-17616 | Critical | 9.8 | 2017-12-13 | Event Search Script 1.0 has SQL Injection via the /event-list city parameter. |
CVE-2017-17615 | High | 8.8 | 2017-12-13 | Facebook Clone Script 1.0 has SQL Injection via the friend-profile.php id parameter. |
CVE-2017-17614 | Critical | 9.8 | 2017-12-13 | Food Order Script 1.0 has SQL Injection via the /list city parameter. |
CVE-2017-17613 | Critical | 9.8 | 2017-12-13 | Freelance Website Script 2.0.6 has SQL Injection via the jobdetails.php pr_id parameter or the searchbycat_list.php catid parameter. |
CVE-2017-17612 | Critical | 9.8 | 2017-12-13 | Hot Scripts Clone 3.1 has SQL Injection via the /categories subctid or mctid parameter. |
CVE-2017-17611 | Critical | 9.8 | 2017-12-13 | Doctor Search Script 1.0 has SQL Injection via the /list city parameter. |
CVE-2017-17610 | Critical | 9.8 | 2017-12-13 | E-commerce MLM Software 1.0 has SQL Injection via the service_detail.php pid parameter, event_detail.php eventid parameter, or news_detail.php newid parameter. |
CVE-2017-17609 | Critical | 9.8 | 2017-12-13 | Chartered Accountant Booking Script 1.0 has SQL Injection via the /service-list city parameter. |
CVE-2017-17608 | Critical | 9.8 | 2017-12-13 | Child Care Script 1.0 has SQL Injection via the /list city parameter. |
CVE-2017-17607 | Critical | 9.8 | 2017-12-13 | CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail. |
CVE-2017-17606 | Critical | 9.8 | 2017-12-13 | Co-work Space Search Script 1.0 has SQL Injection via the /list city parameter. |
CVE-2017-17605 | Critical | 9.8 | 2017-12-13 | Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter. |
CVE-2017-17604 | Critical | 9.8 | 2017-12-13 | Entrepreneur Bus Booking Script 3.0.4 has SQL Injection via the booker_details.php sourcebus parameter. |
CVE-2017-17603 | Critical | 9.8 | 2017-12-13 | Advanced Real Estate Script 4.0.7 has SQL Injection via the search-results.php Projectmain, proj_type, searchtext, sell_price, or maxprice parameter. |
CVE-2017-17602 | Critical | 9.8 | 2017-12-13 | Advance B2B Script 2.1.3 has SQL Injection via the tradeshow-list-detail.php show_id or view-product.php pid parameter. |
CVE-2017-17601 | Critical | 9.8 | 2017-12-13 | Cab Booking Script 1.0 has SQL Injection via the /service-list city parameter. |
CVE-2017-17600 | Critical | 9.8 | 2017-12-13 | Basic B2B Script 2.0.8 has SQL Injection via the product_details.php id parameter. |
CVE-2017-17599 | Critical | 9.8 | 2017-12-13 | Advance Online Learning Management Script 3.1 has SQL Injection via the courselist.php subcatid or popcourseid parameter. |
CVE-2017-17598 | Critical | 9.8 | 2017-12-13 | Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter. |
CVE-2017-17597 | Critical | 9.8 | 2017-12-13 | Nearbuy Clone Script 3.2 has SQL Injection via the category_list.php search parameter. |
CVE-2017-17596 | Critical | 9.8 | 2017-12-13 | Entrepreneur Job Portal Script 2.0.6 has SQL Injection via the jobsearch_all.php rid1 parameter. |
CVE-2017-17595 | Critical | 9.8 | 2017-12-13 | Beauty Parlour Booking Script 1.0 has SQL Injection via the /list gender or city parameter. |
CVE-2017-17594 | Critical | 9.8 | 2017-12-13 | DomainSale PHP Script 1.0 has SQL Injection via the domain.php id parameter. |
CVE-2017-17593 | High | 7.5 | 2017-12-13 | Simple Chatting System 1.0 allows Arbitrary File Upload via view/my_profile.php, which places files under uploads/. |
CVE-2017-17592 | Critical | 9.8 | 2017-12-13 | Website Auction Marketplace 2.0.5 has SQL Injection via the search.php cat_id parameter. |
CVE-2017-17591 | Critical | 9.8 | 2017-12-13 | Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter. |
CVE-2017-17590 | Critical | 9.8 | 2017-12-13 | FS Stackoverflow Clone 1.0 has SQL Injection via the /question keywords parameter. |
CVE-2017-17589 | Critical | 9.8 | 2017-12-13 | FS Thumbtack Clone 1.0 has SQL Injection via the browse-category.php cat parameter or the browse-scategory.php sc parameter. |
CVE-2017-17588 | Critical | 9.8 | 2017-12-13 | FS IMDB Clone 1.0 has SQL Injection via the movie.php f parameter, tvshow.php s parameter, or show_misc_video.php id parameter. |
CVE-2017-17587 | Critical | 9.8 | 2017-12-13 | FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or company/index.php c parameter. |
CVE-2017-17586 | Critical | 9.8 | 2017-12-13 | FS Olx Clone 1.0 has SQL Injection via the subpage.php scat parameter or the message.php pid parameter. |
CVE-2017-17585 | Critical | 9.8 | 2017-12-13 | FS Monster Clone 1.0 has SQL Injection via the Employer_Details.php id parameter. |
CVE-2017-17584 | Critical | 9.8 | 2017-12-13 | FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php fl_orig or fl_dest parameter. |
CVE-2017-17583 | Critical | 9.8 | 2017-12-13 | FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter. |
CVE-2017-17582 | Critical | 9.8 | 2017-12-13 | FS Grubhub Clone 1.0 has SQL Injection via the /food keywords parameter. |
CVE-2017-17581 | Critical | 9.8 | 2017-12-13 | FS Quibids Clone 1.0 has SQL Injection via the itechd.php productid parameter. |
CVE-2017-17580 | Critical | 9.8 | 2017-12-13 | FS Linkedin Clone 1.0 has SQL Injection via the group.php grid parameter, profile.php fid parameter, or company_details.php id parameter. |
CVE-2017-17579 | Critical | 9.8 | 2017-12-13 | FS Freelancer Clone 1.0 has SQL Injection via the profile.php u parameter. |
CVE-2017-17578 | Critical | 9.8 | 2017-12-13 | FS Crowdfunding Script 1.0 has SQL Injection via the latest_news_details.php id parameter. |
CVE-2017-17577 | Critical | 9.8 | 2017-12-13 | FS Trademe Clone 1.0 has SQL Injection via the search_item.php search parameter or the general_item_details.php id parameter. |
CVE-2017-17576 | Critical | 9.8 | 2017-12-13 | FS Gigs Script 1.0 has SQL Injection via the browse-category.php cat parameter, browse-scategory.php sc parameter, or service-provider.php ser parameter. |
CVE-2017-17575 | Critical | 9.8 | 2017-12-13 | FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter. |
CVE-2017-17574 | Critical | 9.8 | 2017-12-13 | FS Care Clone 1.0 has SQL Injection via the searchJob.php jobType or jobFrequency parameter. |
CVE-2017-17573 | Critical | 9.8 | 2017-12-13 | FS Ebay Clone 1.0 has SQL Injection via the product.php id parameter, or the search.php category_id or sub_category_id parameter. |
CVE-2017-17572 | Critical | 9.8 | 2017-12-13 | FS Amazon Clone 1.0 has SQL Injection via the PATH_INFO to /VerAyari. |
CVE-2017-17571 | Critical | 9.8 | 2017-12-13 | FS Foodpanda Clone 1.0 has SQL Injection via the /food keywords parameter. |
CVE-2017-17570 | Critical | 9.8 | 2017-12-13 | FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php fl_orig or fl_dest parameter. |
CVE-2017-17569 | Medium | 6.1 | 2017-12-13 | Scubez Posty Readymade Classifieds has XSS via the admin/user_activate_submit.php ID parameter. |
CVE-2017-17568 | High | 7.5 | 2017-12-13 | Scubez Posty Readymade Classifieds has Incorrect Access Control for visiting admin/user_activate_submit.php (aka the backend PHP script), which might allow rem… |
CVE-2017-17567 | High | 7.5 | 2017-12-13 | Scubez Posty Readymade Classifieds has SQL Injection via the admin/user_activate_submit.php ID parameter. |
CVE-2017-17538 | High | 7.5 | 2017-12-13 | MikroTik v6.40.5 devices allow remote attackers to cause a denial of service via a flood of ICMP packets. |
CVE-2017-5534 | High | 8.8 | 2017-12-13 | The tibbr user profiles components of tibbr Community, and tibbr Enterprise expose a weakness in an improperly sandboxed third-party component. Affected releas… |
CVE-2017-5530 | High | 8.1 | 2017-12-13 | The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate… |
CVE-2017-4942 | Medium | 4.9 | 2017-12-13 | VMware AirWatch Console (AWC) contains a Broken Access Control vulnerability. Successful exploitation of this issue could result in end-user device details bei… |
CVE-2017-14362 | High | 7.3 | 2017-12-13 | Cross-Site Request Forgery vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability could be exploited to allow a… |
CVE-2017-14361 | High | 7.4 | 2017-12-13 | Man-In-The-Middle vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability could be exploited to allow a Man-in-t… |
CVE-2017-13099 | High | 7.5 | 2017-12-13 | wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover t… |
CVE-2017-13098 | High | 7.5 | 2017-12-13 | BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbach… |
CVE-2017-17566 | High | 7.8 | 2017-12-12 | An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode… |
CVE-2017-17565 | Medium | 5.6 | 2017-12-12 | An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in p… |
CVE-2017-17564 | High | 7.8 | 2017-12-12 | An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging inco… |
CVE-2017-17563 | High | 7.8 | 2017-12-12 | An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an i… |
CVE-2017-11939 | Medium | 6.5 | 2017-12-12 | Microsoft Office 2016 Click-to-Run (C2R) allows an information disclosure vulnerability due to the way Microsoft Office enforces DRM copy/paste permissions, ak… |
CVE-2017-11936 | High | 8.8 | 2017-12-12 | Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability due to the way web requests are handled, aka "Microsoft SharePoint E… |
CVE-2017-11935 | High | 7.8 | 2017-12-12 | Microsoft Office 2016 Click-to-Run (C2R) allows a remote code execution vulnerability due to the way files are handled in memory, aka "Microsoft Excel Remote C… |
CVE-2017-11934 | Medium | 5.5 | 2017-12-12 | Microsoft Office 2013 RT SP1, Microsoft Office 2013 SP1, and Microsoft Office 2016 allow an information disclosure vulnerability due to the way certain functio… |
CVE-2017-11932 | High | 8.1 | 2017-12-12 | Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access (OWA) validates web… |
CVE-2017-11930 | High | 7.5 | 2017-12-12 | ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Go… |
CVE-2017-11927 | Medium | 6.5 | 2017-12-12 | Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Serv… |
CVE-2017-11919 | Medium | 5.3 | 2017-12-12 | ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Windows 1… |
CVE-2017-11918 | High | 7.5 | 2017-12-12 | ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights as the curren… |
CVE-2017-11916 | High | 7.5 | 2017-12-12 | ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memor… |
CVE-2017-11914 | High | 7.5 | 2017-12-12 | ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights as the current user… |
CVE-2017-11913 | High | 7.5 | 2017-12-12 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511… |
CVE-2017-11912 | High | 7.5 | 2017-12-12 | ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and I… |
CVE-2017-11911 | High | 7.5 | 2017-12-12 | ChakraCore and Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due… |
CVE-2017-11910 | High | 7.5 | 2017-12-12 | ChakraCore and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user… |
CVE-2017-11909 | High | 7.5 | 2017-12-12 | ChakraCore and Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due… |
CVE-2017-11908 | High | 7.5 | 2017-12-12 | ChakraCore and Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects… |
CVE-2017-11907 | High | 7.5 | 2017-12-12 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511… |
CVE-2017-11906 | Medium | 5.3 | 2017-12-12 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold… |
CVE-2017-11905 | High | 7.5 | 2017-12-12 | ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the… |
CVE-2017-11903 | High | 7.5 | 2017-12-12 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511… |
CVE-2017-11901 | High | 7.5 | 2017-12-12 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 16… |
CVE-2017-11899 | Critical | 9.8 | 2017-12-12 | Device Guard in Windows 10 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows a security feature bypass vulnerability due t… |
CVE-2017-11895 | High | 7.5 | 2017-12-12 | ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Internet… |
CVE-2017-11894 | High | 7.5 | 2017-12-12 | ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and a… |
CVE-2017-11893 | High | 7.5 | 2017-12-12 | ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the… |
CVE-2017-11890 | High | 7.5 | 2017-12-12 | Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, a… |
CVE-2017-11889 | High | 7.5 | 2017-12-12 | ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context o… |
CVE-2017-11888 | High | 7.5 | 2017-12-12 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the… |
CVE-2017-11887 | Medium | 5.3 | 2017-12-12 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Go… |
CVE-2017-11886 | High | 7.5 | 2017-12-12 | Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, a… |