|
257941
|
8.8 |
HIGH
Network
|
graphicsmagick
debian
|
graphicsmagick
debian_linux
|
GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overflow vulnerability found in the "Display visual image directory" feature of the DescribeImage() function of the magick/describe.c file. …
|
CWE-119
Incorrect Access of Indexable Resource ('Range Error')
|
CVE-2017-16352
|
2024-11-21 12:16 |
2017-11-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
257942
|
7.5 |
HIGH
Network
|
catalyst-plugin-static-simple_project
|
catalyst-plugin-static-simple
|
The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended pol…
|
CWE-200
Information Exposure
|
CVE-2017-16248
|
2024-11-21 12:16 |
2017-11-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
257943
|
8.8 |
HIGH
Network
|
octobercms
|
october
|
Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's ac…
|
CWE-352
Origin Validation Error
|
CVE-2017-16244
|
2024-11-21 12:16 |
2017-11-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
257944
|
5.4 |
MEDIUM
Network
|
typecho
|
typecho
|
In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article content, resulting in XSS via index.php/action/contents-post…
|
CWE-79
Cross-site Scripting
|
CVE-2017-16230
|
2024-11-21 12:16 |
2017-10-31 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
257945
|
9.8 |
CRITICAL
Network
|
dulwich_project
|
dulwich
|
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017…
|
NVD-CWE-noinfo
|
CVE-2017-16228
|
2024-11-21 12:16 |
2017-10-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
257946
|
7.5 |
HIGH
Network
|
quagga
debian
|
quagga
debian_linux
|
The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for l…
|
CWE-20
Improper Input Validation
|
CVE-2017-16227
|
2024-11-21 12:16 |
2017-10-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
257947
|
6.1 |
MEDIUM
Network
|
craftercms
|
crafter_cms
|
Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.
|
CWE-79
Cross-site Scripting
|
CVE-2017-15686
|
2024-11-21 12:15 |
2020-11-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
257948
|
8.6 |
HIGH
Network
|
craftercms
|
crafter_cms
|
Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-o…
|
CWE-91
Blind XPath Injection
|
CVE-2017-15685
|
2024-11-21 12:15 |
2020-11-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
257949
|
7.5 |
HIGH
Network
|
craftercms
|
crafter_cms
|
Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.
|
CWE-22
Path Traversal
|
CVE-2017-15684
|
2024-11-21 12:15 |
2020-11-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
257950
|
8.6 |
HIGH
Network
|
craftercms
|
crafter_cms
|
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
|
CWE-91
Blind XPath Injection
|
CVE-2017-15683
|
2024-11-21 12:15 |
2020-11-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
