|
254981
|
6.5 |
MEDIUM
Local
|
xen
|
xen
|
An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to cause a denial of service (infinite loop and host OS hang) by leveraging the mishandling of Populate on Demand (PoD) errors.
|
CWE-754
CWE-755
CWE-835
Improper Check for Unusual or Exceptional Conditions
Improper Handling of Exceptional Conditions
Loop with Unreachable Exit Condition ('Infinite Loop')
|
CVE-2017-17044
|
2024-11-21 12:17 |
2017-11-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
254982
|
6.1 |
MEDIUM
Network
|
zitec
|
emag_marketplace_connector
|
The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filt…
|
CWE-79
Cross-site Scripting
|
CVE-2017-17043
|
2024-11-21 12:17 |
2017-11-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
254983
|
7.5 |
HIGH
Network
|
yardoc
|
yard
|
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitr…
|
CWE-22
Path Traversal
|
CVE-2017-17042
|
2024-11-21 12:17 |
2017-11-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
254984
|
5.5 |
MEDIUM
Local
|
kmplayer
|
kmplayer
|
KMPlayer 4.2.2.4 allows remote attackers to cause a denial of service via a crafted NSV file.
|
CWE-20
Improper Input Validation
|
CVE-2017-16952
|
2024-11-21 12:17 |
2017-11-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
254985
|
5.5 |
MEDIUM
Local
|
audiovalley
|
winamp_pro
|
Winamp Pro 5.66 Build 3512 allows remote attackers to cause a denial of service via a crafted WAV, WMV, AU, ASF, AIFF, or AIF file.
|
CWE-20
Improper Input Validation
|
CVE-2017-16951
|
2024-11-21 12:17 |
2017-11-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
254986
|
5.5 |
MEDIUM
Local
|
linux
|
linux_kernel
|
The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kern…
|
CWE-200
Information Exposure
|
CVE-2017-16994
|
2024-11-21 12:17 |
2017-11-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
254987
|
6.1 |
MEDIUM
Network
|
communigate
|
communigate_pro
|
The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of a Google Calendar invitation, (2) a craf…
|
CWE-79
Cross-site Scripting
|
CVE-2017-16962
|
2024-11-21 12:17 |
2017-11-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
254988
|
6.5 |
MEDIUM
Network
|
bigtreecms
|
bigtree_cms
|
A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated attackers to obtain information in the context of the user used by the application…
|
CWE-89
SQL Injection
|
CVE-2017-16961
|
2024-11-21 12:17 |
2017-11-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
254989
|
8.8 |
HIGH
Network
|
tp-link
|
tl-wvr300
tl-wvr302
tl-wvr450g
tl-wvr900g
tl-er5510g
tl-er5520g
tl-er6120g
tl-er6520g
tl-r473
tl-r478
tl-r478\+
tl-r478g\+
tl-r483
tl-r483g
tl-r488
tl-r42…
|
TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field of an admin/interface command to cgi-bin/…
|
CWE-78
OS Command
|
CVE-2017-16960
|
2024-11-21 12:17 |
2017-11-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
254990
|
6.1 |
MEDIUM
Network
|
symphony_project
|
symphony
|
b3log Symphony (aka Sym) 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a second private letter with a modified title.
|
CWE-79
Cross-site Scripting
|
CVE-2017-16956
|
2024-11-21 12:17 |
2017-11-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
