Latest CVE Feed
-
10.0
HIGHCVE-2017-9944
A vulnerability has been identified in Siemens 7KT PAC1200 data manager (7KT1260) in all versions < V2.03. The integrated web server (port 80/tcp) of the affected devices could allow an unauthenticated remote attacker to perform administrative operations ... Read more
- Published: Dec. 27, 2017
- Modified: Apr. 20, 2025
-
5.5
MEDIUMCVE-2017-9955
The get_build_id function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted fil... Read more
Affected Products : binutils- Published: Jun. 26, 2017
- Modified: Apr. 20, 2025
-
5.3
MEDIUMCVE-2017-9947
A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. A directory traversal vulnerability could allow a remote attacker with network access to the integrated web server (80/tcp and 443/... Read more
Affected Products : apogee_pxc_firmware apogee_pxc_modular_firmware talon_tc_compact_firmware talon_tc_modular_firmware apogee_pxc_compact_\(p2_ethernet\)_firmware apogee_pxc_modular_\(bacnet\)_firmware apogee_pxc_modular_\(p2_ethernet\)_firmware talon_tc_compact_\(bacnet\)_firmware talon_tc_modular_\(bacnet\)_firmware apogee_pxc_modular +3 more products- Published: Oct. 23, 2017
- Modified: Apr. 20, 2025
-
7.8
HIGHCVE-2017-9961
A vulnerability exists in Schneider Electric's Pro-Face GP Pro EX version 4.07.000 that allows an attacker to execute arbitrary code. Malicious code installation requires an access to the computer. By placing a specific DLL/OCX file, an attacker is able t... Read more
Affected Products : pro-face_gp_pro_ex- Published: Sep. 26, 2017
- Modified: Apr. 20, 2025
-
7.5
HIGHCVE-2017-9977
AVG AntiVirus for MacOS with scan engine before 4668 might allow remote attackers to bypass malware detection by leveraging failure to scan inside disk image (aka DMG) files.... Read more
- Published: Jul. 12, 2017
- Modified: Apr. 20, 2025
-
7.5
HIGHCVE-2017-9956
An authentication bypass vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web reque... Read more
Affected Products : u.motion_builder- Published: Sep. 26, 2017
- Modified: Apr. 20, 2025
-
7.5
HIGHCVE-2017-9962
Schneider Electric's ClearSCADA versions released prior to August 2017 are susceptible to a memory allocation vulnerability, whereby malformed requests can be sent to ClearSCADA client applications to cause unexpected behavior. Client applications affecte... Read more
Affected Products : clearscada- Published: Sep. 26, 2017
- Modified: Apr. 20, 2025
-
9.8
CRITICALCVE-2017-9957
A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the web service contains a hidden system account with a hardcoded password. An attacker can use this information to log into the system with high-pr... Read more
Affected Products : u.motion_builder- Published: Sep. 26, 2017
- Modified: Apr. 20, 2025
-
5.5
MEDIUMCVE-2017-9959
A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system accepts reboot in session from unauthenticated users, supporting a denial of service condition.... Read more
Affected Products : u.motion_builder- Published: Sep. 26, 2017
- Modified: Apr. 20, 2025
-
8.8
HIGHCVE-2017-9992
Heap-based buffer overflow in the decode_dds1 function in libavcodec/dfa.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 allows remote attackers to cause a denial of service (application crash)... Read more
- Published: Jun. 28, 2017
- Modified: Apr. 20, 2025
-
7.8
HIGHCVE-2017-9994
libavcodec/webp.c in FFmpeg before 2.8.12, 3.0.x before 3.0.8, 3.1.x before 3.1.8, 3.2.x before 3.2.5, and 3.3.x before 3.3.1 does not ensure that pix_fmt is set, which allows remote attackers to cause a denial of service (heap-based buffer overflow and a... Read more
- Published: Jun. 28, 2017
- Modified: Apr. 20, 2025
-
5.5
MEDIUMCVE-2006-3635
The ia64 subsystem in the Linux kernel before 2.6.26 allows local users to cause a denial of service (stack consumption and system crash) via a crafted application that leverages the mishandling of invalid Register Stack Engine (RSE) state.... Read more
Affected Products : linux_kernel- Published: Aug. 07, 2017
- Modified: Apr. 20, 2025
-
7.5
HIGHCVE-2011-4343
Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.... Read more
Affected Products : myfaces- Published: Aug. 08, 2017
- Modified: Apr. 20, 2025
-
5.3
MEDIUMCVE-2013-4578
jarsigner in OpenJDK and Oracle Java SE before 7u51 allows remote attackers to bypass a code-signing protection mechanism and inject unsigned bytecode into a signed JAR file by leveraging improper file validation.... Read more
- Published: Dec. 29, 2017
- Modified: Apr. 20, 2025
-
7.8
HIGHCVE-2014-0145
Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-... Read more
Affected Products : qemu- Published: Aug. 10, 2017
- Modified: Apr. 20, 2025
-
9.3
HIGHCVE-2017-8511
A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8509, CVE-2017-8510, CVE-2017-8512, CVE-20... Read more
Affected Products : office sharepoint_server office_web_apps office_online_server office_web_apps_server powerpoint_for_mac- Published: Jun. 15, 2017
- Modified: Apr. 20, 2025
-
5.3
MEDIUMCVE-2017-8712
The Windows Hyper-V component on Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Informat... Read more
- Published: Sep. 13, 2017
- Modified: Apr. 20, 2025
-
4.3
MEDIUMCVE-2017-8555
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to trick a user into loading a page with malicious content when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted documents, aka "Microsoft Edge Secur... Read more
- Published: Jun. 15, 2017
- Modified: Apr. 20, 2025
-
7.0
HIGHCVE-2017-8576
The graphics component in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to run arbitrary code in kernel mode via a specially crafted application, aka "Microsoft Graphics Component Elevation of Privil... Read more
- Published: Jun. 29, 2017
- Modified: Apr. 20, 2025
-
5.5
MEDIUMCVE-2017-8557
Windows System Information Console in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerabilit... Read more
Affected Products : windows_10 windows_7 windows_8.1 windows_rt_8.1 windows_server_2008 windows_server_2012 windows_server_2016- Published: Jul. 11, 2017
- Modified: Apr. 20, 2025