Total
7813 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-8340 | 1 Open-xchange | 1 Open-xchange Appsuite | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. | |||||
| CVE-2017-7928 | 1 Selinc | 4 Sel-3620, Sel-3620 Firmware, Sel-3622 and 1 more | 2026-06-17 | 7.5 HIGH | 10.0 CRITICAL |
| An Improper Access Control issue was discovered in Schweitzer Engineering Laboratories (SEL) SEL-3620 and SEL-3622 Security Gateway Versions R202 and, R203, R203-V1, R203-V2 and, R204, R204-V1. The device does not properly enforce access control while configured for NAT port forwarding, which may allow for unauthorized communications to downstream devices. | |||||
| CVE-2017-7918 | 1 Cambium Networks | 8 Epmp 1000, Epmp 1000 Firmware, Epmp 1000 Hotspot and 5 more | 2026-06-17 | 6.0 MEDIUM | 6.8 MEDIUM |
| An Improper Access Control issue was discovered in Cambium Networks ePMP. After a valid user has used SNMP configuration export, an attacker is able to remotely trigger device configuration backups using specific MIBs. These backups lack proper access control and may allow access to sensitive information and possibly allow for configuration changes. | |||||
| CVE-2017-7912 | 1 Hanwhasecurity | 2 Srn-4000, Srn-4000 Firmware | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Hanwha Techwin SRN-4000, SRN-4000 firmware versions prior to SRN4000_v2.16_170401, A specially crafted http request and response could allow an attacker to gain access to the device management page with admin privileges without proper authentication. | |||||
| CVE-2017-7497 | 1 Redhat | 1 Cloudforms Management Engine | 2026-06-17 | 4.0 MEDIUM | 4.1 MEDIUM |
| The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant. | |||||
| CVE-2017-6912 | 1 Open-xchange | 1 Open-xchange Appsuite | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. | |||||
| CVE-2017-6866 | 1 Siemens | 1 Xhq Server | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| A vulnerability was discovered in Siemens XHQ server 4 and 5 (4 before V4.7.1.3 and 5 before V5.0.0.2) that could allow an authenticated low-privileged remote user to gain read access to data in the XHQ solution exceeding his configured permission level. | |||||
| CVE-2017-6016 | 1 Leao Consultoria E Desenvolvimento De Sistemas | 1 Ltda Me Laquis Scada | 2026-06-17 | 4.4 MEDIUM | 7.3 HIGH |
| An Improper Access Control issue was discovered in LCDS - Leao Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA. The following versions are affected: Versions 4.1 and prior versions released before January 20, 2017. An Improper Access Control vulnerability has been identified, which may allow an authenticated user to modify application files to escalate privileges. | |||||
| CVE-2017-5863 | 1 Open-xchange | 1 Open-xchange Appsuite | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. | |||||
| CVE-2017-5254 | 1 Cambiumnetworks | 4 Epmp 1000, Epmp 1000 Firmware, Epmp 2000 and 1 more | 2026-06-17 | 9.0 HIGH | 8.8 HIGH |
| In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechanism. | |||||
| CVE-2017-5212 | 1 Open-xchange | 1 Open-xchange Appsuite | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control. | |||||
| CVE-2017-2664 | 1 Redhat | 2 Cloudforms, Cloudforms Management Engine | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges. | |||||
| CVE-2017-20199 | 1 Buttercup | 1 Buttercup | 2026-06-17 | 2.6 LOW | 3.1 LOW |
| A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Vault Handler. The manipulation results in improper access controls. The attack may be performed from a remote location. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 1.0.1 addresses this issue. The patch is identified as 89. Upgrading the affected component is recommended. This vulnerability only affects products that are no longer supported by the maintainer. | |||||
| CVE-2017-20066 | 1 Adminer Login Project | 1 Adminer Login | 2026-06-17 | 4.6 MEDIUM | 5.3 MEDIUM |
| A vulnerability has been found in Adminer Login 1.4.4 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improper access controls. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2017-18543 | 1 Invite Anyone Project | 1 Invite Anyone | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations. | |||||
| CVE-2017-18457 | 1 Cpanel | 1 Cpanel | 2026-06-17 | 4.9 MEDIUM | 4.4 MEDIUM |
| cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218). | |||||
| CVE-2017-18421 | 1 Cpanel | 1 Cpanel | 2026-06-17 | 2.1 LOW | 3.3 LOW |
| cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271). | |||||
| CVE-2017-18416 | 1 Cpanel | 1 Cpanel | 2026-06-17 | 3.6 LOW | 5.5 MEDIUM |
| cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303). | |||||
| CVE-2017-18404 | 1 Cpanel | 1 Cpanel | 2026-06-17 | 4.9 MEDIUM | 3.1 LOW |
| cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341). | |||||
| CVE-2017-18403 | 1 Cpanel | 1 Cpanel | 2026-06-17 | 6.5 MEDIUM | 6.3 MEDIUM |
| cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337). | |||||