Total
402541 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-9822 | 1 Dnnsoftware | 1 Dotnetnuke | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites." | |||||
| CVE-2017-9821 | 1 Npci | 1 Bharat Interface For Money \(bhim\) | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The National Payments Corporation of India BHIM application 1.3 for Android relies on three hardcoded strings (AK-NPCIMB, IM-NPCIBM, and VK-NPCIBM) for SMS validation, which makes it easier for attackers to bypass authentication. | |||||
| CVE-2017-9820 | 1 Npci | 1 Bharat Interface For Money \(bhim\) | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The National Payments Corporation of India BHIM application 1.3 for Android uses a custom keypad for which the input element is available to the Accessibility service, which makes it easier for attackers to bypass authentication. | |||||
| CVE-2017-9819 | 1 Npci | 1 Bharat Interface For Money \(bhim\) | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The National Payments Corporation of India BHIM application 1.3 for Android does not properly restrict use of the OTP feature, which makes it easier for attackers to bypass authentication. | |||||
| CVE-2017-9818 | 1 Npci | 1 Bharat Interface For Money \(bhim\) | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The National Payments Corporation of India BHIM application 1.3 for Android relies on a four-digit passcode, which makes it easier for attackers to obtain access. | |||||
| CVE-2017-9816 | 1 Paessler | 1 Prtg Network Monitor | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in Paessler PRTG Network Monitor before 17.2.32.2279 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||||
| CVE-2017-9815 | 2 Canonical, Libtiff | 2 Ubuntu Linux, Libtiff | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| In LibTIFF 4.0.7, the TIFFReadDirEntryLong8Array function in libtiff/tif_dirread.c mishandles a malloc operation, which allows attackers to cause a denial of service (memory leak within the function _TIFFmalloc in tif_unix.c) via a crafted file. | |||||
| CVE-2017-9814 | 2 Cairographics, Opensuse | 2 Cairo, Leap | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) because of mishandling of an unexpected malloc(0) call. | |||||
| CVE-2017-9813 | 1 Kaspersky | 1 Anti-virus For Linux Server | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting (XSS). | |||||
| CVE-2017-9812 | 1 Kaspersky | 1 Anti-virus For Linux Server | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312) to read arbitrary files with kluser privileges. | |||||
| CVE-2017-9811 | 1 Kaspersky | 1 Anti-virus For Linux Server | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). By abusing the quarantine read and write operations, it is possible to elevate the privileges to root. | |||||
| CVE-2017-9810 | 1 Kaspersky | 1 Anti-virus For Linux Server | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain. | |||||
| CVE-2017-9809 | 1 Open-xchange | 1 Open-xchange Appsuite | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure. | |||||
| CVE-2017-9808 | 1 Open-xchange | 1 Open-xchange Appsuite | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). | |||||
| CVE-2017-9807 | 1 Openwebif Project | 1 Openwebif | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval() call on the contents of the "key" HTTP GET parameter. This allows an unauthenticated remote attacker to execute arbitrary Python code or OS commands via api/saveconfig. | |||||
| CVE-2017-9806 | 1 Apache | 1 Openoffice | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| A vulnerability in the OpenOffice Writer DOC file parser before 4.1.4, and specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that cause denial of service (memory corruption and application crash) potentially resulting in arbitrary code execution. | |||||
| CVE-2017-9805 | 3 Apache, Cisco, Netapp | 7 Struts, Digital Media Manager, Hosted Collaboration Solution and 4 more | 2026-06-17 | 6.8 MEDIUM | 8.1 HIGH |
| The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads. | |||||
| CVE-2017-9804 | 1 Apache | 1 Struts | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672. | |||||
| CVE-2017-9803 | 1 Apache | 1 Solr | 2026-06-17 | 6.0 MEDIUM | 7.5 HIGH |
| Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality (when using SecurityAwareZkACLProvider type of ACL provider e.g. SaslZkACLProvider). Firstly, access to the security configuration can be leaked to users other than the solr super user. Secondly, malicious users can exploit this leaked configuration for privilege escalation to further expose/modify private data and/or disrupt operations in the Solr cluster. The vulnerability is fixed from Apache Solr 6.6.1 onwards. | |||||
| CVE-2017-9802 | 1 Apache | 1 Sling Servlets Post | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings. | |||||