Total
401057 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-6531 | 1 Televes | 2 Coaxdata Gateway 1gbps, Coaxdata Gateway 1gbps Firmware | 2026-06-17 | 5.0 MEDIUM | 9.8 CRITICAL |
| On Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgw_v1.02.0014 4.20, the backup/restore feature lacks access control, related to ReadFile.cgi and LoadCfgFile. | |||||
| CVE-2017-6530 | 1 Televes | 2 Coaxdata Gateway 1gbps, Coaxdata Gateway 1gbps Firmware | 2026-06-17 | 5.0 MEDIUM | 9.8 CRITICAL |
| Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgw_v1.02.0014 4.20 do not check password.shtml authorization, leading to Arbitrary password change. | |||||
| CVE-2017-6529 | 1 Dnatools | 1 Dnalims | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter. | |||||
| CVE-2017-6528 | 1 Dnatools | 1 Dnalims | 2026-06-17 | 4.3 MEDIUM | 8.1 HIGH |
| An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password storage (the /home/dna/spool/.pfile file). | |||||
| CVE-2017-6527 | 1 Dnatools | 1 Dnalims | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files readable by the web server user (by using the viewAppletFsa.cgi seqID parameter). | |||||
| CVE-2017-6526 | 1 Dnatools | 1 Dnalims | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi POST requests). | |||||
| CVE-2017-6520 | 1 Bose | 1 Soundtouch 30 | 2026-06-17 | 6.4 MEDIUM | 9.1 CRITICAL |
| The Multicast DNS (mDNS) responder used in BOSE Soundtouch 30 inadvertently responds to IPv4 unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets. | |||||
| CVE-2017-6519 | 2 Avahi, Canonical | 2 Avahi, Ubuntu Linux | 2026-06-17 | 6.4 MEDIUM | 9.1 CRITICAL |
| avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service (traffic amplification) and may cause information leakage by obtaining potentially sensitive information from the responding device via port-5353 UDP packets. NOTE: this may overlap CVE-2015-2809. | |||||
| CVE-2017-6518 | 1 Sanadata | 1 Sanacms | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in /sanadata/seo/index.asp in SANADATA SanaCMS 7.3 allows remote attackers to inject arbitrary web script or HTML via the txtFrom parameter. | |||||
| CVE-2017-6517 | 1 Microsoft | 1 Skype | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| Microsoft Skype 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded by Skype. It allows an attacker to load a .dll of the attacker's choosing that could execute arbitrary code without the user's knowledge.The specific flaw exists within the handling of DLL (api-ms-win-core-winrt-string-l1-1-0.dll) loading by the Skype.exe process. | |||||
| CVE-2017-6516 | 1 Magnicomp | 1 Sysinfo | 2026-06-17 | 7.2 HIGH | 6.7 MEDIUM |
| A Local Privilege Escalation Vulnerability in MagniComp's Sysinfo before 10-H64 for Linux and UNIX platforms could allow a local attacker to gain elevated privileges. Parts of SysInfo require setuid-to-root access in order to access restricted system files and make restricted kernel calls. This access could be exploited by a local attacker to gain a root shell prompt using the right combination of environment variables and command line arguments. | |||||
| CVE-2017-6514 | 1 Wordpress | 1 Wordpress | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring. | |||||
| CVE-2017-6513 | 1 Softaculous | 2 Virtualizor, Whmcs Reseller Module | 2026-06-17 | 6.5 MEDIUM | 9.9 CRITICAL |
| The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which allows remote authenticated users to control other virtual machines managed by Virtualizor by accessing a modified URL. | |||||
| CVE-2017-6512 | 3 Canonical, Debian, File\ | 3 Ubuntu Linux, Debian Linux, \ | 2026-06-17 | 4.3 MEDIUM | 5.9 MEDIUM |
| Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic. | |||||
| CVE-2017-6511 | 1 Finecms Project | 1 Finecms | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in application/classes/application.php. | |||||
| CVE-2017-6510 | 1 Efssoft | 1 Easy File Sharing Ftp Server | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Easy File Sharing FTP Server version 3.6 is vulnerable to a directory traversal vulnerability which allows an attacker to list and download any file from any folder outside the FTP root Directory. | |||||
| CVE-2017-6509 | 1 Burgundy-cms Project | 1 Burgundy-cms | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Smith0r/burgundy-cms before 2017-03-06 is vulnerable to a reflected XSS in admin/components/menu/views/menuitems.php (id parameter). | |||||
| CVE-2017-6508 | 1 Gnu | 1 Wget | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL. | |||||
| CVE-2017-6507 | 2 Apparmor, Canonical | 3 Apparmor, Ubuntu Core, Ubuntu Touch | 2026-06-17 | 4.3 MEDIUM | 5.9 MEDIUM |
| An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit files allows an attacker to possibly have increased attack surfaces of processes that were intended to be confined by AppArmor. This is due to the common logic to handle 'restart' operations removing AppArmor profiles that aren't found in the typical filesystem locations, such as /etc/apparmor.d/. Userspace projects that manage their own AppArmor profiles in atypical directories, such as what's done by LXD and Docker, are affected by this flaw in the AppArmor init script logic. | |||||
| CVE-2017-6506 | 1 Azure Dex | 1 Data Expert Ultimate | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| In Azure Data Expert Ultimate 2.2.16, the SMTP verification function suffers from a buffer overflow vulnerability, leading to remote code execution. The attack vector is a crafted SMTP daemon that sends a long 220 (aka "Service ready") string. | |||||