Total
398867 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-11196 | 1 Pulsesecure | 1 Pulse Connect Secure | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to logout a user by making them visit a malicious web page. | |||||
| CVE-2017-11195 | 1 Pulsesecure | 1 Pulse Connect Secure | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quotes. It properly sanitizes quotes and tags, so one cannot simply close the src with a quote and inject after that. However, an attacker can use javascript: or data: to abuse this. | |||||
| CVE-2017-11194 | 1 Pulsesecure | 1 Pulse Connect Secure | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Pulse Connect Secure 8.3R1 has Reflected XSS in adminservercacertdetails.cgi. In the admin panel, the certid parameter of adminservercacertdetails.cgi is reflected in the application's response and is not properly sanitized, allowing an attacker to inject tags. An attacker could come up with clever payloads to make the system run commands such as ping, ping6, traceroute, nslookup, arp, etc. | |||||
| CVE-2017-11193 | 1 Pulsesecure | 1 Pulse Connect Secure | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, traceroute6, nslookup, arp, and Portprobe. These functions do not have any protections against CSRF. That can allow an attacker to run these commands against any IP if they can get an admin to visit their malicious CSRF page. | |||||
| CVE-2017-11191 | 1 Freeipa | 1 Freeipa | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID (for the same user account) that had been created for an earlier session. NOTE: Vendor states that issue does not exist in product and does not recognize this report as a valid security concern | |||||
| CVE-2017-11190 | 1 Rarzilla | 1 Unrar-free | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| unrarlib.c in unrar-free 0.0.1, when _DEBUG_LOG mode is enabled, might allow remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via an RAR archive containing a long filename. | |||||
| CVE-2017-11189 | 1 Rarzilla | 1 Unrar-free | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| unrarlib.c in unrar-free 0.0.1 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash), which could be relevant if unrarlib is used as library code for a long-running application. NOTE: one of the several test cases in the references may be the same as what was separately reported as CVE-2017-14121. | |||||
| CVE-2017-11188 | 1 Imagemagick | 1 Imagemagick | 2026-06-17 | 7.8 HIGH | 7.5 HIGH |
| The ReadDPXImage function in coders\dpx.c in ImageMagick 7.0.6-0 has a large loop vulnerability that can cause CPU exhaustion via a crafted DPX file, related to lack of an EOF check. | |||||
| CVE-2017-11187 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-06-17 | 5.0 MEDIUM | 9.8 CRITICAL |
| phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly. | |||||
| CVE-2017-11185 | 1 Strongswan | 1 Strongswan | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted RSA signature. | |||||
| CVE-2017-11184 | 1 Glpi-project | 1 Glpi | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter. | |||||
| CVE-2017-11183 | 1 Glpi-project | 1 Glpi | 2026-06-17 | 5.5 MEDIUM | 4.9 MEDIUM |
| front/backup.php in GLPI before 9.1.5 allows remote authenticated administrators to delete arbitrary files via a crafted file parameter. | |||||
| CVE-2017-11182 | 1 Fairsketch | 1 Rise Ultimate Project Manager | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the My Profile section. All input fields are vulnerable. | |||||
| CVE-2017-11181 | 1 Fairsketch | 1 Rise Ultimate Project Manager | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the Messaging section. Subject and Message fields are vulnerable. | |||||
| CVE-2017-11180 | 1 Finecms Project | 1 Finecms | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in (1) the User-Agent header of an HTTP request or (2) the username entered on the login screen. | |||||
| CVE-2017-11179 | 1 Finecms Project | 1 Finecms | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| FineCMS through 2017-07-11 has stored XSS in route=admin when modifying user information, and in route=register when registering a user account. | |||||
| CVE-2017-11178 | 1 Finecms Project | 1 Finecms | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. For example, this can be used to overwrite a .php file because the file extension is not checked. | |||||
| CVE-2017-11177 | 1 Websense | 1 Triton Ap Email | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| TRITON AP-EMAIL 8.2 before 8.2 IB does not properly restrict file access in an unspecified directory. | |||||
| CVE-2017-11176 | 2 Debian, Linux | 2 Debian Linux, Linux Kernel | 2026-06-17 | 7.2 HIGH | 7.8 HIGH |
| The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact. | |||||
| CVE-2017-11175 | 1 Siemens | 1 Fin Stack | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| In J2 Innovations FIN Stack 4.0, the authentication webform is vulnerable to reflected XSS via the query string to /login. | |||||