NVD List
| Id | Name | Description | Reject | CVSS Version | CVSS Score | Severity | Pub Date | Modified Date | Actions |
|---|---|---|---|---|---|---|---|---|---|
| 84781 | CVE-2017-7241 | A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the Post-installation and upgrade tasks of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page. | 2 | 3.5 | Low | 2017-07-18 | 2017-07-11 | View | |
| 83838 | CVE-2017-7240 | An issue was discovered on Miele Professional PST10 devices. The corresponding embedded webserver PST10 WebServer typically listens to port 80 and is prone to a directory traversal attack; therefore, an unauthenticated attacker may be able to exploit this issue to access sensitive information to aide in subsequent attacks. A Proof of Concept is GET /../../../../../../../../../../../../etc/shadow HTTP/1.1. This affects PG8527 devices 2.02 before 2.12, PG8527 devices 2.51 before 2.61, PG8527 devices 2.52 before 2.62, PG8527 devices 2.54 before 2.64, PG8528 devices 2.02 before 2.12, PG8528 devices 2.51 before 2.61, PG8528 devices 2.52 before 2.62, PG8528 devices 2.54 before 2.64, PG8535 devices 1.00 before 1.10, PG8535 devices 1.04 before 1.14, PG8536 devices 1.10 before 1.20, and PG8536 devices 1.14 before 1.24. | 2 | 5 | Medium | 2017-05-27 | 2017-05-19 | View | |
| 84780 | CVE-2017-7239 | Ninka before 1.3.2 might allow remote attackers to obtain sensitive information, manipulate license compliance scan results, or cause a denial of service (process hang) via a crafted filename. | 2 | 7.5 | High | 2017-04-27 | 2017-04-14 | View | |
| 84779 | CVE-2017-7237 | The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks dataconfigurations directory by leveraging the unauthenticated nature of the TFTP service for all clients who can reach UDP port 69, as demonstrated by a WRQ (aka Write request) operation for a configuration file or an executable file. | 2 | 7.5 | High | 2017-04-27 | 2017-04-12 | View | |
| 86012 | CVE-2017-7236 | SQL injection vulnerability in NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | 2 | 5 | Medium | 2017-06-03 | 2017-06-02 | View |
Page 292 of 17672, showing 5 records out of 88360 total, starting on record 1456, ending on 1460
