| CVE-2017-5645 | Critical 9.8 | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,… Assigned by apache | Apr 17, 2017 |
| CVE-2017-7990 Healthcare | High 8.8 | The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageRepor… Assigned by mitre | Apr 21, 2017 |
| CVE-2016-1555 Known exploited | Critical 9.8 | (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and W… Assigned by certcc | Apr 21, 2017 |
| CVE-2017-3506 Known exploited | High 7.4 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Assigned by oracle | Apr 24, 2017 |
| CVE-2017-5030 Known exploited | High 8.8 | Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a… Assigned by Chrome | Apr 24, 2017 |
| CVE-2017-8291 Known exploited | High 7.8 | Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an in… Assigned by mitre | Apr 27, 2017 |
| CVE-2017-3066 Known exploited | Critical 9.8 | Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Assigned by adobe | Apr 27, 2017 |
| CVE-2017-7957 | High 7.5 | XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application cr… Assigned by mitre | Apr 29, 2017 |
| CVE-2017-5689 Known exploited | Critical 9.8 | An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). Assigned by intel | May 2, 2017 |
| CVE-2017-7921 Known exploited | Critical 9.8 | An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2x… Assigned by icscert | May 6, 2017 |
| CVE-2017-0281 | High 7.8 | Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web Apps 2013 SP1, Project Server 2013 SP1, SharePoint Enterprise… Assigned by microsoft | May 12, 2017 |
| CVE-2017-0263 Known exploited | High 7.8 | The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Se… Assigned by microsoft | May 12, 2017 |
| CVE-2017-0262 Known exploited | High 7.8 | Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution… Assigned by microsoft | May 12, 2017 |
| CVE-2017-0261 Known exploited | High 7.8 | Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution… Assigned by microsoft | May 12, 2017 |
| CVE-2017-0222 Known exploited | High 8.8 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017… Assigned by microsoft | May 12, 2017 |
| CVE-2017-0213 Known exploited | High 7.3 | Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, an… Assigned by microsoft | May 12, 2017 |
| CVE-2017-9050 | High 7.5 | libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. Assigned by mitre | May 18, 2017 |
| CVE-2017-9049 | High 7.5 | libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. Assigned by mitre | May 18, 2017 |
| CVE-2017-9048 | High 7.5 | libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. Assigned by mitre | May 18, 2017 |
| CVE-2017-9047 | High 7.5 | A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. Assigned by mitre | May 18, 2017 |
| CVE-2016-9841 | Critical 9.8 | inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Assigned by microfocus | May 23, 2017 |
| CVE-2016-9840 | High 8.8 | inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. Assigned by microfocus | May 23, 2017 |
| CVE-2017-8540 Known exploited | High 7.8 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and… Assigned by microsoft | May 26, 2017 |
| CVE-2017-6862 Known exploited | Critical 9.8 | NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code execution via a buffer overflow that us… Assigned by netgear | May 26, 2017 |
| CVE-2017-7494 Known exploited | Critical 9.8 | Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and the… Assigned by redhat | May 30, 2017 |
| CVE-2017-9380 Healthcare | High 8.8 | OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application. Assigned by mitre | Jun 2, 2017 |
| CVE-2017-5664 | High 7.5 | The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwa… Assigned by apache | Jun 6, 2017 |
| CVE-2016-7836 Known exploited | Critical 9.8 | SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program. Assigned by jpcert | Jun 9, 2017 |
| CVE-2017-0663 | High 7.8 | A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. Assigned by google_android | Jun 14, 2017 |
| CVE-2017-8512 | High 8.8 | A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". Assigned by microsoft | Jun 15, 2017 |
| CVE-2017-8509 | High 8.8 | A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". Assigned by microsoft | Jun 15, 2017 |
| CVE-2017-8543 Known exploited | Critical 9.8 | Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012… Assigned by microsoft | Jun 15, 2017 |
| CVE-2017-8464 Known exploited | High 8.8 | Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows S… Assigned by microsoft | Jun 15, 2017 |
| CVE-2017-8529 | Medium 6.5 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to detect specific files on the user's compu… Assigned by microsoft | Jun 15, 2017 |
| CVE-2017-9841 Known exploited | Critical 9.8 | Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by… Assigned by mitre | Jun 27, 2017 |
| CVE-2017-6018 Healthcare | Medium 6.1 | An open redirect issue was discovered in B. Assigned by icscert | Jun 30, 2017 |
| CVE-2017-6022 Healthcare | Critical 9.8 | A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Journal Service, Version 1.0.51 and prior versions. Assigned by icscert | Jun 30, 2017 |
| CVE-2017-9248 Known exploited | Critical 9.8 | Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKe… Assigned by mitre | Jul 3, 2017 |
| CVE-2017-9791 Known exploited | Critical 9.8 | The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. Assigned by apache | Jul 10, 2017 |
| CVE-2017-8570 Known exploited | High 7.8 | Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". Assigned by microsoft | Jul 11, 2017 |
| CVE-2017-6744 Known exploited | High 8.8 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code… Assigned by cisco | Jul 17, 2017 |
| CVE-2017-6743 Known exploited | High 8.8 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code… Assigned by cisco | Jul 17, 2017 |
| CVE-2017-6742 Known exploited | High 8.8 | A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. Assigned by cisco | Jul 17, 2017 |
| CVE-2017-6740 Known exploited | High 8.8 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code… Assigned by cisco | Jul 17, 2017 |
| CVE-2017-6739 Known exploited | High 8.8 | A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. Assigned by cisco | Jul 17, 2017 |
| CVE-2017-6738 Known exploited | High 8.8 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code… Assigned by cisco | Jul 17, 2017 |
| CVE-2017-6737 Known exploited | High 8.8 | A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. Assigned by cisco | Jul 17, 2017 |
| CVE-2017-6736 Known exploited | High 8.8 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code… Assigned by cisco | Jul 17, 2017 |
| CVE-2017-6316 Known exploited | Critical 9.8 | Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. Assigned by mitre | Jul 20, 2017 |
| CVE-2017-9822 Known exploited | High 8.8 | DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites." Assigned by hpe | Jul 20, 2017 |
