CVE-2017-18xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
876 records · Page 4 of 9
The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.
UpdatedThe sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.
UpdatedThe postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter.
UpdatedThe examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.
UpdatedThe examapp plugin 1.0 for WordPress has XSS via exam input text fields.
UpdatedThe formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
UpdatedThe Pinfinity theme before 2.0 for WordPress has XSS via the s parameter.
UpdatedThe Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.
UpdatedThe jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId parameter.
UpdatedThe elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.
UpdatedAn issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c.
Updatednse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \n character to ssh-brute.nse or ssh-auth-methods.nse.
UpdatedThe updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
UpdatedThe woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.
UpdatedThe gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.
UpdatedThe timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
UpdatedAn issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic.
UpdatedAn issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.
UpdatedAn issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
UpdatedThe insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.
UpdatedThe posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.
UpdatedThe post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.
Updated- CVE-2017-18583: The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection. Unscored
The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.
Updated The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.
UpdatedThe time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.
UpdatedThe shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.
UpdatedThe corner-ad plugin before 1.0.8 for WordPress has XSS.
UpdatedThe crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.
UpdatedThe mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.
UpdatedThe event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.
Updated- CVE-2017-18575: The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues. Unscored
The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.
Updated The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
UpdatedThe simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
UpdatedThe gnucommerce plugin before 1.4.2 for WordPress has XSS.
UpdatedThe search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.
UpdatedThe cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.
UpdatedThe my-wp-translate plugin before 1.0.4 for WordPress has CSRF.
UpdatedThe my-wp-translate plugin before 1.0.4 for WordPress has XSS.
UpdatedThe wp-all-import plugin before 3.4.6 for WordPress has XSS.
UpdatedThe user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
UpdatedThe updater plugin before 1.35 for WordPress has multiple XSS issues.
UpdatedThe sender plugin before 1.2.1 for WordPress has multiple XSS issues.
UpdatedThe rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.
Updated- CVE-2017-18562: The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues. Unscored
The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.
Updated The embed-comment-images plugin before 0.6 for WordPress has XSS.
UpdatedThe content-audit plugin before 1.9.2 for WordPress has XSS.
UpdatedThe cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.
Updated- CVE-2017-18558: The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues. Unscored
The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.
Updated - CVE-2017-18557: The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues. Unscored
The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.
Updated - CVE-2017-18556: The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues. Unscored
The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.
Updated The booking-sms plugin before 1.1.0 for WordPress has XSS.
Updated- CVE-2017-18554: The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event. Unscored
The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.
Updated The ad-buttons plugin before 2.3.2 for WordPress has XSS.
UpdatedAn issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency.
UpdatedAn issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated.
UpdatedAn issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_get_hba_info does not initialize the hbainfo structure.
UpdatedAn issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_send_raw_srb does not initialize the reply structure.
UpdatedThe note-press plugin before 0.1.2 for WordPress has SQL injection.
Updated- CVE-2017-18547: The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms. Unscored
The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.
Updated The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.
UpdatedThe invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.
UpdatedThe invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.
UpdatedThe invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.
Updated- CVE-2017-18542: The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues. Unscored
The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.
Updated The xo-security plugin before 1.5.3 for WordPress has XSS.
UpdatedThe weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.
UpdatedThe weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.
UpdatedThe weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.
Updated- CVE-2017-18537: The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues. Unscored
The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.
Updated The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.
UpdatedThe smokesignal plugin before 1.2.7 for WordPress has XSS.
UpdatedThe share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.
UpdatedThe rimons-twitter-widget plugin before 1.3 for WordPress has XSS.
UpdatedThe realty plugin before 1.1.0 for WordPress has multiple XSS issues.
UpdatedThe raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.
UpdatedThe rating-bws plugin before 0.2 for WordPress has multiple XSS issues.
UpdatedThe promobar plugin before 1.1.1 for WordPress has multiple XSS issues.
UpdatedThe pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
UpdatedThe pagination plugin before 1.0.7 for WordPress has multiple XSS issues.
UpdatedThe moreads-se plugin before 1.4.7 for WordPress has XSS.
UpdatedThe megamenu plugin before 2.4 for WordPress has XSS.
Updated- CVE-2017-18524: The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues. Unscored
The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.
Updated - CVE-2017-18523: The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book. Unscored
The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.
Updated - CVE-2017-18522: The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book. Unscored
The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.
Updated The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.
UpdatedThe democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.
Updated- CVE-2017-18519: The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages. Unscored
The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.
Updated The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.
Updated- CVE-2017-18517: The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues. Unscored
The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.
Updated - CVE-2017-18516: The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues. Unscored
The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.
Updated The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.
UpdatedThe simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
UpdatedThe responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.
UpdatedThe newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.
UpdatedThe custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.
UpdatedThe custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
UpdatedAn issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability)
UpdatedThe wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.
UpdatedThe wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.
UpdatedThe woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.
Updated