Vulnerabilities > Critical

DATE CVE VULNERABILITY TITLE RISK
2017-07-12 CVE-2017-11174 SQL Injection vulnerability in Xoops 2.5.8.1
In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page, related to use of GBK in CHARACTER SET and COLLATE clauses.
network
low complexity
xoops CWE-89
critical
 9.8
9.8
2017-07-12 CVE-2017-4053 OS Command Injection vulnerability in Mcafee Advanced Threat Defense
Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to execute a command of their choice via a crafted HTTP request parameter.
network
low complexity
mcafee CWE-78
critical
 9.8
9.8
2017-07-12 CVE-2017-4052 Missing Authentication for Critical Function vulnerability in Mcafee Advanced Threat Defense
Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to change or update any configuration settings, or gain administrator functionality via a crafted HTTP request parameter.
network
low complexity
mcafee CWE-306
critical
 9.8
9.8
2017-07-12 CVE-2017-11187 Improper Restriction of Excessive Authentication Attempts vulnerability in PHPmyfaq
phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly.
network
low complexity
phpmyfaq CWE-307
critical
 9.8
9.8
2017-07-12 CVE-2017-11167 Code Injection vulnerability in Finecms Project Finecms 2.1.0
FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain name, as demonstrated by the ',phpinfo() input value.
network
low complexity
finecms-project CWE-94
critical
 9.8
9.8
2017-07-12 CVE-2016-8638 Session Fixation vulnerability in Ipsilon Project Ipsilon
A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users.
network
low complexity
ipsilon-project CWE-384
critical
 9.1
9.1
2017-07-12 CVE-2017-11165 Information Exposure vulnerability in Datataker Dt80 DEX Firmware 1.50.012
dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI.
network
low complexity
datataker CWE-200
critical
 9.8
9.8
2017-07-11 CVE-2017-8589 Improper Preservation of Permissions vulnerability in Microsoft products
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability due to the way that Windows Search handles objects in memory, aka "Windows Search Remote Code Execution Vulnerability".
network
low complexity
microsoft CWE-281
critical
 9.8
9.8
2017-07-11 CVE-2017-7728 Unspecified vulnerability in Ismartalarm Cubeone Firmware
On iSmartAlarm cube devices, there is authentication bypass leading to remote execution of commands (e.g., setting the alarm on/off), related to incorrect cryptography.
network
low complexity
ismartalarm
critical
 9.8
9.8
2017-07-10 CVE-2017-5640 Improper Authentication vulnerability in Apache Impala 2.7.0/2.8.0
It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to skip authentication checks when Kerberos is enabled (but TLS is not).
network
low complexity
apache CWE-287
critical
 9.8
9.8