Vulnerabilities > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-06-16 | CVE-2017-9559 | Improper Certificate Validation vulnerability in Meafinancial Vision Bank 3.0.1 The MEA Financial vision-bank/id420406345 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | 5.9 |
| 2017-06-16 | CVE-2017-9558 | Improper Certificate Validation vulnerability in Wawacu Wawa Employees Credit Union Mobile 4.0.1 The wawa-employees-credit-union-mobile/id1158082793 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | 5.9 |
| 2017-06-15 | CVE-2017-9419 | Cross-site Scripting vulnerability in Webhammer WP Custom Fields Search 0.3.28 Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScript via the cs-all-0 parameter. | 6.1 |
| 2017-06-15 | CVE-2017-9674 | Cross-site Scripting vulnerability in Simplece 2.3.0 In SimpleCE 2.3.0, an authenticated XSS vulnerability was found on index.php/content/text/1?return_url=[XSS] exploitable as a regular or admin user. | 5.4 |
| 2017-06-15 | CVE-2017-9613 | Cross-site Scripting vulnerability in SAP Successfactors B1702P5E.1190658 Stored Cross-site scripting (XSS) vulnerability in SAP SuccessFactors before b1705.1234962 allows remote authenticated users to inject arbitrary web script or HTML via the file upload functionality. | 5.4 |
| 2017-06-15 | CVE-2017-9505 | Incorrect Default Permissions vulnerability in Atlassian Confluence Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. | 4.3 |
| 2017-06-15 | CVE-2017-8555 | Improper Input Validation vulnerability in Microsoft Edge Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to trick a user into loading a page with malicious content when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted documents, aka "Microsoft Edge Security Feature Bypass Vulnerability". | 4.3 |
| 2017-06-15 | CVE-2017-8553 | Information Exposure vulnerability in Microsoft products An information disclosure vulnerability exists in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows Server 2016 when the Windows kernel improperly handles objects in memory, aka "GDI Information Disclosure Vulnerability". | 4.7 |
| 2017-06-15 | CVE-2017-8551 | Cross-site Scripting vulnerability in Microsoft Project Server 2013 An elevation of privilege vulnerability exists when Microsoft SharePoint software fails to properly sanitize a specially crafted requests, aka "Microsoft SharePoint XSS vulnerability". | 6.1 |
| 2017-06-15 | CVE-2017-8550 | Cross-site Scripting vulnerability in Microsoft Office 2016 A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafted content, aka "Skype for Business Remote Code Execution Vulnerability". | 5.4 |