CVE-2017-17704

A door-unlocking issue was discovered on Software House iStar Ultra devices through 6.5.2.20569 when used in conjunction with the IP-ACM Ethernet Door Module. The communications between the IP-ACM and the iStar Ultra is encrypted using a fixed AES key and IV. Each message is encrypted in CBC mode and restarts with the fixed IV, leading to replay attacks of entire messages. There is no authentication of messages beyond the use of the fixed AES key, so message forgery is also possible.

Source: CVE-2017-17704

CVE-2016-10704

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka APPSEC-1503.

Source: CVE-2016-10704

CVE-2017-14855

Red Lion HMI panels allow remote attackers to cause a denial of service (software exception) via an HTTP POST request to a long URI that does not exist, as demonstrated by version HMI 2.41 PLC 2.42.

Source: CVE-2017-14855

CVE-2017-17089

custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionality.

Source: CVE-2017-17089

CVE-2017-12812

PHPJabbers Night Club Booking Software has stored XSS in the name parameter in the reservations tab.

Source: CVE-2017-12812

CVE-2017-17997

In Wireshark 2.2.11 and before, the MRDISC dissector misuses a NULL pointer. This was addressed in epan/dissectors/packet-mrdisc.c by validating an IPv4 address. This vulnerability is similar to CVE-2017-9343.

Source: CVE-2017-17997

CVE-2017-12810

PHPJabbers PHP Newsletter Script 4.2 has stored XSS in lists in the admin panel.

Source: CVE-2017-12810

CVE-2017-12813

PHPJabbers File Sharing Script 1.0 has stored XSS in the comments section.

Source: CVE-2017-12813

CVE-2017-12811

PHPJabbers Star Rating Script 4.0 has stored XSS via a rating item.

Source: CVE-2017-12811

CVE-2017-17983

PHP Scripts Mall Muslim Matrimonial Script has SQL injection via the view-profile.php mem_id parameter.

Source: CVE-2017-17983