CVE-2017-17739

The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html rp parameter, allowing an attacker to read or write to files.

Source: CVE-2017-17739

CVE-2017-17738

The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and modifying files via /tools.html.

Source: CVE-2017-17738

CVE-2017-17735

CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.

Source: CVE-2017-17735

CVE-2017-17737

The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network_diagnostics.html or /storage_info.html.

Source: CVE-2017-17737

CVE-2017-17740

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.

Source: CVE-2017-17740

CVE-2017-17734

CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.

Source: CVE-2017-17734

CVE-2017-17733

Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.

Source: CVE-2017-17733

CVE-2017-17730

DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php.

Source: CVE-2017-17730

CVE-2017-17731

DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.

Source: CVE-2017-17731

CVE-2017-17727

DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php.

Source: CVE-2017-17727