cvelist/CVEDB huggingface dataset:
CVE-2017-18357
Published: 2019-01-15
CVSS score: 0.0
Source: Metasploit

Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.
CVE-2017-18362
Published: 2019-02-05
CVSS score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CISA

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.
CVE-2017-18368
Published: 2019-05-02
CVSS score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: Metasploit/CISA

The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.
CVE-2017-18369
Published: 2019-05-02
CVSS score: 0.0
Source: Metasploit

The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the adv_remotelog.asp page and can be exploited through the syslogServerAddr parameter.
CVE-2017-18370
Published: 2019-05-02
CVSS score: 0.0
Source: Metasploit

The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is only accessible by an authenticated user. The vulnerability is in the logSet.asp page and can be exploited through the ServerIP parameter. Authentication can be achieved by exploiting CVE-2017-18371.
CVE-2017-18371
Published: 2019-05-02
CVSS score: 0.0
Source: Metasploit

The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service accounts: one with the username true and password true, and another with the username supervisor and password zyad1234. These accounts can be used to login to the web interface, exploit authenticated command injections, and change router settings for malicious purposes.
CVE-2017-18372
Published: 2019-05-02
CVSS score: 0.0
Source: Metasploit

The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which is only accessible by an authenticated user. The vulnerability is in the tools_time.asp page and can be exploited through the uiViewSNTPServer parameter. Authentication can be achieved by exploiting CVE-2017-18373.
CVE-2017-18487
Published: 2019-08-13
CVSS score: 0.0
Source: Nuclei

The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.
CVE-2017-18490
Published: 2019-08-13
CVSS score: 0.0
Source: Nuclei

The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.
CVE-2017-18491
Published: 2019-08-13
CVSS score: 0.0
Source: Nuclei

The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
CVE-2017-18492
Published: 2019-08-13
CVSS score: 0.0
Source: Nuclei

The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.
CVE-2017-18493
Published: 2019-08-13
CVSS score: 0.0
Source: Nuclei

The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.
CVE-2017-18494
Published: 2019-08-13
CVSS score: 0.0
Source: Nuclei

The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.
CVE-2017-18496
Published: 2019-08-13
CVSS score: 0.0
Source: Nuclei

The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.
CVE-2017-18500
Published: 2019-08-12
CVSS score: 0.0
Source: Nuclei

The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.
CVE-2017-18501
Published: 2019-08-12
CVSS score: 0.0
Source: Nuclei

The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.
CVE-2017-18502
Published: 2019-08-12
CVSS score: 0.0
Source: Nuclei

The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.
CVE-2017-18505
Published: 2019-08-12
CVSS score: 0.0
Source: Nuclei

The twitter-plugin plugin before 2.55 for WordPress has XSS.
CVE-2017-18516
Published: 2019-08-21
CVSS score: 0.0
Source: Nuclei

The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.
CVE-2017-18517
Published: 2019-08-20
CVSS score: 0.0
Source: Nuclei

The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.
CVE-2017-18518
Published: 2019-08-20
CVSS score: 0.0
Source: Nuclei

The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.
CVE-2017-18527
Published: 2019-08-20
CVSS score: 0.0
Source: Nuclei

The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.
CVE-2017-18528
Published: 2019-08-20
CVSS score: 0.0
Source: Nuclei

The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
CVE-2017-18529
Published: 2019-08-20
CVSS score: 0.0
Source: Nuclei

The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.
CVE-2017-18530
Published: 2019-08-20
CVSS score: 0.0
Source: Nuclei

The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.
CVE-2017-18532
Published: 2019-08-20
CVSS score: 0.0
Source: Nuclei

The realty plugin before 1.1.0 for WordPress has multiple XSS issues.
CVE-2017-18536
Published: 2019-08-21
CVSS score: 0.0
Source: Nuclei

The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.
CVE-2017-18537
Published: 2019-08-21
CVSS score: 0.0
Source: Nuclei

The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.
CVE-2017-18542
Published: 2019-08-16
CVSS score: 0.0
Source: Nuclei

The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.
CVE-2017-18556
Published: 2019-08-21
CVSS score: 0.0
Source: Nuclei

The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.
CVE-2017-18557
Published: 2019-08-21
CVSS score: 0.0
Source: Nuclei

The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.
CVE-2017-18558
Published: 2019-08-21
CVSS score: 0.0
Source: Nuclei

The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.
CVE-2017-18562
Published: 2019-08-21
CVSS score: 0.0
Source: Nuclei

The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.
CVE-2017-18564
Published: 2019-08-21
CVSS score: 0.0
Source: Nuclei

The sender plugin before 1.2.1 for WordPress has multiple XSS issues.
CVE-2017-18565
Published: 2019-08-21
CVSS score: 0.0
Source: Nuclei

The updater plugin before 1.35 for WordPress has multiple XSS issues.
CVE-2017-18566
Published: 2019-08-20
CVSS score: 0.0
Source: Nuclei

The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
CVE-2017-18590
Published: 2019-08-27
CVSS score: 0.0
Source: Nuclei

The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
CVE-2017-18598
Published: 2019-09-10
CVSS score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: Nuclei

The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.
CVE-2017-18638
Published: 2019-10-11
CVSS score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: Nuclei

send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
CVE-2017-2741
Published: 2018-01-23
CVSS score: 0.0
Source: Metasploit

A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmware before 1708D. This vulnerability could potentially be exploited to execute arbitrary code.
CVE-2017-3066
Published: 2017-04-27
CVSS score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CISA

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.
CVE-2017-3131
Published: 2017-09-12
CVSS score: 0.0
Source: Nuclei

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in "Applications" under FortiView.
CVE-2017-3132
Published: 2017-09-12
CVSS score: 0.0
Source: Nuclei

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action input during the activation of a FortiToken.
CVE-2017-3133
Published: 2017-09-12
CVSS score: 0.0
Source: Nuclei

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replacement Message HTML for SSL-VPN.
CVE-2017-3248
Published: 2017-01-27
CVSS score: 0.0
Source: Metasploit

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
CVE-2017-3506
Published: 2017-04-24
CVSS score: 7.4
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: Nuclei/CISA

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2017-3528
Published: 2017-04-24
CVSS score: 0.0
Source: Nuclei

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).
CVE-2017-3622
Published: 2017-04-24
CVSS score: 0.0
Source: Metasploit

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Common Desktop Environment (CDE)). The supported version that is affected is 10. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. Note: CVE-2017-3622 is assigned for the "Extremeparr". CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2017-3629
Published: 2017-06-22
CVSS score: 0.0
Source: Metasploit

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in takeover of Solaris. CVSS 3.0 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2017-3630
Published: 2017-06-22
CVSS score: 0.0
Source: Metasploit

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
CVE-2017-3631
Published: 2017-06-22
CVSS score: 0.0
Source: Metasploit

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data as well as unauthorized read access to a subset of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
CVE-2017-3823
Published: 2017-02-01
CVSS score: 0.0
Source: Metasploit

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control plugin before 10031.6.2017.0126 on Internet Explorer, and the Download Manager ActiveX control plugin before 2.1.0.10 on Internet Explorer. A vulnerability in these Cisco WebEx browser extensions could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server and Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center) when they are running on Microsoft Windows. The vulnerability is a design defect in an application programing interface (API) response parser within the extension. An attacker that can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If successful, the attacker could execute arbitrary code with the privileges of the affected browser.
CVE-2017-3881
Published: 2017-03-17
CVSS score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: Metasploit/Nuclei/CISA

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.
CVE-2017-4011
Published: 2017-05-17
CVSS score: 0.0
Source: Nuclei

Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request.
CVE-2017-4915
Published: 2017-05-22
CVSS score: 0.0
Source: Metasploit

VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of this issue may allow unprivileged host users to escalate their privileges to root in a Linux host machine.
CVE-2017-5030
Published: 2017-04-24
CVSS score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CISA

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.
CVE-2017-5070
Published: 2017-10-27
CVSS score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CISA

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVE-2017-5146
Published: 2017-02-13
CVSS score: 0.0
Source: Metasploit

An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Sensitive information is stored in clear-text.
CVE-2017-5162
Published: 2017-02-13
CVSS score: 0.0
Source: Metasploit

An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Lack of authentication for remote service gives access to application set up and configuration.
CVE-2017-5254
Published: 2017-12-20
CVSS score: 0.0
Source: Metasploit

In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechanism.
CVE-2017-5255
Published: 2017-12-20
CVSS score: 0.0
Source: Metasploit

In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user (including the otherwise low-privilege readonly user) to inject shell meta-characters as part of a specially-crafted POST request to the get_chart function and run OS-level commands, effectively as root.
CVE-2017-5259
Published: 2017-12-20
CVSS score: 0.0
Source: Metasploit

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or-hostname>/adm/syscmd.asp.
CVE-2017-5260
Published: 2017-12-20
CVSS score: 0.0
Source: Metasploit

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference (DRO) at http://<device-ip-or-hostname>/goform/down_cfg_file by this otherwise low privilege 'user' account.
CVE-2017-5261
Published: 2017-12-20
CVSS score: 0.0
Source: Metasploit

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path traversal vulnerability, accessible to all authenticated users.
CVE-2017-5262
Published: 2017-12-20
CVSS score: 0.0
Source: Metasploit

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive information by OID reference.
CVE-2017-5521
Published: 2017-01-17
CVSS score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: Metasploit/Nuclei/CISA

An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.
CVE-2017-5631
Published: 2017-05-01
CVSS score: 0.0
Source: Nuclei

An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., "usr") that is transmitted in the login.php query string.
CVE-2017-5638
Published: 2017-03-11
CVSS score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: Metasploit/Nuclei/CISA

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CVE-2017-5645
Published: 2017-04-17
CVSS score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: Nuclei

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.