Security Vulnerabilities - CVEs Published In April 2017
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.
CVSS Score
9.8
EPSS Score
0.056
Published
2017-04-17
Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the Customapp function.
CVSS Score
4.8
EPSS Score
0.004
Published
2017-04-17
Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the Project function.
CVSS Score
4.8
EPSS Score
0.004
Published
2017-04-17
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restriction to view unauthorized project information via the Project function.
CVSS Score
4.3
EPSS Score
0.002
Published
2017-04-17
Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send unintended emails via specially crafted requests.
CVSS Score
4.3
EPSS Score
0.007
Published
2017-04-17
Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed.
CVSS Score
6.5
EPSS Score
0.012
Published
2017-04-17
Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the Schedule function.
CVSS Score
5.4
EPSS Score
0.003
Published
2017-04-17
Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to cause a denial of service.
CVSS Score
6.5
EPSS Score
0.015
Published
2017-04-17
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects via a breadcrumb trail.
CVSS Score
4.3
EPSS Score
0.002
Published
2017-04-17
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to execute unintended operations via the Project function.
CVSS Score
4.3
EPSS Score
0.003
Published
2017-04-17