2017 CVEs (page 10)
Page 10 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-18457 | Medium | 4.4 | 2019-08-02 | cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218). |
CVE-2017-18456 | Medium | 6.1 | 2019-08-02 | cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217). |
CVE-2017-18455 | Low | 2.7 | 2019-08-02 | In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208). |
CVE-2017-18454 | Medium | 5.4 | 2019-08-02 | cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262). |
CVE-2017-18453 | Medium | 4.9 | 2019-08-02 | cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260). |
CVE-2017-18452 | Medium | 6.7 | 2019-08-02 | cPanel before 64.0.21 allows code execution via Rails configuration files (SEC-259). |
CVE-2017-18451 | Medium | 5.3 | 2019-08-02 | cPanel before 64.0.21 allows attackers to read a user's crontab file during a short time interval upon a cPAddon upgrade (SEC-257). |
CVE-2017-18450 | Medium | 4.5 | 2019-08-02 | cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convert_roundcube_mysql2sqlite (SEC-255). |
CVE-2017-18449 | Medium | 5.5 | 2019-08-02 | cPanel before 64.0.21 allows certain file-rename operations in the context of the root account via scripts/convert_roundcube_mysql2sqlite (SEC-254). |
CVE-2017-18448 | Medium | 5.3 | 2019-08-02 | cPanel before 64.0.21 allows certain file-read operations via a Serverinfo_manpage API call (SEC-252). |
CVE-2017-18447 | Medium | 6.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251). |
CVE-2017-18446 | Medium | 6.3 | 2019-08-02 | cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250). |
CVE-2017-18445 | Medium | 4.3 | 2019-08-02 | cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249). |
CVE-2017-18444 | Medium | 5.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute SSH API commands (SEC-248). |
CVE-2017-18443 | Medium | 5.8 | 2019-08-02 | cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding (SEC-247). |
CVE-2017-18442 | Medium | 5.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands (SEC-246). |
CVE-2017-18441 | Medium | 5.0 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245). |
CVE-2017-18440 | Medium | 4.3 | 2019-08-02 | cPanel before 64.0.21 allows demo users to execute traceroute via api2 (SEC-244). |
CVE-2017-18439 | Medium | 6.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243). |
CVE-2017-18438 | Medium | 6.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242). |
CVE-2017-18437 | Medium | 4.4 | 2019-08-02 | cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240). |
CVE-2017-18436 | Low | 3.5 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239). |
CVE-2017-18435 | High | 7.3 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to execute code via the BoxTrapper API (SEC-238). |
CVE-2017-18434 | High | 7.8 | 2019-08-02 | cPanel before 64.0.21 allows code execution in the context of the root account via a SET_VHOST_LANG_PACKAGE multilang adminbin call (SEC-237). |
CVE-2017-18433 | High | 8.8 | 2019-08-02 | cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236). |
CVE-2017-18432 | High | 7.8 | 2019-08-02 | In cPanel before 64.0.21, Horde MySQL to SQLite conversion can leak a database password (SEC-234). |
CVE-2017-18431 | High | 7.5 | 2019-08-02 | cPanel before 66.0.1 does not reliably perform suspend/unsuspend operations on accounts (CPANEL-13941). |
CVE-2017-18430 | Medium | 4.7 | 2019-08-02 | In cPanel before 66.0.2, user and group ownership may be incorrectly set when using reassign_post_terminate_cruft (SEC-294). |
CVE-2017-18429 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291). |
CVE-2017-18428 | Low | 2.5 | 2019-08-02 | In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290). |
CVE-2017-18427 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289). |
CVE-2017-18426 | Low | 2.7 | 2019-08-02 | cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288). |
CVE-2017-18425 | Low | 2.5 | 2019-08-02 | In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280). |
CVE-2017-18424 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274). |
CVE-2017-18423 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273). |
CVE-2017-18422 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272). |
CVE-2017-18421 | Low | 3.3 | 2019-08-02 | cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271). |
CVE-2017-18420 | Medium | 5.4 | 2019-08-02 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269). |
CVE-2017-18419 | Medium | 5.4 | 2019-08-02 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266). |
CVE-2017-18418 | Medium | 5.4 | 2019-08-02 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265). |
CVE-2017-18417 | Medium | 5.4 | 2019-08-02 | cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263). |
CVE-2017-18416 | Medium | 5.5 | 2019-08-02 | cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303). |
CVE-2017-18415 | High | 7.8 | 2019-08-02 | cPanel before 67.9999.103 allows code execution in the context of the mailman account because of incorrect environment-variable filtering (SEC-302). |
CVE-2017-18414 | High | 7.4 | 2019-08-02 | cPanel before 67.9999.103 allows an open redirect in /unprotected/redirect.html (SEC-300). |
CVE-2017-18413 | High | 7.8 | 2019-08-02 | In cPanel before 67.9999.103, the backup system overwrites root's home directory when a mount disappears (SEC-299). |
CVE-2017-18412 | Low | 2.5 | 2019-08-02 | cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296). |
CVE-2017-18411 | Medium | 6.8 | 2019-08-02 | The "addon domain conversion" feature in cPanel before 67.9999.103 can copy all MySQL databases to the new account (SEC-285). |
CVE-2017-18410 | Medium | 6.5 | 2019-08-02 | In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284). |
CVE-2017-18409 | Medium | 6.5 | 2019-08-02 | In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283). |
CVE-2017-18408 | Medium | 5.4 | 2019-08-02 | cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282). |
CVE-2017-18407 | Medium | 4.8 | 2019-08-02 | cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279). |
CVE-2017-18406 | High | 7.5 | 2019-08-02 | cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276). |
CVE-2017-18405 | Medium | 5.5 | 2019-08-02 | cPanel before 68.0.15 allows arbitrary file-read operations because of the backup .htaccess modification logic (SEC-345). |
CVE-2017-18404 | Low | 3.1 | 2019-08-02 | cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341). |
CVE-2017-18403 | Medium | 6.3 | 2019-08-02 | cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337). |
CVE-2017-18402 | Medium | 5.4 | 2019-08-02 | cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336). |
CVE-2017-18401 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334). |
CVE-2017-18400 | High | 7.8 | 2019-08-02 | cPanel before 68.0.15 allows local root code execution via cpdavd (SEC-333). |
CVE-2017-18399 | Low | 3.7 | 2019-08-02 | cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC-332). |
CVE-2017-18398 | Low | 3.8 | 2019-08-02 | DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331). |
CVE-2017-18397 | Low | 3.3 | 2019-08-02 | cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330). |
CVE-2017-18396 | Medium | 5.5 | 2019-08-02 | cPanel before 68.0.15 allows arbitrary file-read operations via Exim vdomainaliases (SEC-329). |
CVE-2017-18395 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 does not block a username of ssl (SEC-328). |
CVE-2017-18394 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327). |
CVE-2017-18393 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326). |
CVE-2017-18392 | Low | 2.0 | 2019-08-02 | cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325). |
CVE-2017-18391 | Low | 2.5 | 2019-08-02 | cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323). |
CVE-2017-18390 | High | 7.8 | 2019-08-02 | cPanel before 68.0.15 allows code execution in the context of the root account because of weak permissions on incremental backups (SEC-322). |
CVE-2017-18389 | Medium | 6.3 | 2019-08-02 | cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318). |
CVE-2017-18388 | High | 7.8 | 2019-08-02 | cPanel before 68.0.15 can perform unsafe file operations because Jailshell does not set the umask (SEC-315). |
CVE-2017-18387 | High | 7.2 | 2019-08-02 | cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314). |
CVE-2017-18386 | High | 7.2 | 2019-08-02 | cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313). |
CVE-2017-18385 | Medium | 5.5 | 2019-08-02 | cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311). |
CVE-2017-18384 | Low | 3.8 | 2019-08-02 | cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310). |
CVE-2017-18383 | High | 7.8 | 2019-08-02 | cPanel before 68.0.15 writes home-directory backups to an incorrect location (SEC-309). |
CVE-2017-18382 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306). |
CVE-2017-18381 | High | 7.2 | 2019-07-30 | The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials. |
CVE-2017-18380 | High | 7.5 | 2019-07-30 | edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled domain name. |
CVE-2017-18379 | Critical | 9.8 | 2019-07-27 | In the Linux kernel before 4.14, an out of boundary access happened in drivers/nvme/target/fc.c. |
CVE-2017-7189 | High | 7.5 | 2019-07-10 | main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port… |
CVE-2017-6217 | Medium | 6.1 | 2019-07-10 | paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code execution |
CVE-2017-12652 | Critical | 9.8 | 2019-07-10 | libpng before 1.6.32 does not properly check the length of chunks against the user limit. |
CVE-2017-8230 | High | 8.8 | 2019-07-03 | On Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices, the users on the device are divided into 2 groups "admin" and "user". However, as a part of security ana… |
CVE-2017-8229 | Critical | 9.8 | 2019-07-03 | Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. If the firmware version V2.420… |
CVE-2017-8228 | High | 8.8 | 2019-07-03 | Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices mishandle reboots within the past two hours. Amcrest cloud services does not perform a thorough verification… |
CVE-2017-8227 | Critical | 9.8 | 2019-07-03 | Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect password attempts are detected using the We… |
CVE-2017-8226 | Critical | 9.8 | 2019-07-03 | Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the… |
CVE-2017-13719 | Critical | 9.8 | 2019-07-03 | The Amcrest IPM-721S Amcrest_IPC-AWXX_Eng_N_V2.420.AC00.17.R.20170322 allows HTTP requests that permit enabling various functionalities of the camera by using… |
CVE-2017-9327 | Medium | 6.5 | 2019-07-03 | Secret data of processes managed by CM is not secured by file permissions. |
CVE-2017-9326 | High | 7.5 | 2019-07-03 | The keystore password for the Spark History Server may be exposed in unsecured files under the /var/run/cloudera-scm-agent directory managed by Cloudera Manage… |
CVE-2017-9325 | High | 7.5 | 2019-07-03 | The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs. |
CVE-2017-6900 | Critical | 9.8 | 2019-07-03 | An issue was discovered in Riello NetMan 204 14-2 and 15-2. The issue is with the login script and wrongpass Python script used for authentication. When callin… |
CVE-2017-6216 | Medium | 6.1 | 2019-07-03 | novaksolutions/infusionsoft-php-sdk v2016-10-31 is vulnerable to a reflected XSS in the leadscoring.php resulting code execution |
CVE-2017-18346 | Critical | 9.8 | 2019-07-03 | SQL injection vulnerability in /wbg/core/_includes/authorization.inc.php in CMS Web-Gooroo through 2013-01-19 allows remote attackers to execute arbitrary SQL… |
CVE-2017-17972 | Medium | 6.1 | 2019-07-03 | packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open Bug Bounty ID OBB-… |
CVE-2017-8417 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. Howev… |
CVE-2017-8416 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for b… |
CVE-2017-8415 | Critical | 9.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from… |
CVE-2017-8413 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device runs a custom daemon on UDP port 5978 which is called "dldps2121" and listens for b… |
CVE-2017-8412 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom binary called mp4ts under the /var/www/video folder. It seems that thi… |