2017 CVEs (page 100)
Page 100 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-9933 | High | 7.5 | 2017-07-17 | Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads to disclosure of form contents. |
CVE-2017-9813 | Medium | 6.1 | 2017-07-17 | In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptName parameter of the licenseKeyInfo acti… |
CVE-2017-9812 | High | 7.5 | 2017-07-17 | The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance… |
CVE-2017-9811 | Critical | 9.8 | 2017-07-17 | The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8… |
CVE-2017-9810 | High | 8.8 | 2017-07-17 | There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version… |
CVE-2017-9671 | High | 7.8 | 2017-07-17 | A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution, by crafting a malicio… |
CVE-2017-9669 | High | 7.8 | 2017-07-17 | A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution by crafting a maliciou… |
CVE-2017-9609 | Medium | 5.4 | 2017-07-17 | Cross-site scripting (XSS) vulnerability in Blackcat CMS 1.2 allows remote authenticated users to inject arbitrary web script or HTML via the map_language para… |
CVE-2017-9340 | Medium | 6.5 | 2017-07-17 | An attacker is logged in as a normal user and can somehow make admin to delete shared folders in ownCloud Server before 10.0.2. |
CVE-2017-9339 | Medium | 5.3 | 2017-07-17 | A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to… |
CVE-2017-9338 | Medium | 5.4 | 2017-07-17 | Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before… |
CVE-2017-8896 | Medium | 6.1 | 2017-07-17 | ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url… |
CVE-2017-7947 | Medium | 6.5 | 2017-07-17 | NetApp Clustered Data ONTAP before 8.3.2P11, 9.0 before P4, and 9.1 before P5 allow attackers to obtain sensitive password information by leveraging logging of… |
CVE-2017-6744 | High | 8.8 | 2017-07-17 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, r… |
CVE-2017-6743 | High | 8.8 | 2017-07-17 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, r… |
CVE-2017-6742 | High | 8.8 | 2017-07-17 | A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute cod… |
CVE-2017-6741 | High | 8.8 | 2017-07-17 | A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute cod… |
CVE-2017-6740 | High | 8.8 | 2017-07-17 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, r… |
CVE-2017-6739 | High | 8.8 | 2017-07-17 | A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute cod… |
CVE-2017-6738 | High | 8.8 | 2017-07-17 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, r… |
CVE-2017-6737 | High | 8.8 | 2017-07-17 | A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute cod… |
CVE-2017-6736 | High | 8.8 | 2017-07-17 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, r… |
CVE-2017-9639 | High | 7.3 | 2017-07-17 | An issue was discovered in Fuji Electric V-Server Version 3.3.22.0 and prior. A memory corruption vulnerability has been identified (aka improper restriction o… |
CVE-2017-3754 | Medium | 6.7 | 2017-07-17 | Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with physical or adminis… |
CVE-2017-3742 | Medium | 4.8 | 2017-07-17 | In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two systems for the purpo… |
CVE-2017-11399 | High | 7.8 | 2017-07-17 | Integer overflow in the ape_decode_frame function in libavcodec/apedec.c in FFmpeg 2.4 through 3.3.2 allows remote attackers to cause a denial of service (out-… |
CVE-2017-11128 | Medium | 5.4 | 2017-07-17 | Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry. |
CVE-2017-11127 | Medium | 5.4 | 2017-07-17 | Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header. |
CVE-2017-7532 | Medium | 6.5 | 2017-07-17 | In Moodle 3.x, course creators are able to change system default settings for courses. |
CVE-2017-7531 | Medium | 4.3 | 2017-07-17 | In Moodle 3.3, the course overview block reveals activities in hidden courses. |
CVE-2017-2642 | Medium | 6.5 | 2017-07-17 | Moodle 3.x has user fullname disclosure on the user preferences page. |
CVE-2017-11361 | High | 8.8 | 2017-07-17 | Inteno routers have a JUCI ACL misconfiguration that allows the "user" account to read files, write to files, and add root SSH keys via JSON commands to ubus… |
CVE-2017-10987 | High | 7.5 | 2017-07-17 | An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Buffer over-read in fr_dhcp_decode_suboptions()" and a denial of service. |
CVE-2017-10986 | High | 7.5 | 2017-07-17 | An FR-GV-303 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Infinite read in dhcp_attr2vp()" and a denial of service. |
CVE-2017-10985 | High | 7.5 | 2017-07-17 | An FR-GV-302 issue in FreeRADIUS 3.x before 3.0.15 allows "Infinite loop and memory exhaustion with 'concat' attributes" and a denial of service. |
CVE-2017-10984 | Critical | 9.8 | 2017-07-17 | An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in data2vp_wimax()" - this allows remote attackers to cause a denial of service (daem… |
CVE-2017-10983 | High | 7.5 | 2017-07-17 | An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "DHCP - Read overflow when decoding option 63" and a denial of service. |
CVE-2017-10982 | High | 7.5 | 2017-07-17 | An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a denial of service. |
CVE-2017-10981 | High | 7.5 | 2017-07-17 | An FR-GV-204 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in fr_dhcp_decode()" and a denial of service. |
CVE-2017-10980 | High | 7.5 | 2017-07-17 | An FR-GV-203 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in decode_tlv()" and a denial of service. |
CVE-2017-10979 | Critical | 9.8 | 2017-07-17 | An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in rad_coalesce()" - this allows remote attackers to cause a denial of service (daemo… |
CVE-2017-10978 | High | 7.5 | 2017-07-17 | An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of service. |
CVE-2017-11367 | High | 7.5 | 2017-07-17 | The shoco_decompress function in the API in shoco through 2017-07-17 allows remote attackers to cause a denial of service (buffer over-read and application cra… |
CVE-2017-8034 | Medium | 6.6 | 2017-07-17 | The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions… |
CVE-2017-8011 | Critical | 9.8 | 2017-07-17 | EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions… |
CVE-2017-8006 | Medium | 5.9 | 2017-07-17 | In EMC RSA Authentication Manager 8.2 SP1 Patch 1 and earlier, a malicious user logged into the Self-Service Console of RSA Authentication Manager as a target… |
CVE-2017-8005 | Medium | 5.4 | 2017-07-17 | The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG products (RSA Identity Governance and Lifecycle versions 7.0.1, 7… |
CVE-2017-8004 | High | 7.2 | 2017-07-17 | The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance and RSA IMG products (RSA Identity Governance and Lifecycle versions 7.0.1, 7.0… |
CVE-2017-8000 | Medium | 4.8 | 2017-07-17 | In EMC RSA Authentication Manager 8.2 SP1 and earlier, a malicious RSA Security Console Administrator could craft a token profile and store the profile name in… |
CVE-2017-9951 | High | 7.5 | 2017-07-17 | The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request… |
CVE-2017-9814 | High | 7.5 | 2017-07-17 | cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) because of mishandling of an unex… |
CVE-2017-7688 | High | 7.5 | 2017-07-17 | Apache OpenMeetings 1.0.0 updates user password in insecure manner. |
CVE-2017-7685 | Medium | 5.3 | 2017-07-17 | Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH. |
CVE-2017-7684 | High | 7.5 | 2017-07-17 | Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the se… |
CVE-2017-7683 | High | 7.5 | 2017-07-17 | Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure. |
CVE-2017-7682 | High | 8.2 | 2017-07-17 | Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas. |
CVE-2017-7681 | High | 8.8 | 2017-07-17 | Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure… |
CVE-2017-7680 | High | 7.5 | 2017-07-17 | Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains. |
CVE-2017-7673 | Critical | 9.8 | 2017-07-17 | Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing br… |
CVE-2017-7666 | High | 8.8 | 2017-07-17 | Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks. |
CVE-2017-7664 | Critical | 10.0 | 2017-07-17 | Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0. |
CVE-2017-7663 | Medium | 6.1 | 2017-07-17 | Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0. |
CVE-2017-3103 | Medium | 6.1 | 2017-07-17 | Adobe Connect versions 9.6.1 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to a stored cross-site scripting… |
CVE-2017-3102 | Medium | 6.1 | 2017-07-17 | Adobe Connect versions 9.6.1 and earlier have a reflected cross-site scripting vulnerability. Successful exploitation could lead to a reflected cross-site scri… |
CVE-2017-3101 | High | 7.5 | 2017-07-17 | Adobe Connect versions 9.6.1 and earlier have a clickjacking vulnerability. Successful exploitation could lead to a clickjacking attack. |
CVE-2017-3100 | Medium | 6.5 | 2017-07-17 | Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful expl… |
CVE-2017-3099 | High | 8.8 | 2017-07-17 | Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 3 raster data model. Successful exp… |
CVE-2017-3080 | Medium | 6.5 | 2017-07-17 | Adobe Flash Player versions 26.0.0.131 and earlier have a security bypass vulnerability related to the Flash API used by Internet Explorer. Successful exploita… |
CVE-2017-2349 | Critical | 9.9 | 2017-07-17 | A command injection vulnerability in the IDP feature of Juniper Networks Junos OS on SRX series devices potentially allows a user with login access to the devi… |
CVE-2017-2348 | High | 7.5 | 2017-07-17 | The Juniper Enhanced jdhcpd daemon may experience high CPU utilization, or crash and restart upon receipt of an invalid IPv6 UDP packet. Both high CPU utilizat… |
CVE-2017-2347 | Medium | 6.5 | 2017-07-17 | A denial of service vulnerability in rpd daemon of Juniper Networks Junos OS allows a malformed MPLS ping packet to crash the rpd daemon if MPLS OAM is configu… |
CVE-2017-2346 | Medium | 5.9 | 2017-07-17 | An MS-MPC or MS-MIC Service PIC may crash when large fragmented packets are passed through an Application Layer Gateway (ALG). Repeated crashes of the Service… |
CVE-2017-2345 | Critical | 9.8 | 2017-07-17 | On Junos OS devices with SNMP enabled, a network based attacker with unfiltered access to the RE can cause the Junos OS snmpd daemon to crash and restart by se… |
CVE-2017-2344 | High | 7.8 | 2017-07-17 | A routine within an internal Junos OS sockets library is vulnerable to a buffer overflow. Malicious exploitation of this issue may lead to a denial of service… |
CVE-2017-2343 | Critical | 10.0 | 2017-07-17 | The Integrated User Firewall (UserFW) feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series devices to provide simple integration of… |
CVE-2017-2342 | High | 8.1 | 2017-07-17 | MACsec feature on Juniper Networks Junos OS 15.1X49 prior to 15.1X49-D100 on SRX300 series does not report errors when a secure link can not be established. It… |
CVE-2017-2341 | High | 8.8 | 2017-07-17 | An insufficient authentication vulnerability on platforms where Junos OS instances are run in a virtualized environment, may allow unprivileged users on the Ju… |
CVE-2017-2339 | High | 8.4 | 2017-07-17 | A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the '… |
CVE-2017-2338 | High | 8.4 | 2017-07-17 | A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the '… |
CVE-2017-2337 | High | 8.4 | 2017-07-17 | A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the '… |
CVE-2017-2336 | Critical | 9.6 | 2017-07-17 | A reflected cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a network based at… |
CVE-2017-2335 | High | 8.4 | 2017-07-17 | A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the '… |
CVE-2017-2314 | High | 7.5 | 2017-07-17 | Receipt of a malformed BGP OPEN message may cause the routing protocol daemon (rpd) process to crash and restart. By continuously sending specially crafted BGP… |
CVE-2017-2272 | High | 7.8 | 2017-07-17 | Untrusted search path vulnerability in Self-extracting encrypted files created by AttacheCase ver.3.2.2.6 and earlier allows an attacker to gain privileges via… |
CVE-2017-2271 | High | 7.8 | 2017-07-17 | Untrusted search path vulnerability in Self-extracting encrypted files created by AttacheCase ver.2.8.3.0 and earlier allows an attacker to gain privileges via… |
CVE-2017-2270 | High | 7.8 | 2017-07-17 | Untrusted search path vulnerability in Encrypted files in self-decryption format created by FileCapsule Deluxe Portable Ver.2.0.9 and earlier allows an attacke… |
CVE-2017-2269 | High | 7.8 | 2017-07-17 | Untrusted search path vulnerability in FileCapsule Deluxe Portable Ver.2.0.9 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an uns… |
CVE-2017-2268 | High | 7.8 | 2017-07-17 | Untrusted search path vulnerability in Encrypted files in self-decryption format created by FileCapsule Deluxe Portable Ver.1.0.5.1 and earlier allows an attac… |
CVE-2017-2267 | High | 7.8 | 2017-07-17 | Untrusted search path vulnerability in FileCapsule Deluxe Portable Ver.1.0.5.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an u… |
CVE-2017-2266 | High | 7.8 | 2017-07-17 | Untrusted search path vulnerability in Encrypted files in self-decryption format created by FileCapsule Deluxe Portable Ver.1.0.4.1 and earlier allows an attac… |
CVE-2017-2265 | High | 7.8 | 2017-07-17 | Untrusted search path vulnerability in FileCapsule Deluxe Portable Ver.1.0.4.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an u… |
CVE-2017-2253 | High | 7.8 | 2017-07-17 | Untrusted search path vulnerability in Installer of Yahoo! Toolbar (for Internet explorer) v8.0.0.6 and earlier, with its timestamp prior to June 13, 2017, 18… |
CVE-2017-2252 | High | 7.8 | 2017-07-17 | Untrusted search path vulnerability in self-extracting archive files created by File Compact Ver.5 version 5.10 and earlier, Ver.6 version 6.02 and earlier, Ve… |
CVE-2017-2249 | High | 7.8 | 2017-07-17 | Untrusted search path vulnerability in Self-extracting archive files created by Lhaz+ version 3.4.0 and earlier allows an attacker to gain privileges via a Tro… |
CVE-2017-2248 | High | 7.8 | 2017-07-17 | Untrusted search path vulnerability in Installer of Lhaz+ version 3.4.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecif… |
CVE-2017-2247 | High | 7.8 | 2017-07-17 | Untrusted search path vulnerability in Self-extracting archive files created by Lhaz version 2.4.0 and earlier allows an attacker to gain privileges via a Troj… |
CVE-2017-2246 | High | 7.8 | 2017-07-17 | Untrusted search path vulnerability in Installer of Lhaz version 2.4.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecifi… |
CVE-2017-2241 | Medium | 6.3 | 2017-07-17 | SQL injection vulnerability in the AssetView for MacOS Ver.9.2.0 and earlier versions allows remote attackers to execute arbitrary SQL commands via "File Trans… |
CVE-2017-2240 | Medium | 6.5 | 2017-07-17 | Directory traversal vulnerability in AssetView for MacOS Ver.9.2.0 and earlier versions allows remote attackers to read arbitrary files via "File Transfer Web… |
CVE-2017-1183 | High | 7.5 | 2017-07-17 | IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to modify SQL commands to the Portal Server, when default client-server communi… |