2017 CVEs (page 101)
Page 101 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-1182 | High | 7.5 | 2017-07-17 | IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to execute arbitrary commands on the system, when default client-server default… |
CVE-2017-1181 | High | 7.0 | 2017-07-17 | IBM Tivoli Monitoring Portal V6 client could allow a local attacker to gain elevated privileges for IBM Tivoli Monitoring, caused by the default console connec… |
CVE-2017-11362 | Critical | 9.8 | 2017-07-17 | In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformat_parse.c does not restrict the locale length, which allows remote attackers to cau… |
CVE-2017-11360 | Medium | 6.5 | 2017-07-17 | The ReadRLEImage function in coders\rle.c in ImageMagick 7.0.6-1 has a large loop vulnerability via a crafted rle file that triggers a huge number_pixels value. |
CVE-2017-11354 | Critical | 9.8 | 2017-07-17 | Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/app_article/sys_article.php via the name parameter in editing or adding a tag name. |
CVE-2017-11353 | Medium | 5.9 | 2017-07-17 | yadm (yet another dotfile manager) 1.10.0 has a race condition (related to the behavior of git commands in setting permissions for new files and directories)… |
CVE-2017-11352 | Medium | 6.5 | 2017-07-17 | In ImageMagick before 7.0.5-10, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c. NOTE: this vulnerability exists beca… |
CVE-2017-11349 | Critical | 9.8 | 2017-07-17 | dataTaker DT8x dEX 1.72.007 allows remote attackers to compose programs or schedules, for purposes such as sending e-mail messages or making outbound connectio… |
CVE-2017-11348 | Medium | 5.7 | 2017-07-17 | In Octopus Deploy 3.x before 3.15.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, pot… |
CVE-2017-11347 | High | 8.8 | 2017-07-17 | Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious im… |
CVE-2017-11346 | Critical | 9.8 | 2017-07-17 | Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos. |
CVE-2017-11345 | High | 7.8 | 2017-07-17 | Stack buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U… |
CVE-2017-11344 | High | 7.8 | 2017-07-17 | Global buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-AC68U, RT-AC68P, RT-AC88U… |
CVE-2017-11343 | High | 7.5 | 2017-07-17 | Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An at… |
CVE-2017-11342 | High | 7.5 | 2017-07-17 | There is an illegal address access in ast.cpp of LibSass 3.4.5. A crafted input will lead to a remote denial of service attack. |
CVE-2017-11341 | High | 7.5 | 2017-07-17 | There is a heap based buffer over-read in lexer.hpp of LibSass 3.4.5. A crafted input will lead to a remote denial of service attack. |
CVE-2017-11340 | Medium | 6.5 | 2017-07-17 | There is a Segmentation fault in the XmpParser::terminate() function in Exiv2 0.26, related to an exit call. A Crafted input will lead to a remote denial of se… |
CVE-2017-11339 | Medium | 6.5 | 2017-07-17 | There is a heap-based buffer overflow in the Image::printIFDStructure function of image.cpp in Exiv2 0.26. A Crafted input will lead to a remote denial of serv… |
CVE-2017-11338 | Medium | 6.5 | 2017-07-17 | There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.26. A crafted input will lead to a remote denial of service a… |
CVE-2017-11337 | Medium | 6.5 | 2017-07-17 | There is an invalid free in the Action::TaskFactory::cleanup function of actions.cpp in Exiv2 0.26. A crafted input will lead to a remote denial of service att… |
CVE-2017-11336 | Medium | 6.5 | 2017-07-17 | There is a heap-based buffer over-read in the Image::printIFDStructure function in image.cpp in Exiv2 0.26. A Crafted input will lead to a remote denial of ser… |
CVE-2017-11335 | High | 8.8 | 2017-07-17 | There is a heap based buffer overflow in tools/tiff2pdf.c of LibTIFF 4.0.8 via a PlanarConfig=Contig image, which causes a more than one hundred bytes out-of-b… |
CVE-2017-11329 | Critical | 9.8 | 2017-07-17 | GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers. |
CVE-2017-11328 | Medium | 5.5 | 2017-07-17 | Heap buffer overflow in the yr_object_array_set_item() function in object.c in YARA 3.x allows a denial-of-service attack by scanning a crafted .NET file. |
CVE-2017-11318 | High | 8.1 | 2017-07-17 | Cobian Backup 11 client allows man-in-the-middle attackers to add and execute new backup tasks when the master server is spoofed. In addition, the attacker can… |
CVE-2017-11311 | High | 7.8 | 2017-07-17 | soundlib/Load_psm.cpp in OpenMPT through 1.26.12.00 and libopenmpt before 0.2.8461-beta26 has a heap buffer overflow with the potential for arbitrary code exec… |
CVE-2017-10605 | High | 8.6 | 2017-07-17 | On all vSRX and SRX Series devices, when the DHCP or DHCP relay is configured, specially crafted packet might cause the flowd process to crash, halting or inte… |
CVE-2017-10604 | Medium | 5.3 | 2017-07-17 | When the device is configured to perform account lockout with a defined period of time, any unauthenticated user attempting to log in as root with an incorrect… |
CVE-2017-10603 | High | 7.0 | 2017-07-17 | An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This i… |
CVE-2017-10602 | High | 7.0 | 2017-07-17 | A buffer overflow vulnerability in Junos OS CLI may allow a local authenticated user with read only privileges and access to Junos CLI, to execute code with ro… |
CVE-2017-10601 | Critical | 9.8 | 2017-07-17 | A specific device configuration can result in a commit failure condition. When this occurs, a user is logged in without being prompted for a password while try… |
CVE-2017-1000363 | High | 7.8 | 2017-07-17 | Linux drivers/char/lp.c Out-of-Bounds Write. Due to a missing bounds check, and the fact that parport_ptr integer is static, a 'secure boot' kernel command lin… |
CVE-2017-1000362 | Critical | 9.8 | 2017-07-17 | The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a backup directory with a… |
CVE-2017-1000081 | Critical | 9.8 | 2017-07-17 | Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code execution. |
CVE-2017-1000080 | High | 7.5 | 2017-07-17 | Linux foundation ONOS 1.9.0 allows unauthenticated use of websockets. |
CVE-2017-1000079 | High | 7.5 | 2017-07-17 | Linux foundation ONOS 1.9.0 is vulnerable to a DoS. |
CVE-2017-1000078 | Medium | 6.1 | 2017-07-17 | Linux foundation ONOS 1.9 is vulnerable to XSS in the device. registration |
CVE-2017-1000075 | Critical | 9.8 | 2017-07-17 | Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the memcmp function |
CVE-2017-1000074 | Critical | 9.8 | 2017-07-17 | Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the string_repeat() function. |
CVE-2017-1000073 | Critical | 9.8 | 2017-07-17 | Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary code execution. |
CVE-2017-1000072 | Critical | 9.8 | 2017-07-17 | Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravity_value resulting potentially leading to modification of unexpected memory locations |
CVE-2017-1000071 | High | 8.1 | 2017-07-17 | Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server. |
CVE-2017-1000070 | Medium | 6.1 | 2017-07-17 | The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow. T… |
CVE-2017-1000069 | High | 8.8 | 2017-07-17 | CSRF in Bitly oauth2_proxy 2.1 during authentication flow |
CVE-2017-1000068 | High | 7.5 | 2017-07-17 | TestTrack Server versions 1.0 and earlier are vulnerable to an authentication flaw in the split disablement feature resulting in the ability to disable arbitra… |
CVE-2017-1000067 | High | 8.8 | 2017-07-17 | MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user a… |
CVE-2017-1000066 | High | 7.5 | 2017-07-17 | The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in the disclosure of sens… |
CVE-2017-1000065 | Medium | 6.1 | 2017-07-17 | Multiple Cross-site scripting (XSS) vulnerabilities in rpc.php in OpenMediaVault release 2.1 in Access Rights Management(Users) functionality allows attackers… |
CVE-2017-1000064 | High | 7.5 | 2017-07-17 | kittoframework kitto version 0.5.1 is vulnerable to memory exhaustion in the router resulting in DoS |
CVE-2017-1000063 | Medium | 6.1 | 2017-07-17 | kittoframework kitto version 0.5.1 is vulnerable to an XSS in the 404 page resulting in information disclosure |
CVE-2017-1000062 | High | 7.5 | 2017-07-17 | kittoframework kitto 0.5.1 is vulnerable to directory traversal in the router resulting in remote code execution |
CVE-2017-1000061 | High | 7.1 | 2017-07-17 | xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or d… |
CVE-2017-1000060 | Critical | 9.8 | 2017-07-17 | EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root |
CVE-2017-1000059 | Medium | 6.1 | 2017-07-17 | Live Helper Chat version 2.06v and older is vulnerable to Cross-Site Scripting in the HTTP Header handling resulting in the execution of any user provided Java… |
CVE-2017-1000058 | Medium | 6.1 | 2017-07-17 | Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data parser. |
CVE-2017-1000056 | Critical | 9.8 | 2017-07-17 | Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any ex… |
CVE-2017-1000054 | Medium | 6.1 | 2017-07-17 | Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages. |
CVE-2017-1000053 | High | 8.1 | 2017-07-17 | Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session. |
CVE-2017-1000052 | High | 7.8 | 2017-07-17 | Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetyp… |
CVE-2017-1000051 | Medium | 6.1 | 2017-07-17 | Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via t… |
CVE-2017-1000050 | High | 7.5 | 2017-07-17 | JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component r… |
CVE-2017-1000048 | High | 7.5 | 2017-07-17 | the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to ca… |
CVE-2017-1000047 | Critical | 9.8 | 2017-07-17 | rbenv (all current versions) is vulnerable to Directory Traversal in the specification of Ruby version resulting in arbitrary code execution |
CVE-2017-1000046 | High | 7.5 | 2017-07-17 | Mautic 2.6.1 and earlier fails to set flags on session cookies |
CVE-2017-1000044 | Critical | 9.8 | 2017-07-17 | gtk-vnc 0.4.2 and older doesn't check framebuffer boundaries correctly when updating framebuffer which may lead to memory corruption when rendering |
CVE-2017-1000043 | Medium | 6.1 | 2017-07-17 | Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON n… |
CVE-2017-1000042 | Medium | 6.1 | 2017-07-17 | Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON N… |
CVE-2017-1000039 | Critical | 9.8 | 2017-07-17 | Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution |
CVE-2017-1000038 | Medium | 6.1 | 2017-07-17 | WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected site |
CVE-2017-1000037 | Critical | 9.8 | 2017-07-17 | RVM automatically loads environment variables from files in $PWD resulting in command execution RVM vulnerable to command injection when automatically loading… |
CVE-2017-1000035 | Medium | 6.1 | 2017-07-17 | Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack |
CVE-2017-1000034 | High | 8.1 | 2017-07-17 | Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context o… |
CVE-2017-1000033 | Medium | 6.1 | 2017-07-17 | Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in… |
CVE-2017-1000032 | Medium | 6.1 | 2017-07-17 | Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parent_id parameter to tree.ph… |
CVE-2017-1000031 | High | 8.8 | 2017-07-17 | SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the graph_template_inpu… |
CVE-2017-1000030 | Critical | 9.8 | 2017-07-17 | Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure vulnerability, that makes it possible to prov… |
CVE-2017-1000029 | High | 7.5 | 2017-07-17 | Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Local File Inclusion vulnerability, that makes it possible to include arbitrary… |
CVE-2017-1000028 | High | 7.5 | 2017-07-17 | Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Traversal vulnerability, that can be exploit… |
CVE-2017-1000027 | Medium | 6.1 | 2017-07-17 | Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user web login function resulting in unauthor… |
CVE-2017-1000026 | High | 7.5 | 2017-07-17 | Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using… |
CVE-2017-1000025 | High | 7.5 | 2017-07-17 | GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 before 3.20.7, 3.18 before 3.18.11, and prior versions, is vulnerable to a password manager s… |
CVE-2017-1000024 | High | 7.5 | 2017-07-17 | Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential passwo… |
CVE-2017-1000023 | Medium | 5.4 | 2017-07-17 | LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document. |
CVE-2017-1000022 | High | 8.8 | 2017-07-17 | LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalation. |
CVE-2017-1000021 | High | 8.8 | 2017-07-17 | LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents. |
CVE-2017-1000020 | Critical | 9.8 | 2017-07-17 | SYN Flood or FIN Flood attack in ECos 1 and other versions embedded devices results in web Authentication Bypass. "eCos Embedded Web Servers used by Multiple R… |
CVE-2017-1000018 | High | 7.5 | 2017-07-17 | phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name |
CVE-2017-1000017 | High | 8.8 | 2017-07-17 | phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server |
CVE-2017-1000016 | High | 7.5 | 2017-07-17 | A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18. |
CVE-2017-1000015 | Medium | 6.1 | 2017-07-17 | phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters |
CVE-2017-1000014 | High | 7.5 | 2017-07-17 | phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality |
CVE-2017-1000013 | Medium | 6.1 | 2017-07-17 | phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness |
CVE-2017-1000012 | Medium | 6.1 | 2017-07-17 | MySQL Dumper version 1.24 is vulnerable to stored XSS when displaying the data in the database to the user |
CVE-2017-1000011 | Medium | 6.1 | 2017-07-17 | MyWebSQL version 3.6 is vulnerable to stored XSS in the database manager component resulting in account takeover or stealing of information |
CVE-2017-1000010 | High | 7.8 | 2017-07-17 | Audacity 2.1.2 through 2.3.2 is vulnerable to Dll HIjacking in the avformat-55.dll resulting arbitrary code execution. |
CVE-2017-1000009 | Critical | 9.8 | 2017-07-17 | Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote execution. |
CVE-2017-1000008 | High | 8.8 | 2017-07-17 | Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged in users to modify a… |
CVE-2017-1000007 | Medium | 5.9 | 2017-07-17 | txAWS (all current versions) fail to perform complete certificate verification resulting in vulnerability to MitM attacks and information disclosure. |
CVE-2017-1000006 | Medium | 6.1 | 2017-07-17 | Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue. |
CVE-2017-1000005 | Medium | 6.1 | 2017-07-17 | PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases, tables and columns resulting in potential account takeover and scraping o… |