2017 CVEs (page 102)
Page 102 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-1000004 | Critical | 9.8 | 2017-07-17 | ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog, Group Course Email, Course Alumni, Cou… |
CVE-2017-1000003 | Critical | 9.8 | 2017-07-17 | ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application component resulting in privilege… |
CVE-2017-1000002 | Critical | 9.8 | 2017-07-17 | ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution… |
CVE-2017-1000001 | High | 7.5 | 2017-07-17 | FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on. |
CVE-2017-0196 | Medium | 6.5 | 2017-07-17 | An information disclosure vulnerability in Microsoft scripting engine allows remote attackers to obtain sensitive information from process memory via a crafted… |
CVE-2017-0152 | High | 8.1 | 2017-07-17 | A remote code execution vulnerability exists in the way affected Microsoft scripting engine render when handling objects in memory in Microsoft browsers. The v… |
CVE-2017-0028 | Critical | 9.8 | 2017-07-17 | A remote code execution vulnerability exists when Microsoft scripting engine improperly accesses objects in memory. The vulnerability could corrupt memory in a… |
CVE-2017-11310 | High | 8.8 | 2017-07-13 | The read_user_chunk_callback function in coders\png.c in ImageMagick 7.0.6-1 Q16 2017-06-21 (beta) has memory leak vulnerabilities via crafted PNG files. |
CVE-2017-9789 | High | 7.5 | 2017-07-13 | When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has been freed, resulting i… |
CVE-2017-9788 | Critical | 9.1 | 2017-07-13 | In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset bef… |
CVE-2017-6249 | High | 7.0 | 2017-07-13 | An elevation of privilege vulnerability in the NVIDIA sound driver could enable a local malicious application to execute arbitrary code within the context of t… |
CVE-2017-9787 | High | 7.5 | 2017-07-13 | When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 o… |
CVE-2017-7672 | Medium | 5.9 | 2017-07-13 | If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload… |
CVE-2017-1308 | Medium | 6.5 | 2017-07-13 | IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not have access to due t… |
CVE-2017-7529 | High | 7.5 | 2017-07-13 | Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of pote… |
CVE-2017-11103 | High | 8.1 | 2017-07-13 | Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates… |
CVE-2017-11173 | High | 8.8 | 2017-07-13 | Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended t… |
CVE-2017-11202 | Medium | 6.1 | 2017-07-13 | FineCMS through 2017-07-12 allows XSS in visitors.php because JavaScript in visited URLs is not restricted either during logging or during the reading of logs… |
CVE-2017-11201 | Medium | 5.4 | 2017-07-13 | application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to conduct XSS attacks by uploading an image via a rout… |
CVE-2017-11200 | High | 8.8 | 2017-07-13 | SQL Injection exists in FineCMS through 2017-07-12 via the application/core/controller/excludes.php visitor_ip parameter. |
CVE-2017-11198 | Medium | 6.1 | 2017-07-13 | Cross-site scripting (XSS) vulnerability in /application/lib/ajax/get_image.php in FineCMS through 2017-07-12 allows remote attackers to inject arbitrary web s… |
CVE-2017-11174 | Critical | 9.8 | 2017-07-12 | In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the da… |
CVE-2017-11196 | High | 8.8 | 2017-07-12 | Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to log… |
CVE-2017-11195 | Medium | 6.1 | 2017-07-12 | Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quote… |
CVE-2017-11194 | Medium | 6.1 | 2017-07-12 | Pulse Connect Secure 8.3R1 has Reflected XSS in adminservercacertdetails.cgi. In the admin panel, the certid parameter of adminservercacertdetails.cgi is refle… |
CVE-2017-11193 | High | 8.8 | 2017-07-12 | Pulse Connect Secure 8.3R1 has CSRF in diag.cgi. In the panel, the diag.cgi file is responsible for running commands such as ping, ping6, traceroute, tracerout… |
CVE-2017-2863 | High | 7.8 | 2017-07-12 | An out-of-bounds write vulnerability exists in the PDF parsing functionality of Infix 7.1.5. A specially crafted PDF file can cause a vulnerability resulting i… |
CVE-2017-2820 | High | 8.8 | 2017-07-12 | An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of freedesktop.org Poppler 0.53.0. A specially crafted PDF fi… |
CVE-2017-2818 | High | 7.5 | 2017-07-12 | An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted PDF can cause an overly large… |
CVE-2017-2814 | High | 7.5 | 2017-07-12 | An exploitable heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted pdf can cause an image resizin… |
CVE-2017-1321 | Medium | 6.1 | 2017-07-12 | IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2017-1285 | Medium | 6.5 | 2017-07-12 | IBM WebSphere MQ 9.0.1 and 9.0.2 could allow an authenticated user with authority to send a specially crafted message that would cause a channel to remain in a… |
CVE-2017-9977 | High | 7.5 | 2017-07-12 | AVG AntiVirus for MacOS with scan engine before 4668 might allow remote attackers to bypass malware detection by leveraging failure to scan inside disk image (… |
CVE-2017-9845 | High | 7.5 | 2017-07-12 | disp+work 7400.12.21.30308 in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request, aka SA… |
CVE-2017-9844 | High | 7.5 | 2017-07-12 | SAP NetWeaver 7400.12.21.30308 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object in… |
CVE-2017-9843 | Low | 2.7 | 2017-07-12 | SAP NetWeaver AS ABAP 7.40 allows remote authenticated users with certain privileges to cause a denial of service (process crash) via vectors involving disp+wo… |
CVE-2017-11190 | High | 7.8 | 2017-07-12 | unrarlib.c in unrar-free 0.0.1, when _DEBUG_LOG mode is enabled, might allow remote attackers to cause a denial of service (stack-based buffer overflow and app… |
CVE-2017-11189 | Medium | 6.5 | 2017-07-12 | unrarlib.c in unrar-free 0.0.1 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash), which could be relev… |
CVE-2017-4057 | High | 8.8 | 2017-07-12 | Privilege Escalation vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated users to gain e… |
CVE-2017-4055 | High | 7.5 | 2017-07-12 | Exploitation of Authentication vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated use… |
CVE-2017-4054 | High | 8.8 | 2017-07-12 | Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated users to execute a… |
CVE-2017-4053 | Critical | 9.8 | 2017-07-12 | Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote a… |
CVE-2017-4052 | Critical | 9.8 | 2017-07-12 | Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remo… |
CVE-2017-11188 | High | 7.5 | 2017-07-12 | The ReadDPXImage function in coders\dpx.c in ImageMagick 7.0.6-0 has a large loop vulnerability that can cause CPU exhaustion via a crafted DPX file, related t… |
CVE-2017-11187 | Critical | 9.8 | 2017-07-12 | phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly. |
CVE-2017-7678 | Medium | 6.1 | 2017-07-12 | In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points t… |
CVE-2017-11167 | Critical | 9.8 | 2017-07-12 | FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter this code after a ', sequence in a domain… |
CVE-2017-11165 | Critical | 9.8 | 2017-07-12 | dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile… |
CVE-2017-11182 | Medium | 5.4 | 2017-07-12 | In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the My Profile section. All input fields are vulnerable. |
CVE-2017-11181 | Medium | 5.4 | 2017-07-12 | In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the Messaging section. Subject and Message fields are vulnerable. |
CVE-2017-11180 | Medium | 6.1 | 2017-07-12 | FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in (1) the User-Agent header of an HTTP request or (2… |
CVE-2017-11179 | Medium | 6.1 | 2017-07-12 | FineCMS through 2017-07-11 has stored XSS in route=admin when modifying user information, and in route=register when registering a user account. |
CVE-2017-11178 | High | 7.5 | 2017-07-12 | In FineCMS through 2017-07-11, application/core/controller/style.php allows remote attackers to write to arbitrary files via the contents and filename paramete… |
CVE-2017-11176 | High | 7.8 | 2017-07-11 | The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a… |
CVE-2017-8621 | Medium | 6.1 | 2017-07-11 | Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an open redirect vulnerability tha… |
CVE-2017-8619 | High | 7.5 | 2017-07-11 | Microsoft Edge on Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability in the way affected Microsoft scr… |
CVE-2017-8618 | High | 7.5 | 2017-07-11 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 16… |
CVE-2017-8617 | High | 7.5 | 2017-07-11 | Microsoft Edge in Windows 10 1703 Microsoft Edge allows a remote code execution vulnerability in the way affected Microsoft scripting engines render when handl… |
CVE-2017-8611 | Medium | 6.5 | 2017-07-11 | Microsoft Edge on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows remote attackers to spoof web content via a crafted web site… |
CVE-2017-8610 | High | 7.5 | 2017-07-11 | Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to… |
CVE-2017-8609 | High | 7.5 | 2017-07-11 | Microsoft Internet Explorer in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the cont… |
CVE-2017-8608 | High | 7.5 | 2017-07-11 | Microsoft browsers in Microsoft Windows Server 2008 and R2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703… |
CVE-2017-8607 | High | 7.5 | 2017-07-11 | Microsoft browsers in Microsoft Windows 7, Windows Server 2008 and R2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607… |
CVE-2017-8606 | High | 7.5 | 2017-07-11 | Microsoft browsers in Microsoft Windows 7, Windows Server 2008 and R2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607… |
CVE-2017-8605 | High | 7.5 | 2017-07-11 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the cu… |
CVE-2017-8604 | High | 7.5 | 2017-07-11 | Microsoft Edge in Microsoft Windows 10 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current… |
CVE-2017-8603 | High | 7.5 | 2017-07-11 | Microsoft Edge in Microsoft Windows 10 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current… |
CVE-2017-8602 | Medium | 6.5 | 2017-07-11 | Microsoft browsers on Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607… |
CVE-2017-8601 | High | 7.5 | 2017-07-11 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the cu… |
CVE-2017-8599 | Medium | 6.5 | 2017-07-11 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with maliciou… |
CVE-2017-8598 | High | 7.5 | 2017-07-11 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the cu… |
CVE-2017-8596 | High | 7.5 | 2017-07-11 | Microsoft Edge in Microsoft Windows 10 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user w… |
CVE-2017-8595 | High | 7.5 | 2017-07-11 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the cu… |
CVE-2017-8594 | High | 7.5 | 2017-07-11 | Internet Explorer on Microsoft Windows 8.1 and Windows RT 8.1, and Windows Server 2012 R2 allows an attacker to execute arbitrary code in the context of the cu… |
CVE-2017-8592 | Medium | 6.5 | 2017-07-11 | Microsoft browsers on when Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows RT 8.1, and Windows Server 2012 and R2, Windows 10 Gold, 1… |
CVE-2017-8590 | High | 8.8 | 2017-07-11 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and… |
CVE-2017-8589 | Critical | 9.8 | 2017-07-11 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and… |
CVE-2017-8588 | High | 7.0 | 2017-07-11 | Microsoft WordPad in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 16… |
CVE-2017-8587 | Medium | 6.5 | 2017-07-11 | Windows Explorer in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511 allo… |
CVE-2017-8585 | High | 7.5 | 2017-07-11 | Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of serv… |
CVE-2017-8584 | High | 7.5 | 2017-07-11 | Windows 10 1607 and Windows Server 2016 allow an attacker to execute code remotely via a specially crafted WiFi packet aka "HoloLens Remote Code Execution Vuln… |
CVE-2017-8582 | Medium | 5.9 | 2017-07-11 | HTTP.sys in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1… |
CVE-2017-8581 | High | 7.0 | 2017-07-11 | Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 160… |
CVE-2017-8580 | High | 7.0 | 2017-07-11 | Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 160… |
CVE-2017-8578 | High | 7.8 | 2017-07-11 | Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 160… |
CVE-2017-8577 | High | 7.0 | 2017-07-11 | Win32k in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 160… |
CVE-2017-8574 | High | 7.0 | 2017-07-11 | Graphics in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability when it fails to properly handle objects in… |
CVE-2017-8573 | High | 7.0 | 2017-07-11 | Graphics in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1… |
CVE-2017-8570 | High | 7.8 | 2017-07-11 | Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vul… |
CVE-2017-8569 | High | 8.8 | 2017-07-11 | Microsoft SharePoint Server allows an elevation of privilege vulnerability due to the way that it sanitizes a specially crafted web request to an affected Shar… |
CVE-2017-8566 | High | 7.0 | 2017-07-11 | Microsoft Windows 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to Windows Input Method Editor (IME) improperly handli… |
CVE-2017-8565 | High | 8.1 | 2017-07-11 | Windows PowerShell in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1… |
CVE-2017-8564 | Medium | 5.5 | 2017-07-11 | Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1… |
CVE-2017-8563 | High | 8.1 | 2017-07-11 | Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and… |
CVE-2017-8562 | High | 7.0 | 2017-07-11 | Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation of pri… |
CVE-2017-8561 | High | 7.0 | 2017-07-11 | Windows kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows… |
CVE-2017-8560 | Medium | 6.1 | 2017-07-11 | Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerab… |
CVE-2017-8559 | Medium | 6.1 | 2017-07-11 | Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerab… |
CVE-2017-8557 | Medium | 5.5 | 2017-07-11 | Windows System Information Console in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows… |
CVE-2017-8556 | High | 7.0 | 2017-07-11 | Graphics in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1… |