2017 CVEs (page 108)
Page 108 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-9987 | High | 7.5 | 2017-06-28 | There is a heap-based buffer overflow in the function hpel_motion in mpegvideo_motion.c in libav 12.1. A crafted input can lead to a remote denial of service a… |
CVE-2017-9986 | High | 7.8 | 2017-06-28 | The intr function in sound/oss/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or pos… |
CVE-2017-9985 | High | 7.8 | 2017-06-28 | The snd_msndmidi_input_read function in sound/isa/msnd/msnd_midi.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-bou… |
CVE-2017-9984 | High | 7.8 | 2017-06-28 | The snd_msnd_interrupt function in sound/isa/msnd/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boun… |
CVE-2017-9445 | High | 7.5 | 2017-06-28 | In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server c… |
CVE-2017-6086 | High | 8.8 | 2017-06-27 | Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the… |
CVE-2017-2491 | High | 8.8 | 2017-06-27 | Use after free vulnerability in the String.replace method JavaScriptCore in Apple Safari in iOS before 10.3 allows remote attackers to execute arbitrary code v… |
CVE-2017-9830 | Critical | 9.8 | 2017-06-27 | Remote Code Execution is possible in Code42 CrashPlan 5.4.x via the org.apache.commons.ssl.rmi.DateRMI Java class, because (upon instantiation) it creates an R… |
CVE-2017-9841 | Critical | 9.8 | 2017-06-27 | Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a… |
CVE-2017-9982 | High | 7.5 | 2017-06-27 | TeamSpeak Client 3.0.19 allows remote attackers to cause a denial of service (application crash) via the ᗪ Unicode character followed by the ༿ Unic… |
CVE-2017-1328 | Medium | 5.3 | 2017-06-27 | IBM API Connect 5.0.0.0 - 5.0.6.0 could allow a remote attacker to bypass security restrictions of the api, caused by improper handling of security policy. By… |
CVE-2017-1322 | High | 8.2 | 2017-06-27 | IBM API Connect 5.0.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerabi… |
CVE-2017-1297 | High | 7.3 | 2017-06-27 | IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-based buffer overflow, caused by improper… |
CVE-2017-1234 | Medium | 5.4 | 2017-06-27 | IBM QRadar 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering th… |
CVE-2017-1105 | High | 7.1 | 2017-06-27 | IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a buffer overflow that could allow a local user to… |
CVE-2017-2843 | High | 8.8 | 2017-06-27 | In the web management interface in Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to… |
CVE-2017-2842 | High | 8.8 | 2017-06-27 | In the web management interface in Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to… |
CVE-2017-2841 | High | 8.8 | 2017-06-27 | An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52… |
CVE-2017-7524 | High | 7.5 | 2017-06-27 | tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC. |
CVE-2017-7522 | Medium | 6.5 | 2017-06-27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded… |
CVE-2017-7521 | Medium | 5.9 | 2017-06-27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issu… |
CVE-2017-7520 | High | 7.4 | 2017-06-27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attack… |
CVE-2017-7508 | High | 7.5 | 2017-06-27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet. |
CVE-2017-9257 | Medium | 5.5 | 2017-06-27 | The mp4ff_read_ctts function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (l… |
CVE-2017-9256 | Medium | 5.5 | 2017-06-27 | The mp4ff_read_stco function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (l… |
CVE-2017-9255 | Medium | 5.5 | 2017-06-27 | The mp4ff_read_stsc function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (l… |
CVE-2017-9254 | Medium | 5.5 | 2017-06-27 | The mp4ff_read_stts function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (l… |
CVE-2017-9253 | Medium | 5.5 | 2017-06-27 | The mp4ff_read_stsd function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (l… |
CVE-2017-9223 | Medium | 5.5 | 2017-06-27 | The mp4ff_read_stts function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (i… |
CVE-2017-9222 | Medium | 5.5 | 2017-06-27 | The mp4ff_parse_tag function in common/mp4ff/mp4meta.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (i… |
CVE-2017-9221 | Medium | 5.5 | 2017-06-27 | The mp4ff_read_mdhd function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (i… |
CVE-2017-9220 | Medium | 5.5 | 2017-06-27 | The mp4ff_read_stco function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (m… |
CVE-2017-9219 | Medium | 5.5 | 2017-06-27 | The mp4ff_read_stsc function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (m… |
CVE-2017-9218 | Medium | 5.5 | 2017-06-27 | The mp4ff_read_stsd function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (i… |
CVE-2017-9955 | Medium | 5.5 | 2017-06-26 | The get_build_id function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to… |
CVE-2017-9954 | Medium | 5.5 | 2017-06-26 | The getvalue function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cau… |
CVE-2017-9953 | High | 7.5 | 2017-06-26 | There is an invalid free in Image::printIFDStructure that leads to a Segmentation fault in Exiv2 0.26. A crafted input will lead to a remote denial of service… |
CVE-2017-7458 | High | 7.5 | 2017-06-26 | The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service (NULL pointer derefere… |
CVE-2017-6326 | Critical | 10.0 | 2017-06-26 | The Symantec Messaging Gateway can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to exe… |
CVE-2017-6325 | Medium | 6.6 | 2017-06-26 | The Symantec Messaging Gateway can encounter a file inclusion vulnerability, which is a type of vulnerability that is most commonly found to affect web applica… |
CVE-2017-6324 | High | 7.3 | 2017-06-26 | The Symantec Messaging Gateway, when processing a specific email attachment, can allow a malformed or corrupted Word file with a potentially malicious macro th… |
CVE-2017-9949 | High | 7.8 | 2017-06-26 | The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a denial of service (stack-based buffer underflow and appl… |
CVE-2017-9948 | High | 8.8 | 2017-06-26 | A stack buffer overflow vulnerability has been discovered in Microsoft Skype 7.2, 7.35, and 7.36 before 7.37, involving MSFTEDIT.DLL mishandling of remote RDP… |
CVE-2017-7496 | High | 7.0 | 2017-06-26 | fedora-arm-installer up to and including 1.99.16 is vulnerable to local privilege escalation due to lack of checking the error condition of mount operation fai… |
CVE-2017-9145 | Medium | 6.1 | 2017-06-26 | TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS. |
CVE-2017-9937 | Medium | 6.5 | 2017-06-26 | In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack. |
CVE-2017-9936 | Medium | 6.5 | 2017-06-26 | In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a remote denial of service attack. |
CVE-2017-9935 | High | 8.8 | 2017-06-26 | In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2p_write_pdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages… |
CVE-2017-9929 | Medium | 5.5 | 2017-06-26 | In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:1074, which allows attackers to cause a denial of service via a craft… |
CVE-2017-9928 | Medium | 5.5 | 2017-06-26 | In lrzip 0.631, a stack buffer overflow was found in the function get_fileinfo in lrzip.c:979, which allows attackers to cause a denial of service via a crafte… |
CVE-2017-9615 | Critical | 9.8 | 2017-06-26 | Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbose logging writes th… |
CVE-2017-9466 | Critical | 9.8 | 2017-06-26 | The executable httpd on the TP-Link WR841N V8 router before TL-WR841N(UN)_V8_170210 contained a design flaw in the use of DES for block encryption. This result… |
CVE-2017-7459 | High | 7.5 | 2017-06-26 | ntopng before 3.0 allows HTTP Response Splitting. |
CVE-2017-7416 | Medium | 6.1 | 2017-06-26 | ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated. |
CVE-2017-6678 | High | 7.5 | 2017-06-26 | A vulnerability in the ingress UDP packet processing functionality of Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software 19.2 through 21.0 co… |
CVE-2017-6669 | High | 7.8 | 2017-06-26 | Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files. An attacker could exploit… |
CVE-2017-6662 | High | 8.0 | 2017-06-26 | A vulnerability in the web-based user interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an authenticated… |
CVE-2017-9872 | High | 7.8 | 2017-06-25 | The III_dequantize_sample function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a deni… |
CVE-2017-9871 | High | 7.8 | 2017-06-25 | The III_i_stereo function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of ser… |
CVE-2017-9870 | Medium | 5.5 | 2017-06-25 | The III_i_stereo function in layer3.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of ser… |
CVE-2017-9869 | Medium | 5.5 | 2017-06-25 | The II_step_one function in layer2.c in mpglib, as used in libmpgdecoder.a in LAME 3.99.5 and other products, allows remote attackers to cause a denial of serv… |
CVE-2017-9868 | Medium | 5.5 | 2017-06-25 | In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information. |
CVE-2017-9865 | Medium | 5.5 | 2017-06-25 | The function GfxImageColorMap::getGray in GfxState.cc in Poppler 0.54.0 allows remote attackers to cause a denial of service (stack-based buffer over-read and… |
CVE-2017-9840 | High | 8.8 | 2017-06-25 | Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context… |
CVE-2017-9848 | Critical | 9.8 | 2017-06-24 | SQL injection vulnerability in C_InfoService.asmx in WebServices in Easysite 7.0 could allow remote attackers to execute arbitrary SQL commands via an XML docu… |
CVE-2017-9847 | Medium | 5.5 | 2017-06-24 | The bdecode function in bdecode.cpp in libtorrent 1.1.3 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash… |
CVE-2017-9846 | High | 8.8 | 2017-06-24 | Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move_folder_file call to move a .php f… |
CVE-2017-9836 | Medium | 4.8 | 2017-06-24 | Cross-site scripting (XSS) vulnerability in Piwigo 2.9.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the virtual_name… |
CVE-2017-9833 | High | 7.5 | 2017-06-24 | /cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multi… |
CVE-2017-9832 | Medium | 6.8 | 2017-06-24 | An integer overflow vulnerability in ptp-pack.c (ptp_unpack_OPL function) of libmtp (version 1.1.12 and below) allows attackers to cause a denial of service (o… |
CVE-2017-9831 | Medium | 6.8 | 2017-06-24 | An integer overflow vulnerability in the ptp_unpack_EOS_CustomFuncEx function of the ptp-pack.c file of libmtp (version 1.1.12 and below) allows attackers to c… |
CVE-2017-9829 | High | 7.5 | 2017-06-23 | '/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on… |
CVE-2017-9828 | Critical | 9.8 | 2017-06-23 | '/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attacke… |
CVE-2017-9772 | Critical | 9.8 | 2017-06-23 | Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setu… |
CVE-2017-1349 | Medium | 5.5 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 stores potentially sensitive information from HTTP sessions that could be read by a local user. IBM X-Force ID… |
CVE-2017-1348 | Medium | 5.4 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t… |
CVE-2017-1347 | High | 8.8 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could all… |
CVE-2017-1302 | Medium | 5.5 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 could allow a local user view sensitive information due to improper access controls. IBM X-Force ID: 125456. |
CVE-2017-1193 | Medium | 6.5 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 could allow user to obtain sensitive information using an HTTP GET request. IBM X-Force ID: 123667. |
CVE-2017-1132 | Medium | 5.4 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t… |
CVE-2017-1131 | Medium | 6.5 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 could allow an authenticated user to obtain sensitive information by using unsupported, specially crafted HTTP… |
CVE-2017-3948 | Medium | 5.4 | 2017-06-23 | Cross Site Scripting (XSS) in IMG Tags in the ePO extension in McAfee Data Loss Prevention Endpoint (DLP Endpoint) 10.0.x allows authenticated users to inject… |
CVE-2017-9356 | Medium | 6.1 | 2017-06-23 | Sitecore.NET 7.1 through 7.2 has a Cross Site Scripting Vulnerability via the searchStr parameter to the /Search-Results URI. |
CVE-2017-9776 | High | 7.8 | 2017-06-22 | Integer overflow leading to Heap buffer overflow in JBIG2Stream.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (a… |
CVE-2017-9775 | Medium | 6.5 | 2017-06-22 | Stack buffer overflow in GfxState.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) via a crafte… |
CVE-2017-2782 | Medium | 6.5 | 2017-06-22 | An integer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted x509 certificate c… |
CVE-2017-2781 | Critical | 9.8 | 2017-06-22 | An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted x5… |
CVE-2017-2780 | Critical | 9.8 | 2017-06-22 | An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted x5… |
CVE-2017-0897 | High | 7.5 | 2017-06-22 | ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to rem… |
CVE-2017-1326 | Medium | 4.3 | 2017-06-22 | IBM Sterling File Gateway does not properly restrict user requests based on permission level. This allows for users to update data related to other users, by m… |
CVE-2017-9424 | Critical | 9.8 | 2017-06-22 | IdeaBlade Breeze Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization. |
CVE-2017-9815 | Medium | 6.5 | 2017-06-22 | In LibTIFF 4.0.7, the TIFFReadDirEntryLong8Array function in libtiff/tif_dirread.c mishandles a malloc operation, which allows attackers to cause a denial of s… |
CVE-2017-0176 | High | 8.1 | 2017-06-22 | A buffer overflow in Smart Card authentication code in gpkcsp.dll in Microsoft Windows XP through SP3 and Server 2003 through SP2 allows a remote attacker to e… |
CVE-2017-3631 | Medium | 5.3 | 2017-06-22 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11. Easily exploi… |
CVE-2017-3630 | Medium | 5.3 | 2017-06-22 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11. Easily… |
CVE-2017-3629 | High | 7.8 | 2017-06-22 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11. Easily… |
CVE-2017-9807 | Critical | 9.8 | 2017-06-22 | An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an… |
CVE-2017-9782 | Medium | 5.5 | 2017-06-21 | JasPer 2.0.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted image, related to the jp2_… |
CVE-2017-4990 | Critical | 9.8 | 2017-06-21 | In EMC Avamar Server Software 7.4.1-58, 7.4.0-242, 7.3.1-125, 7.3.0-233, 7.3.0-226, an unauthorized attacker may leverage the file upload feature of the system… |
CVE-2017-4989 | Critical | 9.8 | 2017-06-21 | In EMC Avamar Server Software 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401, an unauthenticated remote attacker may potentially bypass the aut… |