2017 CVEs (page 11)
Page 11 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-11580 | Medium | 6.5 | 2019-07-02 | Blipcare Wifi blood pressure monitor BP700 10.1 devices allow memory corruption that results in Denial of Service. When connected to the "Blip" open wireless c… |
CVE-2017-11579 | High | 7.1 | 2019-07-02 | In the most recent firmware for Blipcare, the device provides an open Wireless network called "Blip" for communicating with the device. The user connects to th… |
CVE-2017-11578 | Medium | 5.9 | 2019-07-02 | It was discovered as a part of the research on IoT devices in the most recent firmware for Blipcare device that the device allows to connect to web management… |
CVE-2017-8414 | High | 7.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by… |
CVE-2017-8410 | Critical | 9.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by th… |
CVE-2017-8409 | High | 7.5 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device requires that a user logging to the device to provide a username and password. However, the devi… |
CVE-2017-8406 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a crossdomain.xml file with no restrictions on who can access the webserver. This allow… |
CVE-2017-8405 | High | 7.5 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by th… |
CVE-2017-8411 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by… |
CVE-2017-8407 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of changing the administrative password for the web manageme… |
CVE-2017-8404 | Critical | 9.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by… |
CVE-2017-8408 | Critical | 9.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by… |
CVE-2017-5028 | Medium | 6.5 | 2019-06-27 | Insufficient data validation in V8 in Google Chrome prior to 56.0.2924.76 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2017-17945 | Critical | 9.1 | 2019-06-24 | The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation. |
CVE-2017-15694 | Medium | 6.5 | 2019-06-21 | When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can modify internal cl… |
CVE-2017-17944 | Critical | 9.1 | 2019-06-20 | The ASUS Vivobaby application before 1.1.09 for Android has Missing SSL Certificate Validation. |
CVE-2017-14395 | Medium | 6.1 | 2019-06-19 | Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect… |
CVE-2017-14394 | Medium | 6.1 | 2019-06-19 | OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirec… |
CVE-2017-1107 | Medium | 4.3 | 2019-06-19 | IBM Marketing Platform 9.1.0, 9.1.2, 10.0, and 10.1 exposes sensitive information in the headers that could be used by an authenticated attacker in further att… |
CVE-2017-8337 | High | 8.8 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of executing… |
CVE-2017-8334 | High | 8.0 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of blocking… |
CVE-2017-8332 | High | 8.8 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of blocking… |
CVE-2017-8330 | Medium | 6.5 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a UPnP functionality for devices to int… |
CVE-2017-8328 | High | 8.8 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of changing… |
CVE-2017-8333 | High | 8.8 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of adding ne… |
CVE-2017-8331 | High | 8.8 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of adding ne… |
CVE-2017-8329 | Medium | 6.4 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of setting a… |
CVE-2017-8336 | High | 8.8 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of adding ne… |
CVE-2017-8335 | High | 8.0 | 2019-06-18 | An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of setting n… |
CVE-2017-10724 | High | 8.8 | 2019-06-17 | Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connected to the device W… |
CVE-2017-10723 | High | 8.8 | 2019-06-17 | Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that an attacker connected to the device W… |
CVE-2017-10722 | High | 7.8 | 2019-06-17 | Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to conne… |
CVE-2017-10721 | Medium | 6.5 | 2019-06-17 | Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has Telnet functionality e… |
CVE-2017-10720 | High | 7.8 | 2019-06-17 | Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the desktop application used to conne… |
CVE-2017-10719 | Medium | 6.5 | 2019-06-17 | Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that the device has default Wi-Fi credenti… |
CVE-2017-10718 | Medium | 6.5 | 2019-06-17 | Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that any malicious user connecting to the… |
CVE-2017-9392 | High | 8.8 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be… |
CVE-2017-9391 | High | 8.8 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be… |
CVE-2017-9390 | Medium | 6.1 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called connect.sh which is supposed to return… |
CVE-2017-9389 | High | 8.8 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device… |
CVE-2017-9387 | Medium | 5.4 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called relay.sh which is used for creating new… |
CVE-2017-9386 | Medium | 6.5 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a script file called "get_file.sh" which allows a user to ret… |
CVE-2017-9385 | Critical | 9.8 | 2019-06-17 | An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to the standard web interface which allows… |
CVE-2017-9383 | Critical | 9.9 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be… |
CVE-2017-9382 | Medium | 6.5 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are available on port 3480 and can also be… |
CVE-2017-9384 | High | 8.8 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device… |
CVE-2017-9381 | High | 8.8 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a user with the capability of installing or deleting apps on… |
CVE-2017-9388 | High | 8.8 | 2019-06-17 | An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device… |
CVE-2017-8252 | Medium | 5.5 | 2019-06-14 | Kernel can inject faults in computations during the execution of TrustZone leading to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2017-15123 | Medium | 5.3 | 2019-06-12 | A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An atta… |
CVE-2017-18378 | High | 8.4 | 2019-06-11 | In NETGEAR ReadyNAS Surveillance before 1.4.3-17 x86 and before 1.1.4-7 ARM, $_GET['uploaddir'] is not escaped and is passed to system() through $tmp_upload_di… |
CVE-2017-18377 | Critical | 9.8 | 2019-06-11 | An issue was discovered on Wireless IP Camera (P2P) WIFICAM cameras. There is Command Injection in the set_ftp.cgi script via shell metacharacters in the pwd v… |
CVE-2017-13718 | High | 8.0 | 2019-06-10 | The HTTP API supported by Starry Station (aka Starry Router) allows brute forcing the PIN setup by the user on the device, and this allows an attacker to chang… |
CVE-2017-13717 | High | 8.8 | 2019-06-10 | Starry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "*". This allows any hosted file on any domain to make calls to the device's… |
CVE-2017-6261 | High | 8.2 | 2019-06-05 | NVIDIA Vibrante Linux version 1.1, 2.0, and 2.2 contains a vulnerability in the user space driver in which protection mechanisms are insufficient, may lead to… |
CVE-2017-14854 | Critical | 9.1 | 2019-06-03 | A stack buffer overflow exists in one of the Orpak SiteOmat CGI components, allowing for remote code execution. The vulnerability affects all versions prior to… |
CVE-2017-14853 | High | 8.6 | 2019-06-03 | The Orpak SiteOmat OrCU component is vulnerable to code injection, for all versions prior to 2017-09-25, due to a search query that uses a direct shell command… |
CVE-2017-14852 | High | 8.6 | 2019-06-03 | An insecure communication was found between a user and the Orpak SiteOmat management console for all known versions, due to an invalid SSL certificate. The att… |
CVE-2017-14851 | Critical | 9.8 | 2019-06-03 | A SQL injection vulnerability exists in all Orpak SiteOmat versions prior to 2017-09-25. The vulnerability is in the login page, where the authentication valid… |
CVE-2017-14850 | Medium | 6.1 | 2019-06-03 | All known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site Scripting due to improper external use… |
CVE-2017-14728 | Critical | 9.8 | 2019-06-03 | An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this expl… |
CVE-2017-18376 | High | 8.8 | 2019-06-02 | An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before 3.3.1 allows users with read-only or read/write access to escalate thei… |
CVE-2017-18375 | High | 8.8 | 2019-05-24 | Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php. |
CVE-2017-13667 | Critical | 9.9 | 2019-05-23 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF. |
CVE-2017-11560 | Medium | 5.4 | 2019-05-23 | An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTM… |
CVE-2017-11559 | High | 7.5 | 2019-05-23 | An issue was discovered in ZOHO ManageEngine OpManager 12.2. The 'apiKey' parameter of "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotover… |
CVE-2017-11557 | Medium | 5.3 | 2019-05-23 | An issue was discovered in ZOHO ManageEngine Applications Manager 12.3. It is possible for an unauthenticated user to view the list of domain names and usernam… |
CVE-2017-11365 | Critical | 9.8 | 2019-05-23 | Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The ty… |
CVE-2017-13668 | Medium | 5.4 | 2019-05-23 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). |
CVE-2017-11740 | High | 8.8 | 2019-05-23 | In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occur… |
CVE-2017-11739 | Medium | 6.1 | 2019-05-23 | In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashbo… |
CVE-2017-11738 | High | 8.1 | 2019-05-23 | In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/auditLogAction.do' module is vulnerable to a Time-based Blind… |
CVE-2017-11561 | Medium | 6.5 | 2019-05-23 | An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" sectio… |
CVE-2017-5213 | Medium | 6.1 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS). |
CVE-2017-5212 | Critical | 9.8 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control. |
CVE-2017-5211 | High | 7.5 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing. |
CVE-2017-5210 | Critical | 9.8 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure. |
CVE-2017-17061 | Medium | 5.4 | 2019-05-23 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). |
CVE-2017-17060 | Critical | 9.8 | 2019-05-23 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions. |
CVE-2017-15652 | Medium | 5.5 | 2019-05-23 | Artifex Ghostscript 9.22 is affected by: Obtain Information. The impact is: obtain sensitive information. The component is: affected source code file, affected… |
CVE-2017-15030 | Medium | 6.1 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). |
CVE-2017-15029 | Medium | 4.3 | 2019-05-23 | Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF. |
CVE-2017-9808 | Medium | 6.1 | 2019-05-22 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). |
CVE-2017-8777 | High | 7.2 | 2019-05-22 | Open-Xchange GmbH OX Cloud Plugins 1.4.0 and earlier is affected by: Missing Authorization. |
CVE-2017-8341 | Medium | 5.3 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing. |
CVE-2017-8340 | High | 8.8 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. |
CVE-2017-6912 | High | 8.8 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. |
CVE-2017-5984 | Medium | 6.5 | 2019-05-22 | In libavcodec in Libav 9.21, ff_h264_execute_ref_pic_marking() has a heap-based buffer over-read. |
CVE-2017-5871 | Medium | 5.4 | 2019-05-22 | Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact is: obtain sensitive information (remote). |
CVE-2017-5864 | Medium | 6.1 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS). |
CVE-2017-5863 | Critical | 9.8 | 2019-05-22 | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. |
CVE-2017-9809 | Medium | 5.3 | 2019-05-22 | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure. |
CVE-2017-6514 | Medium | 5.3 | 2019-05-22 | WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/… |
CVE-2017-12884 | High | 7.5 | 2019-05-10 | OX Software GmbH App Suite 7.8.4 and earlier is affected by: Information Exposure. |
CVE-2017-12885 | Medium | 6.1 | 2019-05-10 | OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). |
CVE-2017-12795 | Critical | 9.8 | 2019-05-10 | OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation). |
CVE-2017-12789 | High | 8.8 | 2019-05-10 | Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/interface/online/dele… |
CVE-2017-12761 | High | 7.5 | 2019-05-09 | http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download (remote). The component is: $file… |
CVE-2017-12760 | High | 8.8 | 2019-05-09 | Ynet Interactive - http://demo.ynetinteractive.com/mobiketa/ Mobiketa 4.0 is affected by: SQL Injection. The impact is: Code execution (remote). |
CVE-2017-12759 | Critical | 9.8 | 2019-05-09 | Ynet Interactive - http://demo.ynetinteractive.com/soa/ SOA School Management 3.0 is affected by: SQL Injection. The impact is: Code execution (remote). |