2017 CVEs (page 113)
Page 113 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-9127 | Medium | 6.5 | 2017-06-12 | The quicktime_user_atoms_read_atom function in useratoms.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overfl… |
CVE-2017-9126 | Medium | 6.5 | 2017-06-12 | The quicktime_read_dref_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and app… |
CVE-2017-9125 | Medium | 6.5 | 2017-06-12 | The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via… |
CVE-2017-9124 | Medium | 6.5 | 2017-06-12 | The quicktime_match_32 function in util.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application… |
CVE-2017-9123 | Medium | 6.5 | 2017-06-12 | The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (invalid memory read and applicat… |
CVE-2017-9122 | Medium | 6.5 | 2017-06-12 | The quicktime_read_moov function in moov.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a… |
CVE-2017-8871 | Medium | 6.5 | 2017-06-12 | The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consum… |
CVE-2017-8834 | Medium | 6.5 | 2017-06-12 | The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a craft… |
CVE-2017-9542 | Critical | 9.8 | 2017-06-11 | D-Link DIR-615 Wireless N 300 Router allows authentication bypass via a modified POST request to login.cgi. This issue occurs because it fails to validate the… |
CVE-2017-9527 | High | 7.8 | 2017-06-11 | The mark_context_stack function in gc.c in mruby through 1.2.0 allows attackers to cause a denial of service (heap-based use-after-free and application crash)… |
CVE-2017-9526 | Medium | 5.9 | 2017-06-11 | In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key (from side-channel observation during the signing process) can easily recover the long-… |
CVE-2017-5004 | Medium | 5.4 | 2017-06-09 | EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2 (all patch levels); RSA Via Lifecycle and Governance version 7.0 (all patch levels); and RSA Id… |
CVE-2017-5003 | Medium | 6.1 | 2017-06-09 | EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2 (all patch levels); RSA Via Lifecycle and Governance version 7.0 (all patch levels); and RSA Id… |
CVE-2017-0376 | High | 7.5 | 2017-06-09 | The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell funct… |
CVE-2017-0375 | High | 7.5 | 2017-06-09 | The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function… |
CVE-2017-9525 | Medium | 6.7 | 2017-06-09 | In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root priv… |
CVE-2017-2219 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in the [Simeji for Windows] installer (simeji.exe) allows an attacker to gain privileges via a Trojan horse DLL in an unspe… |
CVE-2017-2214 | High | 8.4 | 2017-06-09 | Untrusted search path vulnerability in AppCheck and AppCheck Pro prior to version 2.0.1.15 allows an attacker to execute arbitrary code via a specially crafted… |
CVE-2017-2213 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in SemiDynaEXE (SemiDynaEXE2008.EXE) ver. 1.0.2 allows an attacker to gain privileges via a Trojan horse DLL in an unspecif… |
CVE-2017-2212 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in TKY2JGD (TKY2JGD1379.EXE) ver. 1.3.79 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified dir… |
CVE-2017-2211 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in PatchJGD (Hyoko) (PatchJGDh101.EXE) ver. 1.0.1 allows an attacker to gain privileges via a Trojan horse DLL in an unspec… |
CVE-2017-2210 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in PatchJGD (PatchJGD101.EXE) ver. 1.0.1 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified dir… |
CVE-2017-2209 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in the installer of Houkokusyo Sakusei Shien Tool ver3.0.2 (For the first installation) (The version which was available on… |
CVE-2017-2207 | High | 8.8 | 2017-06-09 | Untrusted search path vulnerability in the installer of SaAT Personal ver.1.0.10.272 and earlier allows an attacker to gain privileges via a Trojan horse DLL i… |
CVE-2017-2206 | High | 8.8 | 2017-06-09 | Untrusted search path vulnerability in the installer of SaAT Netizen ver.1.2.10.510 and earlier allows an attacker to gain privileges via a Trojan horse DLL in… |
CVE-2017-2195 | High | 8.8 | 2017-06-09 | SQL injection vulnerability in the Multi Feed Reader prior to version 2.2.4 allows authenticated attackers to execute arbitrary SQL commands via unspecified ve… |
CVE-2017-2193 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in the installer of Tera Term 4.94 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecifi… |
CVE-2017-2192 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in RW-5100 tool to verify execution environment for Windows 7 version 1.1.0.0 and RW-5100 tool to verify execution environm… |
CVE-2017-2191 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in RW-5100 driver installer for Windows 7 version 1.0.0.9 and RW-5100 driver installer for Windows 8.1 version 1.0.1.0 allo… |
CVE-2017-2190 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in RW-4040 tool to verify execution environment for Windows 7 version 1.2.0.0 allows an attacker to gain privileges via a T… |
CVE-2017-2189 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in RW-4040 driver installer for Windows 7 version 2.27 allows an attacker to gain privileges via a Trojan horse DLL in an u… |
CVE-2017-2187 | Medium | 6.1 | 2017-06-09 | Cross-site scripting vulnerability in WP Live Chat Support prior to version 7.0.07 allows remote attackers to inject arbitrary web script or HTML via unspecifi… |
CVE-2017-2182 | High | 8.8 | 2017-06-09 | Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors, a d… |
CVE-2017-2181 | High | 8.8 | 2017-06-09 | Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors, a d… |
CVE-2017-2180 | Medium | 4.3 | 2017-06-09 | Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allow remote attackers to obtain local files via unspecified vectors. |
CVE-2017-2179 | High | 8.8 | 2017-06-09 | Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.2 and earlier allows remote code execution via unspecified vectors, a different vulnera… |
CVE-2017-2178 | High | 8.8 | 2017-06-09 | Untrusted search path vulnerability in Installer of electronic tendering and bid opening system available prior to May 25, 2017 allows an attacker to gain priv… |
CVE-2017-2177 | High | 8.8 | 2017-06-09 | Untrusted search path vulnerability in Installer of Shogyo Touki Denshi Ninsho Software Ver 1.7 and earlier allows an attacker to gain privileges via a Trojan… |
CVE-2017-2176 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in screensaver installers (jasdf_01.exe, jasdf_02.exe, jasdf_03.exe, jasdf_04.exe, jasdf_05.exe, scramble_setup.exe, clock_… |
CVE-2017-2165 | Medium | 6.5 | 2017-06-09 | GroupSession versions 4.6.4 and earlier allows remote authenticated attackers to bypass access restrictions to obtain sensitive information such as emails via… |
CVE-2017-9523 | Medium | 6.1 | 2017-06-09 | The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342. |
CVE-2017-1319 | High | 7.5 | 2017-06-08 | IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted session (SSL) cookie. IBM X-Force ID: 1… |
CVE-2017-1179 | Medium | 5.9 | 2017-06-08 | IBM BigFix Compliance Analytics 1.9.79 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2017-1140 | Medium | 5.4 | 2017-06-08 | IBM Business Process Manager 8.0 and 8.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2017-4918 | Critical | 9.8 | 2017-06-08 | VMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service startup script. Successful exploitation… |
CVE-2017-9330 | Medium | 5.6 | 2017-06-08 | QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of service (infinite loop… |
CVE-2017-9310 | Medium | 5.6 | 2017-06-08 | QEMU (aka Quick Emulator), when built with the e1000e NIC emulation support, allows local guest OS privileged users to cause a denial of service (infinite loop… |
CVE-2017-9023 | High | 7.5 | 2017-06-08 | The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers to cause a denial of… |
CVE-2017-9022 | High | 7.5 | 2017-06-08 | The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers to cause a denial o… |
CVE-2017-8108 | High | 7.8 | 2017-06-08 | Unspecified tests in Lynis before 2.5.0 allow local users to write to arbitrary files or possibly gain privileges via a symlink attack on a temporary file. |
CVE-2017-5878 | Critical | 9.8 | 2017-06-08 | The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to exe… |
CVE-2017-9520 | Medium | 5.5 | 2017-06-08 | The r_config_set function in libr/config/config.c in radare2 1.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash)… |
CVE-2017-9519 | High | 8.8 | 2017-06-08 | atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account. |
CVE-2017-9518 | High | 8.8 | 2017-06-08 | atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails. |
CVE-2017-9517 | High | 8.8 | 2017-06-08 | atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV. |
CVE-2017-9516 | Medium | 5.4 | 2017-06-08 | Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file. |
CVE-2017-6648 | High | 7.5 | 2017-06-08 | A vulnerability in the Session Initiation Protocol (SIP) of the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software could allow an unauthent… |
CVE-2017-6640 | Critical | 9.8 | 2017-06-08 | A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an unauthenticated, remote attacker to log in to the administrative cons… |
CVE-2017-6639 | Critical | 9.8 | 2017-06-08 | A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) could allow an unauthenticated, remote… |
CVE-2017-6638 | High | 7.8 | 2017-06-08 | A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install an… |
CVE-2017-4913 | High | 7.8 | 2017-06-08 | VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain an integer-overflow vulnerability in the True Type Font parser i… |
CVE-2017-4912 | High | 7.8 | 2017-06-08 | VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds read vulnerabilities in TrueType Font (TT… |
CVE-2017-4911 | High | 7.8 | 2017-06-08 | VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds write vulnerabilities in JPEG2000 parser… |
CVE-2017-4910 | High | 7.8 | 2017-06-08 | VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds read vulnerabilities in JPEG2000 parser i… |
CVE-2017-4909 | High | 7.8 | 2017-06-08 | VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain a heap buffer-overflow vulnerability in TrueType Font (TTF) pars… |
CVE-2017-4908 | High | 7.8 | 2017-06-08 | VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple heap buffer-overflow vulnerabilities in JPEG2000 parser… |
CVE-2017-4907 | Critical | 9.8 | 2017-06-08 | VMware Unified Access Gateway (2.5.x, 2.7.x, 2.8.x prior to 2.8.1) and Horizon View (7.x prior to 7.1.0, 6.x prior to 6.2.4) contain a heap buffer-overflow vul… |
CVE-2017-4901 | Critical | 9.9 | 2017-06-08 | The drag-and-drop (DnD) function in VMware Workstation 12.x before version 12.5.4 and Fusion 8.x before version 8.5.5 has an out-of-bounds memory access vulner… |
CVE-2017-7180 | High | 7.3 | 2017-06-08 | Net Monitor for Employees Pro through 5.3.4 has an unquoted service path, which allows a Security Feature Bypass of its documented "Block applications" design… |
CVE-2017-9355 | High | 7.4 | 2017-06-07 | XML external entity (XXE) vulnerability in the import playlist feature in Subsonic 6.1.1 might allow remote attackers to conduct server-side request forgery (S… |
CVE-2017-7966 | High | 8.8 | 2017-06-07 | A DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute arbitrary code on t… |
CVE-2017-7965 | High | 7.3 | 2017-06-07 | A buffer overflow vulnerability exists in Programming Software executable AlTracePrint.exe, in Schneider Electric's SoMachine HVAC v2.1.0 for Modicon M171/M172… |
CVE-2017-4905 | Medium | 5.5 | 2017-06-07 | VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch… |
CVE-2017-4904 | High | 8.8 | 2017-06-07 | The XHCI controller in VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG… |
CVE-2017-4903 | High | 8.8 | 2017-06-07 | VMware ESXi 6.5 without patch ESXi650-201703410-SG, 6.0 U3 without patch ESXi600-201703401-SG, 6.0 U2 without patch ESXi600-201703403-SG, 6.0 U1 without patch… |
CVE-2017-4902 | High | 8.8 | 2017-06-07 | VMware ESXi 6.5 without patch ESXi650-201703410-SG and 5.5 without patch ESXi550-201703401-SG; Workstation Pro / Player 12.x prior to 12.5.5; and Fusion Pro /… |
CVE-2017-4900 | Medium | 5.5 | 2017-06-07 | VMware Workstation Pro/Player 12.x before 12.5.3 contains a NULL pointer dereference vulnerability that exists in the SVGA driver. Successful exploitation of t… |
CVE-2017-4899 | Medium | 4.7 | 2017-06-07 | VMware Workstation Pro/Player 12.x before 12.5.3 contains a security vulnerability that exists in the SVGA driver. An attacker may exploit this issue to crash… |
CVE-2017-4898 | High | 8.8 | 2017-06-07 | VMware Workstation Pro/Player 12.x before 12.5.3 contains a DLL loading vulnerability that occurs due to the "vmware-vmx" process loading DLLs from a path defi… |
CVE-2017-4917 | Critical | 9.8 | 2017-06-07 | VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This issue may allow… |
CVE-2017-4914 | Critical | 9.8 | 2017-06-07 | VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to… |
CVE-2017-1305 | Medium | 5.4 | 2017-06-07 | IBM DOORS Next Generation (DNG/RRC) 6.0.2 and 6.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i… |
CVE-2017-1196 | Critical | 9.8 | 2017-06-07 | IBM BigFix Compliance (TEMA SUAv1 SCA SCM) 1.9.70 does not require that users should have strong passwords by default, which makes it easier for attackers to c… |
CVE-2017-1178 | Medium | 6.1 | 2017-06-07 | IBM Endpoint Manager for Security and Compliance 1.9.70 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript co… |
CVE-2017-1125 | Low | 3.3 | 2017-06-07 | IBM Cognos Analytics 10.1 and 10.2 could allow a local user to craft a URL which could confirm the existence of and expose postial contents of a file. IBM X-Fo… |
CVE-2017-7564 | High | 7.5 | 2017-06-07 | In ARM Trusted Firmware through 1.3, the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of service (secure world p… |
CVE-2017-7563 | High | 8.1 | 2017-06-07 | In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT_EXECUTE_NEVER protection mechanism. This… |
CVE-2017-9501 | Medium | 6.5 | 2017-06-07 | In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function LockSemaphoreInfo, which allows attackers to cause a denial of service via a crafted… |
CVE-2017-9500 | Medium | 6.5 | 2017-06-07 | In ImageMagick 7.0.5-8 Q16, an assertion failure was found in the function ResetImageProfileIterator, which allows attackers to cause a denial of service via a… |
CVE-2017-9499 | Medium | 6.5 | 2017-06-07 | In ImageMagick 7.0.5-7 Q16, an assertion failure was found in the function SetPixelChannelAttributes, which allows attackers to cause a denial of service via a… |
CVE-2017-7314 | High | 7.5 | 2017-06-07 | An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables… |
CVE-2017-7313 | High | 7.5 | 2017-06-07 | An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Cust… |
CVE-2017-7312 | Critical | 9.8 | 2017-06-07 | An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read existing vend… |
CVE-2017-9474 | Medium | 5.5 | 2017-06-07 | In ytnef 1.9.2, the DecompressRTF function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and application cra… |
CVE-2017-9473 | Medium | 5.5 | 2017-06-07 | In ytnef 1.9.2, the TNEFFillMapi function in lib/ytnef.c allows remote attackers to cause a denial of service (memory consumption) via a crafted file. |
CVE-2017-9472 | Medium | 5.5 | 2017-06-07 | In ytnef 1.9.2, the SwapDWord function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash)… |
CVE-2017-9471 | Medium | 5.5 | 2017-06-07 | In ytnef 1.9.2, the SwapWord function in lib/ytnef.c allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) v… |
CVE-2017-9470 | Medium | 5.5 | 2017-06-07 | In ytnef 1.9.2, the MAPIPrint function in lib/ytnef.c allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via… |
CVE-2017-9469 | High | 7.5 | 2017-06-07 | In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus… |
CVE-2017-9468 | High | 7.5 | 2017-06-07 | In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a c… |