2017 CVEs (page 115)
Page 115 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-7511 | Medium | 5.5 | 2017-05-30 | poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents. |
CVE-2017-7502 | High | 7.5 | 2017-05-30 | Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attac… |
CVE-2017-7494 | Critical | 9.8 | 2017-05-30 | Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a sha… |
CVE-2017-2311 | Medium | 5.3 | 2017-05-30 | On Juniper Networks Junos Space versions prior to 16.1R1, an unauthenticated remote attacker with network access to Junos space device can easily create a deni… |
CVE-2017-2310 | Medium | 5.3 | 2017-05-30 | A firewall bypass vulnerability in the host based firewall of Juniper Networks Junos Space versions prior to 16.1R1 may permit certain crafted packets, represe… |
CVE-2017-2309 | Medium | 5.9 | 2017-05-30 | On Juniper Networks Junos Space versions prior to 16.1R1 when certificate based authentication is enabled for the Junos Space cluster, some restricted web serv… |
CVE-2017-2308 | Medium | 6.5 | 2017-05-30 | An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an authenticated user to read arbitrary files… |
CVE-2017-2307 | Medium | 6.1 | 2017-05-30 | A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions prior to 16.1R1 may allow remote attack… |
CVE-2017-2306 | High | 8.8 | 2017-05-30 | On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web inte… |
CVE-2017-2305 | High | 8.8 | 2017-05-30 | On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web inte… |
CVE-2017-2304 | High | 7.5 | 2017-05-30 | Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices running Junos OS 14.1X53 prior to 14.1X53-D40, 15.1X53 prior to 15.1X53-D40, 15… |
CVE-2017-2303 | High | 7.5 | 2017-05-30 | On Juniper Networks products or platforms running Junos OS 12.1X46 prior to 12.1X46-D50, 12.1X47 prior to 12.1X47-D40, 12.3 prior to 12.3R13, 12.3X48 prior to… |
CVE-2017-2302 | High | 7.5 | 2017-05-30 | On Juniper Networks products or platforms running Junos OS 12.1X46 prior to 12.1X46-D55, 12.1X47 prior to 12.1X47-D45, 12.3R13 prior to 12.3R13, 12.3X48 prior… |
CVE-2017-2301 | High | 7.5 | 2017-05-30 | On Juniper Networks products or platforms running Junos OS 11.4 prior to 11.4R13-S3, 12.1X46 prior to 12.1X46-D60, 12.3 prior to 12.3R12-S2 or 12.3R13, 12.3X48… |
CVE-2017-2300 | High | 7.5 | 2017-05-30 | On Juniper Networks SRX Series Services Gateways chassis clusters running Junos OS 12.1X46 prior to 12.1X46-D65, 12.3X48 prior to 12.3X48-D40, 12.3X48 prior to… |
CVE-2017-9303 | Medium | 6.1 | 2017-05-29 | Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishin… |
CVE-2017-9302 | Medium | 5.5 | 2017-05-29 | RealPlayer 16.0.2.32 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted mp4 file. |
CVE-2017-9301 | High | 7.8 | 2017-05-29 | plugins\audio_filter\libmpgatofixed32_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (invalid read and appl… |
CVE-2017-9300 | High | 7.8 | 2017-05-29 | plugins\codec\libflac_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (heap corruption and application crash… |
CVE-2017-9299 | Medium | 6.1 | 2017-05-29 | Open Ticket Request System (OTRS) 3.3.9 has XSS in index.pl?Action=AgentStats requests, as demonstrated by OrderBy=[XSS] and Direction=[XSS] attacks. NOTE: thi… |
CVE-2017-9298 | Medium | 5.4 | 2017-05-29 | Cross-site scripting vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Replication Manager before 8.5.2-00 allows authenticated remote users… |
CVE-2017-9297 | Medium | 6.1 | 2017-05-29 | Open Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 allows remote attackers to redirect users to arbitrary web sites. |
CVE-2017-9296 | Medium | 6.1 | 2017-05-29 | Open Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Tuning Manager before 8.5.2-00 allows remote attackers to redirect authentica… |
CVE-2017-9295 | Medium | 6.5 | 2017-05-29 | XXE vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Replication Manager before 8.5.2-00 allows authenticated remote users to read arbitrary… |
CVE-2017-9294 | Critical | 9.8 | 2017-05-29 | RMI vulnerability in Hitachi Device Manager before 8.5.2-01 allows remote attackers to execute internal commands without authentication via RMI ports. |
CVE-2017-9292 | Medium | 6.1 | 2017-05-29 | Lansweeper before 6.0.0.65 has XSS in an image retrieval URI, aka Bug 542782. |
CVE-2017-9289 | Medium | 6.1 | 2017-05-29 | Bram Korsten Note through 1.2.0 is vulnerable to a reflected XSS in note-source\ui\editor.php (edit parameter). |
CVE-2017-9148 | Critical | 9.8 | 2017-05-29 | The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent re… |
CVE-2017-9288 | Medium | 6.1 | 2017-05-29 | The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter). |
CVE-2017-9287 | Medium | 6.5 | 2017-05-29 | servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd… |
CVE-2017-7917 | High | 8.8 | 2017-05-29 | A Cross-Site Request Forgery issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1.2 Bu… |
CVE-2017-7915 | Critical | 9.8 | 2017-05-29 | An Improper Restriction of Excessive Authentication Attempts issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, O… |
CVE-2017-7913 | Critical | 9.8 | 2017-05-29 | A Plaintext Storage of a Password issue was discovered in Moxa OnCell G3110-HSPA Version 1.3 build 15082117 and previous versions, OnCell G3110-HSDPA Version 1… |
CVE-2017-9265 | Critical | 9.8 | 2017-05-29 | In Open vSwitch (OvS) v2.7.0, there is a buffer over-read while parsing the group mod OpenFlow message sent from the controller in `lib/ofp-util.c` in the func… |
CVE-2017-9264 | Critical | 9.8 | 2017-05-29 | In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets i… |
CVE-2017-9263 | Medium | 6.5 | 2017-05-29 | In Open vSwitch (OvS) 2.7.0, while parsing an OpenFlow role status message, there is a call to the abort() function for undefined role status reasons in the fu… |
CVE-2017-9262 | Medium | 6.5 | 2017-05-29 | In ImageMagick 7.0.5-6 Q16, the ReadJNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-9261 | Medium | 6.5 | 2017-05-29 | In ImageMagick 7.0.5-6 Q16, the ReadMNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-9252 | Medium | 6.1 | 2017-05-28 | andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action. |
CVE-2017-9251 | Medium | 6.1 | 2017-05-28 | andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter to admin.php. |
CVE-2017-9250 | High | 7.5 | 2017-05-28 | The lexer_process_char_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty strings, which allows r… |
CVE-2017-9249 | Medium | 5.4 | 2017-05-28 | Cross-site scripting (XSS) vulnerability in Allen Disk 1.6 allows remote authenticated users to inject arbitrary web script or HTML persistently by uploading a… |
CVE-2017-9243 | Medium | 6.1 | 2017-05-28 | Aries QWR-1104 Wireless-N Router with Firmware Version WRC.253.2.0913 has XSS on the Wireless Site Survey page, exploitable with the name of an access point. |
CVE-2017-9232 | Critical | 9.8 | 2017-05-28 | Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalatio… |
CVE-2017-7296 | Medium | 6.1 | 2017-05-28 | An issue was discovered in Contiki Operating System 3.0. A Persistent XSS vulnerability is present in the MQTT/IBM Cloud Config page (aka mqtt.html) of cc26xx-… |
CVE-2017-7295 | High | 7.5 | 2017-05-28 | An issue was discovered in Contiki Operating System 3.0. A use-after-free vulnerability exists in httpd-simple.c in cc26xx-web-demo httpd, where upon a connect… |
CVE-2017-9242 | Medium | 5.5 | 2017-05-27 | The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structur… |
CVE-2017-7731 | High | 7.5 | 2017-05-27 | A weak password recovery vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows attacker to carry out information disclosure via the Forgotten P… |
CVE-2017-7343 | Medium | 6.1 | 2017-05-27 | An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url parameter. |
CVE-2017-7339 | Medium | 6.1 | 2017-05-27 | A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the 'Name… |
CVE-2017-7338 | High | 7.5 | 2017-05-27 | A password management vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to carry out information disclosure via the FortiAnalyz… |
CVE-2017-7337 | Critical | 9.1 | 2017-05-27 | An improper Access Control vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to interact with unauthorized VDOMs or enumerate o… |
CVE-2017-3134 | High | 7.2 | 2017-05-27 | An escalation of privilege vulnerability in Fortinet FortiWLC-SD versions 8.2.4 and below allows attacker to gain root access via the CLI command 'copy running… |
CVE-2017-3129 | Medium | 6.1 | 2017-05-27 | A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5.7.1 and below allows attacker to execute unauthorized code or commands via an improperly s… |
CVE-2017-3126 | Medium | 6.1 | 2017-05-27 | An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code… |
CVE-2017-5646 | Medium | 6.8 | 2017-05-26 | For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while accessing WebHDFS th… |
CVE-2017-8542 | Medium | 5.5 | 2017-05-26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W… |
CVE-2017-8541 | High | 7.8 | 2017-05-26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W… |
CVE-2017-8540 | High | 7.8 | 2017-05-26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W… |
CVE-2017-8539 | Medium | 5.5 | 2017-05-26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W… |
CVE-2017-8538 | High | 7.8 | 2017-05-26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W… |
CVE-2017-8537 | Medium | 5.5 | 2017-05-26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W… |
CVE-2017-8536 | Medium | 5.5 | 2017-05-26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W… |
CVE-2017-8535 | Medium | 5.5 | 2017-05-26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W… |
CVE-2017-6862 | Critical | 9.8 | 2017-05-26 | NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code… |
CVE-2017-7505 | High | 8.8 | 2017-05-26 | Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organiz… |
CVE-2017-1325 | Medium | 6.1 | 2017-05-26 | IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering th… |
CVE-2017-1292 | Medium | 5.3 | 2017-05-26 | IBM Maximo Asset Management 7.5 and 7.6 generates error messages that could reveal sensitive information that could be used in further attacks against the syst… |
CVE-2017-1291 | Medium | 5.4 | 2017-05-26 | IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-cr… |
CVE-2017-9239 | Medium | 6.5 | 2017-05-26 | An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue()… |
CVE-2017-9037 | Medium | 6.1 | 2017-05-26 | Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web sc… |
CVE-2017-9036 | High | 7.8 | 2017-05-26 | Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows local users to gain privileges by leveraging an unrestricted quarantine directory. |
CVE-2017-9035 | High | 7.4 | 2017-05-26 | Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to eavesdrop and tamper with updates by leveraging unencrypted communications with upda… |
CVE-2017-9034 | Critical | 9.8 | 2017-05-26 | Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code with root privilege… |
CVE-2017-9033 | High | 8.8 | 2017-05-26 | Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication… |
CVE-2017-9032 | Medium | 6.1 | 2017-05-26 | Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web sc… |
CVE-2017-7439 | High | 7.5 | 2017-05-26 | NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors involving error messa… |
CVE-2017-7236 | High | 7.5 | 2017-05-26 | SQL injection vulnerability in NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 allows remote attackers to execute arbitrary SQL commands via u… |
CVE-2017-5868 | Medium | 6.1 | 2017-05-26 | CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently cond… |
CVE-2017-9230 | High | 7.5 | 2017-05-24 | The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology related to 80-byte block headers with a variety of initial 64-byte chunks fo… |
CVE-2017-9229 | High | 7.5 | 2017-05-24 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_c… |
CVE-2017-9228 | Critical | 9.8 | 2017-05-24 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs… |
CVE-2017-9227 | Critical | 9.8 | 2017-05-24 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs… |
CVE-2017-9226 | Critical | 9.8 | 2017-05-24 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or rea… |
CVE-2017-9225 | Critical | 9.8 | 2017-05-24 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in on… |
CVE-2017-9224 | Critical | 9.8 | 2017-05-24 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs… |
CVE-2017-2824 | High | 8.1 | 2017-05-24 | An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a… |
CVE-2017-2823 | High | 7.8 | 2017-05-24 | A use-after-free vulnerability exists in the .ISO parsing functionality of PowerISO 6.8. A specially crafted .ISO file can cause a vulnerability resulting in p… |
CVE-2017-2819 | High | 8.8 | 2017-05-24 | An exploitable heap-based buffer overflow exists in the Hangul Word Processor component (version 9.6.1.4350) of Hancom Thinkfree Office NEO 9.6.1.4902. A speci… |
CVE-2017-2817 | High | 8.8 | 2017-05-24 | A stack buffer overflow vulnerability exists in the ISO parsing functionality of Power Software Ltd PowerISO 6.8. A specially crafted ISO file can cause a vuln… |
CVE-2017-2801 | Medium | 6.5 | 2017-05-24 | A programming error exists in a way Randombit Botan cryptographic library version 2.0.1 implements x500 string comparisons which could lead to certificate veri… |
CVE-2017-2800 | Critical | 9.8 | 2017-05-24 | A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vu… |
CVE-2017-2799 | High | 8.3 | 2017-05-24 | An exploitable heap corruption vulnerability exists in the AddSst functionality of Antenna House DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted… |
CVE-2017-2798 | High | 8.3 | 2017-05-24 | An exploitable heap corruption vulnerability exists in the GetIndexArray functionality of Antenna House DMC HTMLFilter as used by MarkLogic 8.0-6. A specially… |
CVE-2017-9217 | High | 7.5 | 2017-05-24 | systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS response with an empty question section. |
CVE-2017-9216 | Medium | 6.5 | 2017-05-24 | libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c… |
CVE-2017-8314 | Medium | 5.5 | 2017-05-23 | Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles. |
CVE-2017-8313 | Medium | 5.5 | 2017-05-23 | Heap out-of-bound read in ParseJSS in VideoLAN VLC before 2.2.5 due to missing check of string termination allows attackers to read data beyond allocated memor… |
CVE-2017-8312 | Medium | 5.5 | 2017-05-23 | Heap out-of-bound read in ParseJSS in VideoLAN VLC due to missing check of string length allows attackers to read heap uninitialized data via a crafted subtitl… |
CVE-2017-8311 | High | 7.8 | 2017-05-23 | Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute ar… |