2017 CVEs (page 116)
Page 116 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-8310 | Medium | 5.5 | 2017-05-23 | Heap out-of-bound read in CreateHtmlSubtitle in VideoLAN VLC 2.2.x due to missing check of string termination allows attackers to read data beyond allocated me… |
CVE-2017-0374 | High | 7.8 | 2017-05-23 | lib/Config/Model.pm in Config-Model (aka libconfig-model-perl) before 2.102 allows local users to gain privileges via a crafted model in the current working di… |
CVE-2017-0373 | High | 7.3 | 2017-05-23 | The gen_class_pod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model (aka libconfig-model-perl) before 2.102 has a dangerous "use lib" lin… |
CVE-2017-9214 | Critical | 9.8 | 2017-05-23 | In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integ… |
CVE-2017-3128 | Medium | 4.8 | 2017-05-23 | A stored XSS (Cross-Site-Scripting) vulnerability in Fortinet FortiOS allows attackers to execute unauthorized code or commands via the policy global-label par… |
CVE-2017-2797 | High | 8.3 | 2017-05-23 | An exploitable heap overflow vulnerability exists in the ParseEnvironment functionality of AntennaHouse DMC HTMLFilter as used by MarkLogic 8.0-6. |
CVE-2017-2794 | High | 8.3 | 2017-05-23 | An exploitable stack-based buffer overflow vulnerability exists in the DHFSummary functionality of AntennaHouse DMC HTMLFilter as used by MarkLogic 8.0-6. A sp… |
CVE-2017-2793 | High | 8.3 | 2017-05-23 | An exploitable heap corruption vulnerability exists in the UnCompressUnicode functionality of Antenna House DMC HTMLFilter used by MarkLogic 8.0-6. A specially… |
CVE-2017-2783 | High | 8.3 | 2017-05-23 | An exploitable heap corruption vulnerability exists in the FillRowFormat functionality of Antenna House DMC HTMLFilter that is shipped with MarkLogic 8.0-6. A… |
CVE-2017-6131 | Critical | 9.8 | 2017-05-23 | In some circumstances, an F5 BIG-IP version 12.0.0 to 12.1.2 and 13.0.0 Azure cloud instance may contain a default administrative password which could be used… |
CVE-2017-9212 | High | 7.5 | 2017-05-23 | The Bluetooth stack on the BMW 330i 2011 allows a remote crash of the CD/Multimedia software via %x or %c format string specifiers in a device name. |
CVE-2017-9211 | Medium | 5.5 | 2017-05-23 | The crypto_skcipher_init_tfm function in crypto/skcipher.c in the Linux kernel through 4.11.2 relies on a setkey function that lacks a key-size check, which al… |
CVE-2017-5966 | Medium | 4.9 | 2017-05-23 | Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute path traversal attack on sitecore/shell/download… |
CVE-2017-5965 | Medium | 6.7 | 2017-05-23 | The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP code by creating a ZIP archive in which… |
CVE-2017-9210 | Medium | 5.5 | 2017-05-23 | libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to… |
CVE-2017-9209 | Medium | 5.5 | 2017-05-23 | libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to… |
CVE-2017-9208 | Medium | 5.5 | 2017-05-23 | libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to… |
CVE-2017-9207 | Medium | 6.5 | 2017-05-23 | The iw_get_ui16be function in imagew-util.c:422:24 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (heap-base… |
CVE-2017-9206 | Medium | 6.5 | 2017-05-23 | The iw_get_ui16le function in imagew-util.c:405:23 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (heap-base… |
CVE-2017-9205 | Medium | 6.5 | 2017-05-23 | The iw_get_ui16be function in imagew-util.c:422:24 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (invalid r… |
CVE-2017-9204 | Medium | 6.5 | 2017-05-23 | The iw_get_ui16le function in imagew-util.c:405:23 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (invalid r… |
CVE-2017-9203 | Medium | 6.5 | 2017-05-23 | imagew-main.c:960:12 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (buffer underflow) via a crafted image… |
CVE-2017-9202 | Medium | 6.5 | 2017-05-23 | imagew-cmd.c:854:45 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted imag… |
CVE-2017-9201 | Medium | 6.5 | 2017-05-23 | imagew-cmd.c:850:46 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted imag… |
CVE-2017-9200 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:528:63. |
CVE-2017-9199 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:192:19. |
CVE-2017-9198 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:508:18. |
CVE-2017-9197 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:498:55. |
CVE-2017-9196 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a "negative-size-param" issue in the ReadImage function in input-tga.c:528:7. |
CVE-2017-9195 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:620:27. |
CVE-2017-9194 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:559:29. |
CVE-2017-9193 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:538:33. |
CVE-2017-9192 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-tga.c:528:7. |
CVE-2017-9191 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the rle_fread function in input-tga.c:252:15. |
CVE-2017-9190 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid free), related to the free_bitmap function in bitmap.c:24:5. |
CVE-2017-9189 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and application crash), related to the GET_COLOR function… |
CVE-2017-9188 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a "left shift ... cannot be represented in type int" issue in input-bmp.c:516:63. |
CVE-2017-9187 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:486:7. |
CVE-2017-9186 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:326:17. |
CVE-2017-9185 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:319:7. |
CVE-2017-9184 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:314:7. |
CVE-2017-9183 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:309:7. |
CVE-2017-9182 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (use-after-free and invalid heap read), related to the GET_COLOR functi… |
CVE-2017-9181 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bm… |
CVE-2017-9180 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp… |
CVE-2017-9179 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp… |
CVE-2017-9178 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bm… |
CVE-2017-9177 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp… |
CVE-2017-9176 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bm… |
CVE-2017-9175 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bm… |
CVE-2017-9174 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the GET_COLOR function in color.c:2… |
CVE-2017-9173 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:497:29. |
CVE-2017-9172 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:496:29. |
CVE-2017-9171 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-bmp.c:492:24. |
CVE-2017-9170 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:370:25. |
CVE-2017-9169 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:355:25. |
CVE-2017-9168 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:353:25. |
CVE-2017-9167 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:337:25. |
CVE-2017-9166 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:18:11. |
CVE-2017-9165 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:17:11. |
CVE-2017-9164 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:16:11. |
CVE-2017-9163 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in pxl-outline.c:106:54. |
CVE-2017-9162 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in autotrace.c:191:2. |
CVE-2017-9161 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in autotrace.c:188:23. |
CVE-2017-9160 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a stack-based buffer overflow in the pnmscanner_gettoken function in input-pnm.c:458:12. |
CVE-2017-9159 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_rawpbm function in in… |
CVE-2017-9158 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_raw function in input… |
CVE-2017-9157 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_ascii function in inp… |
CVE-2017-9156 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_ascii function in inp… |
CVE-2017-9155 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the input_pnm_reader function in in… |
CVE-2017-9154 | High | 7.5 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the GET_COLOR function in color.c:1… |
CVE-2017-9153 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the pnm_load_rawpbm function in input-pnm.c:391:13. |
CVE-2017-9152 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the pnm_load_raw function in input-pnm.c:346:41. |
CVE-2017-9151 | Critical | 9.8 | 2017-05-23 | libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the pnm_load_ascii function in input-pnm.c:303:12. |
CVE-2017-8915 | High | 7.5 | 2017-05-23 | sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to cause a denial of service (assertion failure and service crash) by pushing a package… |
CVE-2017-8914 | High | 8.3 | 2017-05-23 | sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to hijack npm packages or host arbitrary files by leveraging an insecure user creation p… |
CVE-2017-8913 | High | 8.8 | 2017-05-23 | The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via a cra… |
CVE-2017-8379 | Medium | 6.5 | 2017-05-23 | Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host… |
CVE-2017-8309 | High | 7.5 | 2017-05-23 | Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting… |
CVE-2017-7288 | Medium | 6.1 | 2017-05-23 | Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) before 8.7.1 allows remote attackers to inject arbitrary web script or HTML via un… |
CVE-2017-6821 | Critical | 9.8 | 2017-05-23 | Directory traversal vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.7.6 allows attackers to have unspecified impact via unknown vectors. |
CVE-2017-6813 | Critical | 9.8 | 2017-05-23 | A service provided by Zimbra Collaboration Suite (ZCS) before 8.7.6 fails to require needed privileges before performing a few requested operations. |
CVE-2017-5870 | Medium | 5.4 | 2017-05-23 | Multiple cross-site scripting (XSS) vulnerabilities in ViMbAdmin 3.0.15 allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2)… |
CVE-2017-9150 | Medium | 5.5 | 2017-05-22 | The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allow_ptr_leaks value available for restricting the output o… |
CVE-2017-1320 | Medium | 5.4 | 2017-05-22 | IBM Tivoli Federated Identity Manager 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2017-1289 | High | 8.2 | 2017-05-22 | IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnera… |
CVE-2017-1282 | Medium | 5.4 | 2017-05-22 | IBM Content Navigator & CMIS 2.0 and 3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2017-1159 | Medium | 5.4 | 2017-05-22 | IBM Business Process Manager 8.0 and 8.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to vi… |
CVE-2017-1092 | Critical | 9.8 | 2017-05-22 | IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. IBM X-Force ID… |
CVE-2017-9149 | High | 7.5 | 2017-05-22 | Metadata Anonymisation Toolkit (MAT) 0.6 and 0.6.1 silently fails to perform "Clean metadata" actions upon invocation from the Nautilus contextual menu, which… |
CVE-2017-6891 | High | 8.8 | 2017-05-22 | Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow… |
CVE-2017-9147 | Medium | 6.5 | 2017-05-22 | LibTIFF 4.0.7 has an invalid read in the _TIFFVGetField function in tif_dir.c, which might allow remote attackers to cause a denial of service (crash) via a cr… |
CVE-2017-9146 | High | 8.8 | 2017-05-22 | The TNEFFillMapi function in lib/ytnef.c in libytnef in ytnef through 1.9.2 does not ensure a nonzero count value before a certain memory allocation, which all… |
CVE-2017-5657 | High | 8.0 | 2017-05-22 | Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same brows… |
CVE-2017-2175 | High | 7.8 | 2017-05-22 | Untrusted search path vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to gain privileges via a Trojan horse DLL in a… |
CVE-2017-2174 | Medium | 6.1 | 2017-05-22 | Cross-site scripting vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to inject arbitrary web script or HTML via unsp… |
CVE-2017-2173 | Medium | 5.4 | 2017-05-22 | Cross-site scripting vulnerability in Empirical Project Monitor - eXtended all versions allows remote authenticated attackers to inject arbitrary web script or… |
CVE-2017-2171 | Medium | 6.1 | 2017-05-22 | Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact For… |
CVE-2017-2169 | Medium | 6.1 | 2017-05-22 | Cross-site scripting vulnerability in MaxButtons prior to version 6.19 and MaxButtons Pro prior to version 6.19 allows remote attackers to inject arbitrary web… |
CVE-2017-2168 | Medium | 6.1 | 2017-05-22 | Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows rem… |