2017 CVEs (page 119)
Page 119 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-4012 | Medium | 6.5 | 2017-05-17 | Privilege Escalation vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential inf… |
CVE-2017-4011 | Medium | 6.1 | 2017-05-17 | Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/c… |
CVE-2017-9031 | Critical | 9.8 | 2017-05-17 | The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associ… |
CVE-2017-7493 | High | 7.8 | 2017-05-17 | Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper access control issue. It… |
CVE-2017-9030 | High | 7.5 | 2017-05-17 | The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows a directory traversal attack that bypasses a uniqid protection mechanis… |
CVE-2017-8849 | High | 7.8 | 2017-05-17 | smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service. |
CVE-2017-8422 | High | 7.8 | 2017-05-17 | KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and leveraging a privileged helper app. |
CVE-2017-5215 | Critical | 9.8 | 2017-05-17 | The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows a rename attack that bypasses a "safe file extension" protection mechan… |
CVE-2017-5214 | High | 7.5 | 2017-05-17 | The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows prediction of a uniqid value based on knowledge of a time value. This m… |
CVE-2017-9026 | Critical | 9.8 | 2017-05-17 | Stack buffer overflow in vshttpd (aka ioos) in HooToo Trip Mate 6 (TM6) firmware 2.000.030 and earlier allows remote unauthenticated attackers to control the p… |
CVE-2017-9025 | Medium | 6.5 | 2017-05-17 | Heap buffer overflow in vshttpd (aka ioos) in HooToo Trip Mate 6 (TM6) firmware 2.000.030 and earlier allows remote unauthenticated attackers to control the pr… |
CVE-2017-7488 | Medium | 4.3 | 2017-05-16 | Authconfig version 6.2.8 is vulnerable to an Information exposure while using SSSD to authenticate against remote server resulting in the leak of information a… |
CVE-2017-7662 | High | 8.8 | 2017-05-16 | Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to… |
CVE-2017-7661 | High | 8.8 | 2017-05-16 | Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnera… |
CVE-2017-6658 | High | 7.5 | 2017-05-16 | Cisco Sourcefire Snort 3.0 before build 233 has a Buffer Overread related to use of a decoder array. The size was off by one making it possible to read past th… |
CVE-2017-6657 | High | 7.5 | 2017-05-16 | Cisco Sourcefire Snort 3.0 before build 233 mishandles Ether Type Validation. Since valid ether type and IP protocol numbers do not overlap, Snort++ stores all… |
CVE-2017-6651 | High | 7.5 | 2017-05-16 | A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information that could allow them to access scheduled cust… |
CVE-2017-6079 | Critical | 9.8 | 2017-05-16 | The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden page that allows for user-defined commands such as specific iptables… |
CVE-2017-3882 | Critical | 9.6 | 2017-05-16 | A vulnerability in the Universal Plug-and-Play (UPnP) implementation in the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, Layer 2-adjacen… |
CVE-2017-3876 | High | 7.5 | 2017-05-16 | A vulnerability in the Event Management Service daemon (emsd) of Cisco IOS XR routers could allow an unauthenticated, remote attacker to cause a denial of serv… |
CVE-2017-3873 | High | 7.5 | 2017-05-16 | A vulnerability in the Plug-and-Play (PnP) subsystem of the Cisco Aironet 1800, 2800, and 3800 Series Access Points running a Lightweight Access Point (AP) or… |
CVE-2017-3825 | High | 7.5 | 2017-05-16 | A vulnerability in the ICMP ingress packet processing of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an unauthenticated, remote attacke… |
CVE-2017-6887 | High | 7.8 | 2017-05-16 | A boundary error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to cause a memory corrupt… |
CVE-2017-6886 | Critical | 9.8 | 2017-05-16 | An error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to corrupt memory. |
CVE-2017-6885 | Critical | 9.8 | 2017-05-16 | An error when handling certain external commands and services related to the FlexNet Inventory Agent and FlexNet Beacon of the Flexera Software FlexNet Manager… |
CVE-2017-8382 | Medium | 4.5 | 2017-05-16 | admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts. |
CVE-2017-7953 | Medium | 5.4 | 2017-05-16 | INFOR EAM V11.0 Build 201410 has XSS via comment fields. |
CVE-2017-7952 | High | 8.8 | 2017-05-16 | INFOR EAM V11.0 Build 201410 has SQL injection via search fields, related to the filtervalue parameter. |
CVE-2017-8943 | Medium | 5.9 | 2017-05-15 | The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain s… |
CVE-2017-8942 | Medium | 5.9 | 2017-05-15 | The YottaMark ShopWell - Healthy Diet & Grocery Food Scanner app 5.3.7 through 5.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows… |
CVE-2017-8941 | Medium | 5.9 | 2017-05-15 | The Interval International app 3.3 through 3.5.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… |
CVE-2017-8940 | Medium | 5.9 | 2017-05-15 | The Zipongo - Healthy Recipes and Grocery Deals app before 6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atta… |
CVE-2017-8939 | Medium | 5.9 | 2017-05-15 | The Warner Bros. ellentube app 3.1.1 through 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spo… |
CVE-2017-8938 | Medium | 5.9 | 2017-05-15 | The Radio Javan app 9.3.4 through 9.6.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers… |
CVE-2017-8937 | Medium | 5.9 | 2017-05-15 | The Life Before Us Yo app 2.5.8 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obta… |
CVE-2017-8936 | Medium | 5.9 | 2017-05-15 | The MoboTap Dolphin Web Browser - Fast Private Internet Search app 9.23.0 through 9.23.2 for iOS does not verify X.509 certificates from SSL servers, which all… |
CVE-2017-8935 | Medium | 5.9 | 2017-05-15 | The Quest Information Systems Indiana Voters app 1.1.24 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers t… |
CVE-2017-8927 | High | 7.8 | 2017-05-15 | Buffer overflow in Larson VizEx Reader 9.7.5 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .tif file. |
CVE-2017-8926 | High | 7.8 | 2017-05-15 | Buffer overflow in Halliburton LogView Pro 10.0.1 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .tif fi… |
CVE-2017-7495 | Medium | 5.5 | 2017-05-15 | fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which allows local users… |
CVE-2017-7479 | Medium | 6.5 | 2017-05-15 | OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of ser… |
CVE-2017-7478 | High | 7.5 | 2017-05-15 | OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed… |
CVE-2017-6890 | Critical | 9.8 | 2017-05-15 | A boundary error within the "foveon_load_camf()" function (dcraw_foveon.c) when initializing a huffman table in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be… |
CVE-2017-6889 | Critical | 9.8 | 2017-05-15 | An integer overflow error within the "foveon_load_camf()" function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a heap… |
CVE-2017-0252 | Critical | 9.8 | 2017-05-15 | A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory. aka "Scripting Engi… |
CVE-2017-0223 | Critical | 9.8 | 2017-05-15 | A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory. aka "Scripting Engi… |
CVE-2017-8934 | Medium | 5.5 | 2017-05-15 | PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (application unavailability). |
CVE-2017-8933 | Low | 3.3 | 2017-05-15 | Libmenu-cache 1.0.2 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (menu unavailability). |
CVE-2017-7491 | Medium | 4.3 | 2017-05-15 | In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration s… |
CVE-2017-7490 | Medium | 5.3 | 2017-05-15 | In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing. |
CVE-2017-7489 | Medium | 6.3 | 2017-05-15 | In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link. |
CVE-2017-5655 | Medium | 6.5 | 2017-05-15 | In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari Server host. The temporary files are read… |
CVE-2017-7213 | Critical | 10.0 | 2017-05-15 | Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected active desktops via unspecified vectors. |
CVE-2017-8930 | High | 8.8 | 2017-05-14 | Multiple cross-site request forgery (CSRF) vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for r… |
CVE-2017-8929 | High | 7.5 | 2017-05-14 | The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) v… |
CVE-2017-8928 | High | 8.8 | 2017-05-14 | mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF. |
CVE-2017-7487 | High | 7.8 | 2017-05-14 | The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through 4.11.1 mishandles reference counts, which allows local users to cause a denial of ser… |
CVE-2017-8925 | Medium | 5.5 | 2017-05-12 | The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of service (tty exhaustion) by… |
CVE-2017-8924 | Medium | 4.6 | 2017-05-12 | The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information (in the d… |
CVE-2017-5654 | High | 7.5 | 2017-05-12 | In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthorized read access to files on the host w… |
CVE-2017-8923 | Critical | 9.8 | 2017-05-12 | The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which a… |
CVE-2017-8246 | High | 7.8 | 2017-05-12 | In function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel, prtd is assigned substream->runtime->private_data. Later, prtd is… |
CVE-2017-8245 | High | 7.8 | 2017-05-12 | In all Android releases from CAF using the Linux kernel, while processing a voice SVC request which is nonstandard by specifying a payload size that will overf… |
CVE-2017-8244 | High | 7.0 | 2017-05-12 | In core_info_read and inst_info_read in all Android releases from CAF using the Linux kernel, variable "dbg_buf", "dbg_buf->curr" and "dbg_buf->filled_size" co… |
CVE-2017-8921 | High | 7.5 | 2017-05-12 | In FlightGear before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but not with arbitrary data: only with the con… |
CVE-2017-7486 | High | 7.5 | 2017-05-12 | PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE pri… |
CVE-2017-7485 | Medium | 5.9 | 2017-05-12 | In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was… |
CVE-2017-7484 | High | 7.5 | 2017-05-12 | It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x be… |
CVE-2017-7474 | Critical | 9.8 | 2017-05-12 | It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and… |
CVE-2017-2167 | High | 7.8 | 2017-05-12 | Untrusted search path vulnerability in Installer for PrimeDrive Desktop Application version 1.4.4 and earlier allows remote attackers to execute arbitrary code… |
CVE-2017-2164 | Medium | 6.1 | 2017-05-12 | Cross-site scripting vulnerability in SOY CMS with installer 1.8.12 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified… |
CVE-2017-2163 | High | 7.5 | 2017-05-12 | Directory traversal vulnerability in SOY CMS Ver.1.8.1 to Ver.1.8.12 allows authenticated attackers to read arbitrary files via shop_id. |
CVE-2017-2157 | High | 7.3 | 2017-05-12 | Untrusted search path vulnerability in installers for The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver… |
CVE-2017-2122 | Medium | 5.4 | 2017-05-12 | Cross-site scripting vulnerability in Nessus versions 6.8.0, 6.8.1, 6.9.0, 6.9.1 and 6.9.2 allows remote authenticated attackers to inject arbitrary web script… |
CVE-2017-0635 | Medium | 5.5 | 2017-05-12 | A remote denial of service vulnerability in HevcUtils.cpp in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a… |
CVE-2017-0634 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outside of its permission… |
CVE-2017-0633 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Broadcom Wi-Fi driver could enable a local malicious component to access data outside of its permission levels… |
CVE-2017-0632 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm sound codec driver could enable a local malicious application to access data outside of its permission… |
CVE-2017-0631 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission level… |
CVE-2017-0630 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the kernel trace subsystem could enable a local malicious application to access data outside of its permission level… |
CVE-2017-0629 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission level… |
CVE-2017-0628 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission level… |
CVE-2017-0627 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the kernel UVC driver could enable a local malicious application to access data outside of its permission levels. Th… |
CVE-2017-0626 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm crypto engine driver could enable a local malicious application to access data outside of its permissio… |
CVE-2017-0625 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability in the MediaTek command queue driver could enable a local malicious application to access data outside of its permissio… |
CVE-2017-0624 | Medium | 5.5 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0623 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the HTC bootloader could enable a local malicious application to execute arbitrary code within the context of the bo… |
CVE-2017-0622 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Goodix touchscreen driver could enable a local malicious application to execute arbitrary code within the contex… |
CVE-2017-0621 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2017-0620 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm Secure Channel Manager driver could enable a local malicious application to execute arbitrary code with… |
CVE-2017-0619 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm pin controller driver could enable a local malicious application to execute arbitrary code within the c… |
CVE-2017-0618 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the MediaTek command queue driver could enable a local malicious application to execute arbitrary code within the co… |
CVE-2017-0617 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the MediaTek video driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0616 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the MediaTek system management interrupt driver could enable a local malicious application to execute arbitrary code… |
CVE-2017-0615 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the MediaTek power driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0614 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious application to execute… |
CVE-2017-0613 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious application to execute… |
CVE-2017-0612 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious application to execute… |
CVE-2017-0611 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0610 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of… |