2017 CVEs (page 12)
Page 12 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12758 | Critical | 9.8 | 2019-05-09 | https://www.joomlaextensions.co.in/ Joomla! Component Appointment 1.1 is affected by: SQL Injection. The impact is: Code execution (remote). The component is… |
CVE-2017-12757 | Critical | 9.8 | 2019-05-09 | Certain Ambit Technologies Pvt. Ltd products are affected by: SQL Injection. This affects iTech B2B Script 4.42i and Tech Business Networking Script 8.26i and… |
CVE-2017-12839 | High | 8.3 | 2019-05-09 | A heap-based buffer over-read in the getbits function in src/libmpg123/getbits.h in mpg123 through 1.25.5 allows remote attackers to cause a possible denial-of… |
CVE-2017-12790 | Medium | 6.5 | 2019-05-09 | Metinfo 5.3.18 is affected by: Cross Site Request Forgery (CSRF). The impact is: Information Disclosure (remote). The component is: admin/index.php. The attack… |
CVE-2017-12778 | High | 7.1 | 2019-05-09 | The UI Lock feature in qBittorrent version 3.3.15 is vulnerable to Authentication Bypass, which allows Attack to gain unauthorized access to qBittorrent functi… |
CVE-2017-12806 | High | 7.5 | 2019-05-09 | In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which allows attackers to cause a denial of service. |
CVE-2017-12805 | High | 7.5 | 2019-05-09 | In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which allows attackers to cause a denial of service. |
CVE-2017-12804 | Medium | 6.5 | 2019-05-09 | The iwgif_init_screen function in imagew-gif.c:510 in ImageWorsener 1.3.2 allows remote attackers to cause a denial of service (hmemory exhaustion) via a craft… |
CVE-2017-12788 | Medium | 6.1 | 2019-05-09 | Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the… |
CVE-2017-18279 | High | 7.8 | 2019-05-06 | Lack of check of buffer length before copying can lead to buffer overflow in camera module in Small Cell SoC, Snapdragon Mobile, Snapdragon Wear in FSM9055, FS… |
CVE-2017-18278 | High | 7.8 | 2019-05-06 | An integer underflow may occur due to lack of check when received data length from font_mgr_qsee_request_service is bigger than the minimal value of the segmen… |
CVE-2017-18276 | High | 7.8 | 2019-05-06 | Secure camera logic allows display/secure camera controllers to access HLOS memory during secure display or camera session in Snapdragon Mobile, Snapdragon Wea… |
CVE-2017-18275 | Medium | 5.5 | 2019-05-06 | A new account can be inserted into simContacts service using Android command line tool in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in MDM9206… |
CVE-2017-18274 | High | 7.8 | 2019-05-06 | While iterating through the models contained in a fixed-size array in the actData structure, which also stores an incorrect number of models that is greater th… |
CVE-2017-18173 | High | 7.8 | 2019-05-06 | In case of using an invalid android verified boot signature with very large length, an integer underflow occurs in Snapdragon Mobile in SD 425, SD 427, SD 430… |
CVE-2017-18157 | High | 7.8 | 2019-05-06 | A Use After Free Condition can occur in Thermal Engine in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in MDM9206, MDM9607, MDM9650, MSM8909W, MSM… |
CVE-2017-18156 | High | 7.8 | 2019-05-06 | While processing camera buffers in camera driver, a use after free condition can occur in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in MDM9206… |
CVE-2017-18131 | High | 7.8 | 2019-05-06 | In QTEE, an incorrect fuse value can be blown in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MSM8996AU, SD 210/SD 21… |
CVE-2017-15841 | Medium | 5.5 | 2019-05-06 | When HOST sends a Special command ID packet, Controller triggers a RAM Dump and FW reset in Snapdragon Mobile in version SD 410/12, SD 425, SD 427, SD 430, SD… |
CVE-2017-18374 | High | 8.8 | 2019-05-02 | The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has two user accounts with default passwords, including a h… |
CVE-2017-18373 | High | 8.8 | 2019-05-02 | The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded se… |
CVE-2017-18372 | High | 8.8 | 2019-05-02 | The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which… |
CVE-2017-18371 | Critical | 9.8 | 2019-05-02 | The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service a… |
CVE-2017-18370 | High | 8.8 | 2019-05-02 | The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding functio… |
CVE-2017-18369 | Critical | 9.8 | 2019-05-02 | The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which i… |
CVE-2017-18368 | Critical | 9.8 | 2019-05-02 | The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System… |
CVE-2017-16558 | Critical | 9.8 | 2019-04-25 | Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module. |
CVE-2017-18367 | High | 7.5 | 2019-04-24 | libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccom… |
CVE-2017-12619 | High | 8.1 | 2019-04-23 | Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone". |
CVE-2017-11430 | High | 7.7 | 2019-04-17 | OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may… |
CVE-2017-11429 | High | 7.7 | 2019-04-17 | Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able t… |
CVE-2017-11428 | High | 7.7 | 2019-04-17 | OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be a… |
CVE-2017-11427 | High | 7.7 | 2019-04-17 | OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be… |
CVE-2017-7777 | High | 8.8 | 2019-04-15 | Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function. |
CVE-2017-7776 | High | 8.1 | 2019-04-15 | Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph. |
CVE-2017-7774 | Critical | 9.1 | 2019-04-15 | Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function. |
CVE-2017-7773 | High | 8.8 | 2019-04-15 | Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor. |
CVE-2017-7771 | High | 8.1 | 2019-04-15 | Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function. |
CVE-2017-18366 | High | 8.8 | 2019-04-15 | Subrion CMS 4.1.5 has CSRF in blog/delete/. |
CVE-2017-7772 | High | 8.8 | 2019-04-12 | Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function. |
CVE-2017-14199 | Critical | 9.8 | 2019-04-12 | A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0. |
CVE-2017-3139 | High | 7.5 | 2019-04-09 | A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to make named exit unexpectedly with an ass… |
CVE-2017-17023 | High | 8.1 | 2019-04-09 | The Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e.com). The affected client software, "Sophos IPSec Client" 11… |
CVE-2017-17544 | High | 7.2 | 2019-04-09 | A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin users to elevate their profile to super_ad… |
CVE-2017-7912 | Critical | 9.8 | 2019-04-08 | Hanwha Techwin SRN-4000, SRN-4000 firmware versions prior to SRN4000_v2.16_170401, A specially crafted http request and response could allow an attacker to gai… |
CVE-2017-7151 | High | 7.0 | 2019-04-03 | A race condition was addressed with additional validation. This issue affected versions prior to iOS 11.2, macOS High Sierra 10.13.2, tvOS 11.2, watchOS 4.2, i… |
CVE-2017-13911 | High | 7.8 | 2019-04-03 | A configuration issue was addressed with additional restrictions. This issue affected versions prior to macOS X El Capitan 10.11.6 Security Update 2018-002, ma… |
CVE-2017-6049 | High | 7.5 | 2019-04-02 | Detcon Sitewatch Gateway, all versions without cellular, an attacker can edit settings on the device using a specially crafted URL. |
CVE-2017-6047 | Critical | 9.8 | 2019-04-02 | Detcon Sitewatch Gateway, all versions without cellular, Passwords are presented in plaintext in a file that is accessible without authentication. |
CVE-2017-8023 | Critical | 9.8 | 2019-04-01 | EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the Networker Client execution service (nsrexecd) when… |
CVE-2017-16775 | High | 7.1 | 2019-04-01 | Improper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote attackers to conduct… |
CVE-2017-16774 | Medium | 6.5 | 2019-04-01 | Cross-site scripting (XSS) vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager (DSM) before 6.1.4-15217-3 allows remote authe… |
CVE-2017-18111 | High | 8.7 | 2019-03-29 | The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used… |
CVE-2017-18110 | Medium | 6.5 | 2019-03-29 | The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read… |
CVE-2017-18109 | Medium | 6.1 | 2019-03-29 | The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to… |
CVE-2017-18108 | High | 7.2 | 2019-03-29 | The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary… |
CVE-2017-18106 | High | 7.5 | 2019-03-29 | The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in… |
CVE-2017-18105 | High | 8.1 | 2019-03-29 | The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obt… |
CVE-2017-18365 | Critical | 9.8 | 2019-03-28 | The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary co… |
CVE-2017-9626 | Critical | 9.8 | 2019-03-27 | Systems using the Marel Food Processing Systems Pluto platform do not restrict remote access. Marel has created an update for Pluto-based applications. This up… |
CVE-2017-7655 | High | 7.5 | 2019-03-27 | In Eclipse Mosquitto version from 1.0 to 1.4.15, a Null Dereference vulnerability was found in the Mosquitto library which could lead to crashes for those appl… |
CVE-2017-2752 | Low | 2.1 | 2019-03-27 | A potential security vulnerability caused by incomplete obfuscation of application configuration information was discovered in Tommy Hilfiger TH24/7 Android ap… |
CVE-2017-2748 | High | 7.5 | 2019-03-27 | A potential security vulnerability caused by the use of insecure (http) transactions during login has been identified with early versions of the Isaac Mizrahi… |
CVE-2017-18364 | High | 7.4 | 2019-03-27 | phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter. |
CVE-2017-7342 | Critical | 9.8 | 2019-03-25 | A weak password recovery process vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via… |
CVE-2017-7340 | Medium | 6.1 | 2019-03-25 | A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the appli… |
CVE-2017-7510 | High | 8.8 | 2019-03-25 | In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST interface. |
CVE-2017-9376 | Medium | 6.5 | 2019-03-25 | ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfi… |
CVE-2017-9362 | High | 8.8 | 2019-03-25 | ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API. |
CVE-2017-16255 | High | 8.1 | 2019-03-21 | An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012. Specially crafted commands sent… |
CVE-2017-16254 | High | 8.1 | 2019-03-21 | An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012. Specially crafted commands sent… |
CVE-2017-16253 | High | 8.1 | 2019-03-21 | An exploitable buffer overflow vulnerability exists in the PubNub message handler Insteon Hub 2245-222 - Firmware version 1012 for the cc channel of Insteon Hu… |
CVE-2017-2659 | Medium | 5.3 | 2019-03-21 | It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI a… |
CVE-2017-1713 | Medium | 5.9 | 2019-03-21 | IBM InfoSphere Streams 4.2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-For… |
CVE-2017-16232 | High | 7.5 | 2019-03-21 | LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c… |
CVE-2017-16231 | Medium | 5.5 | 2019-03-21 | In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE… |
CVE-2017-3164 | High | 7.5 | 2019-03-08 | Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism… |
CVE-2017-12447 | High | 7.8 | 2019-03-07 | GdkPixBuf (aka gdk-pixbuf), possibly 2.32.2, as used by GNOME Nautilus 3.14.3 on Ubuntu 16.04, allows attackers to cause a denial of service (stack corruption)… |
CVE-2017-15515 | Medium | 4.8 | 2019-03-04 | NetApp SnapCenter Server prior to 4.0 is susceptible to cross site scripting vulnerability that could allow a privileged user to inject arbitrary scripts into… |
CVE-2017-1695 | Medium | 5.9 | 2019-02-15 | IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Forc… |
CVE-2017-0938 | High | 7.5 | 2019-02-12 | Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks. |
CVE-2017-1202 | Medium | 5.4 | 2019-02-05 | IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when v… |
CVE-2017-1200 | Low | 3.7 | 2019-02-05 | IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker… |
CVE-2017-1198 | Low | 3.7 | 2019-02-05 | IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) stores sensitive information in URL parameters. This may lead to information disclosure if unauth… |
CVE-2017-1177 | Medium | 5.3 | 2019-02-05 | IBM BigFix Compliance 1.7 through 1.9.91 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the sys… |
CVE-2017-18362 | Critical | 9.8 | 2019-02-05 | ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya… |
CVE-2017-18361 | High | 7.5 | 2019-02-01 | In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of service via an unclosed… |
CVE-2017-18360 | Medium | 5.5 | 2019-01-31 | In change_port_settings in drivers/usb/serial/io_ti.c in the Linux kernel before 4.11.3, local users could cause a denial of service by division-by-zero in the… |
CVE-2017-18359 | High | 7.5 | 2019-01-25 | PostGIS 2.x before 2.3.3, as used with PostgreSQL, allows remote attackers to cause a denial of service via crafted ST_AsX3D function input, as demonstrated by… |
CVE-2017-17836 | Critical | 9.8 | 2019-01-23 | In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An att… |
CVE-2017-17835 | High | 8.8 | 2019-01-23 | In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow. |
CVE-2017-15720 | High | 8.8 | 2019-01-23 | In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object. |
CVE-2017-6923 | Medium | 6.5 | 2019-01-22 | In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module d… |
CVE-2017-6922 | Medium | 6.5 | 2019-01-22 | In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to… |
CVE-2017-8276 | High | 7.8 | 2019-01-18 | Improper authorization involving a fuse in TrustZone in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MSM8996AU, S… |
CVE-2017-18332 | Medium | 5.5 | 2019-01-18 | Security keys are logged when any WCDMA call is configured or reconfigured in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9607… |
CVE-2017-18331 | High | 7.8 | 2019-01-18 | Improper access control on secure display buffers in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9650, MSM899… |
CVE-2017-18160 | Critical | 9.8 | 2019-01-18 | AGPS session failure in GNSS module due to cyphersuites are hardcoded and needed manual update everytime in snapdragon mobile and snapdragon wear in versions M… |
CVE-2017-3145 | High | 7.5 | 2019-01-16 | BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an ass… |
CVE-2017-3144 | High | 7.5 | 2019-01-16 | A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the D… |