2017 CVEs (page 121)
Page 121 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2681 | Medium | 6.5 | 2017-05-11 | Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial of service condition of that prod… |
CVE-2017-8798 | Critical | 9.8 | 2017-05-11 | Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of service or possibly have unspecified oth… |
CVE-2017-5461 | Critical | 9.8 | 2017-05-11 | Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attack… |
CVE-2017-2680 | Medium | 6.5 | 2017-05-11 | Specially crafted PROFINET DCP broadcast packets could cause a denial of service condition of affected products on a local Ethernet segment (Layer 2). Human in… |
CVE-2017-8895 | Critical | 9.8 | 2017-05-10 | In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple… |
CVE-2017-8892 | Medium | 6.1 | 2017-05-10 | Cross-site scripting (XSS) vulnerability in OpenText Tempo Box 10.0.3 allows remote attackers to inject arbitrary web script or HTML persistently via the name… |
CVE-2017-8852 | High | 7.8 | 2017-05-10 | SAP SAPCAR 721.510 has a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted CAR archive file received from an untrusted remote sour… |
CVE-2017-8891 | Medium | 5.5 | 2017-05-10 | Dropbox Lepton 1.2.1 allows DoS (SEGV and application crash) via a malformed lepton file because the code does not ensure setup of a correct number of threads. |
CVE-2017-8890 | High | 7.8 | 2017-05-10 | The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double f… |
CVE-2017-3894 | Medium | 6.1 | 2017-05-10 | A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, and all versions of BE… |
CVE-2017-8879 | Medium | 6.8 | 2017-05-10 | Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain acces… |
CVE-2017-7888 | Critical | 9.8 | 2017-05-10 | Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier. |
CVE-2017-7887 | Medium | 6.1 | 2017-05-10 | Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter. |
CVE-2017-7886 | Critical | 9.8 | 2017-05-10 | Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter. |
CVE-2017-7698 | High | 7.8 | 2017-05-10 | A Use After Free in the pdf2swf part of swftools 0.9.2 and earlier allows remote attackers to execute arbitrary code via a malformed PDF document, possibly a c… |
CVE-2017-4896 | Low | 3.8 | 2017-05-10 | Airwatch Inbox for Android contains a vulnerability that may allow a rooted device to decrypt the local data used by the application. Successful exploitation o… |
CVE-2017-4895 | High | 8.8 | 2017-05-10 | Airwatch Agent for Android contains a vulnerability that may allow a device to bypass root detection. Successful exploitation of this issue may result in an en… |
CVE-2017-1137 | High | 8.1 | 2017-05-10 | IBM WebSphere Application Server 8.0 and 8.5.5 could provide weaker than expected security. A remote attacker could exploit this weakness to obtain sensitive i… |
CVE-2017-1103 | High | 8.1 | 2017-05-10 | IBM Team Concert (RTC) is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker… |
CVE-2017-8878 | Medium | 6.5 | 2017-05-10 | ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 allow remote authenticated users to discover the Wi-Fi password via WPS_info.xml. |
CVE-2017-8877 | Medium | 6.5 | 2017-05-10 | ASUS RT-AC* and RT-N* devices with firmware through 3.0.0.4.380.7378 allow JSONP Information Disclosure such as the SSID. |
CVE-2017-8876 | Medium | 6.1 | 2017-05-10 | Symphony 2 2.6.11 has XSS in the meta[navigation_group] parameter to content/content.blueprintssections.php. |
CVE-2017-8875 | Medium | 6.5 | 2017-05-10 | CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL. |
CVE-2017-8874 | High | 8.8 | 2017-05-10 | Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that (1) d… |
CVE-2017-8872 | Critical | 9.1 | 2017-05-10 | The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure. |
CVE-2017-8868 | High | 7.5 | 2017-05-10 | acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk might be limited to… |
CVE-2017-5892 | High | 7.5 | 2017-05-10 | ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 allow JSONP Information Disclosure such as a network map. |
CVE-2017-5891 | High | 8.8 | 2017-05-10 | ASUS RT-AC* and RT-N* devices with firmware before 3.0.0.4.380.7378 have Login Page CSRF and Save Settings CSRF. |
CVE-2017-8859 | Critical | 9.8 | 2017-05-09 | In Veritas NetBackup Appliance 3.0 and earlier, unauthenticated users can execute arbitrary commands as root. |
CVE-2017-8858 | Critical | 9.8 | 2017-05-09 | In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated privileged remote file write using the 'bprd' process. |
CVE-2017-8857 | Critical | 9.8 | 2017-05-09 | In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated file copy and arbitrary remote command execution using t… |
CVE-2017-8856 | Critical | 9.8 | 2017-05-09 | In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated, arbitrary remote command execution using the 'bprd' pro… |
CVE-2017-0355 | Medium | 5.5 | 2017-05-09 | All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgkDdiEscape where it may access paged memo… |
CVE-2017-0354 | Medium | 4.7 | 2017-05-09 | All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgkDdiEscape where a call to certain functi… |
CVE-2017-0353 | Medium | 5.5 | 2017-05-09 | All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where due to improper locking on certai… |
CVE-2017-0352 | High | 7.8 | 2017-05-09 | All versions of the NVIDIA GPU Display Driver contain a vulnerability in the GPU firmware where incorrect access control may allow CPU access sensitive GPU con… |
CVE-2017-0351 | High | 7.8 | 2017-05-09 | All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user… |
CVE-2017-0350 | High | 7.8 | 2017-05-09 | All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not co… |
CVE-2017-0349 | High | 7.8 | 2017-05-09 | All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer… |
CVE-2017-0348 | High | 7.8 | 2017-05-09 | All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where a NULL pointer dereference… |
CVE-2017-0347 | High | 7.8 | 2017-05-09 | All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value p… |
CVE-2017-0346 | High | 7.8 | 2017-05-09 | All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size… |
CVE-2017-0345 | High | 7.8 | 2017-05-09 | All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where user provi… |
CVE-2017-0344 | High | 7.8 | 2017-05-09 | All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape may allow users… |
CVE-2017-0343 | High | 7.0 | 2017-05-09 | All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) where user can trigger a race condition d… |
CVE-2017-0342 | High | 7.8 | 2017-05-09 | All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where incorrect calculation may c… |
CVE-2017-0341 | High | 7.8 | 2017-05-09 | All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where user provi… |
CVE-2017-8855 | High | 7.5 | 2017-05-09 | wolfSSL before 3.11.0 does not prevent wc_DhAgree from accepting a malformed DH key. |
CVE-2017-8854 | High | 7.8 | 2017-05-09 | wolfSSL before 3.10.2 has an out-of-bounds memory access with loading crafted DH parameters, aka a buffer overflow triggered by a malformed temporary DH file. |
CVE-2017-5527 | Medium | 4.3 | 2017-05-09 | TIBCO Spotfire Server 7.0.X before 7.0.2, 7.5.x before 7.5.1, 7.6.x before 7.6.1, 7.7.x before 7.7.1, and 7.8.x before 7.8.1 and Spotfire Analytics Platform fo… |
CVE-2017-7967 | Medium | 5.5 | 2017-05-09 | All versions of VAMPSET software produced by Schneider Electric, prior to V2.2.189, are susceptible to a memory corruption vulnerability when a corrupted vf2 f… |
CVE-2017-8853 | High | 7.5 | 2017-05-09 | Fiyo CMS v2.0.7 has an arbitrary file delete vulnerability in dapur/apps/app_config/controller/backuper.php via directory traversal in the file parameter durin… |
CVE-2017-3074 | High | 8.8 | 2017-05-09 | Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Graphics class. Successful exploitation could lea… |
CVE-2017-3073 | High | 8.8 | 2017-05-09 | Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when handling multiple mask properties of display objects… |
CVE-2017-3072 | High | 8.8 | 2017-05-09 | Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the BitmapData class. Successful exploitation could l… |
CVE-2017-3071 | High | 8.8 | 2017-05-09 | Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when masking display objects. Successful exploitation could… |
CVE-2017-3070 | High | 8.8 | 2017-05-09 | Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the ConvolutionFilter class. Successful exploitation… |
CVE-2017-3069 | High | 8.8 | 2017-05-09 | Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the BlendMode class. Successful exploitation could le… |
CVE-2017-3068 | High | 8.8 | 2017-05-09 | Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Advanced Video Coding engine. Successful exploita… |
CVE-2017-3067 | High | 7.5 | 2017-05-09 | Adobe Experience Manager Forms versions 6.2, 6.1, 6.0 have an information disclosure vulnerability resulting from abuse of the pre-population service in AEM Fo… |
CVE-2017-6137 | Medium | 5.9 | 2017-05-09 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, and WebSafe 11.6.1 HF1, 12.0.0 HF3, 12.0.0… |
CVE-2017-0302 | Medium | 5.3 | 2017-05-09 | In F5 BIG-IP APM 12.0.0 through 12.1.2 and 13.0.0, an authenticated user with an established access session to the BIG-IP APM system may be able to cause a tra… |
CVE-2017-0290 | High | 7.8 | 2017-05-09 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W… |
CVE-2017-4982 | Critical | 9.8 | 2017-05-08 | EMC Mainframe Enablers ResourcePak Base versions 7.6.0, 8.0.0, and 8.1.0 contains a fix for a privilege management vulnerability that could potentially be expl… |
CVE-2017-0895 | Low | 3.5 | 2017-05-08 | Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content… |
CVE-2017-0894 | Medium | 4.3 | 2017-05-08 | Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potenti… |
CVE-2017-0893 | Medium | 5.4 | 2017-05-08 | Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which suffered from a XSS… |
CVE-2017-0892 | Low | 3.5 | 2017-05-08 | Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to… |
CVE-2017-0891 | Medium | 5.4 | 2017-05-08 | Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabilities in multiple comp… |
CVE-2017-0890 | Medium | 5.4 | 2017-05-08 | Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to wri… |
CVE-2017-8848 | Medium | 6.5 | 2017-05-08 | Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password. |
CVE-2017-6953 | High | 7.8 | 2017-05-08 | Gemalto SmartDiag Diagnosis Tool v2.5 has a stack-based Buffer Overflow with SEH Overwrite via long "Register a new card" input fields. There may be a risk of… |
CVE-2017-6051 | High | 7.0 | 2017-05-08 | An Uncontrolled Search Path Element issue was discovered in BLF-Tech LLC VisualView HMI Version 9.9.14.0 and prior. The uncontrolled search path element vulner… |
CVE-2017-8825 | High | 7.5 | 2017-05-08 | A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in… |
CVE-2017-8847 | Medium | 5.5 | 2017-05-08 | The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL pointer dereference a… |
CVE-2017-8846 | Medium | 5.5 | 2017-05-08 | The read_stream function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (use-after-free and application crash)… |
CVE-2017-8845 | Medium | 5.5 | 2017-05-08 | The lzo1x_decompress function in lzo1x_d.ch in LZO 2.08, as used in lrzip 0.631, allows remote attackers to cause a denial of service (invalid memory read and… |
CVE-2017-8844 | High | 7.8 | 2017-05-08 | The read_1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (heap-based buffer overflow and application… |
CVE-2017-8843 | Medium | 5.5 | 2017-05-08 | The join_pthread function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (NULL pointer dereference and applicat… |
CVE-2017-8842 | Medium | 5.5 | 2017-05-08 | The bufRead::get() function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service (divide-by-zero error and a… |
CVE-2017-8833 | Medium | 6.1 | 2017-05-08 | Zen Cart 1.6.0 has XSS in the main_page parameter to index.php. NOTE: 1.6.0 is not an official release but the vendor's README.md file offers a link to v160.zi… |
CVE-2017-8832 | Medium | 6.1 | 2017-05-08 | Allen Disk 1.6 has XSS in the id parameter to downfile.php. |
CVE-2017-8831 | Medium | 6.4 | 2017-05-08 | The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5 allows local users to cause a denial of service (out… |
CVE-2017-8830 | Medium | 6.5 | 2017-05-08 | In ImageMagick 7.0.5-6, the ReadBMPImage function in bmp.c:1379 allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8829 | High | 7.8 | 2017-05-08 | Deserialization vulnerability in lintian through 2.5.50.3 allows attackers to trigger code execution by requesting a review of a source package with a crafted… |
CVE-2017-8827 | Critical | 9.1 | 2017-05-08 | forgotpassword.php in GeniXCMS 1.0.2 lacks a rate limit, which might allow remote attackers to cause a denial of service (login inability) or possibly conduct… |
CVE-2017-8804 | High | 7.5 | 2017-05-07 | The xdr_bytes and xdr_string functions in the GNU C Library (aka glibc or libc6) 2.25 mishandle failures of buffer deserialization, which allows remote attacke… |
CVE-2017-8391 | Medium | 5.5 | 2017-05-06 | The OS Installation Management component in CA Client Automation r12.9, r14.0, and r14.0 SP1 places an encrypted password into a readable local file during ope… |
CVE-2017-7929 | High | 7.1 | 2017-05-06 | An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has been identified, wh… |
CVE-2017-7927 | High | 7.3 | 2017-05-06 | A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW… |
CVE-2017-7925 | Critical | 9.8 | 2017-05-06 | A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-… |
CVE-2017-7923 | High | 8.8 | 2017-05-06 | A Password in Configuration File issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0… |
CVE-2017-7921 | Critical | 9.8 | 2017-05-06 | An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build… |
CVE-2017-7911 | High | 8.8 | 2017-05-06 | A Code Injection issue was discovered in CyberVision Kaa IoT Platform, Version 0.7.4. An insufficient-encapsulation vulnerability has been identified, which ma… |
CVE-2017-7909 | Critical | 9.8 | 2017-05-06 | A Use of Client-Side Authentication issue was discovered in Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior. The web interface uses JavaScrip… |
CVE-2017-6031 | High | 8.8 | 2017-05-06 | A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax"… |
CVE-2017-6029 | Medium | 5.4 | 2017-05-06 | A Cross-Site Scripting issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. This may allow remote code execution. |
CVE-2017-6024 | Medium | 5.9 | 2017-05-06 | A Resource Exhaustion issue was discovered in Rockwell Automation ControlLogix 5580 controllers V28.011, V28.012, and V28.013; ControlLogix 5580 controllers V2… |
CVE-2017-8801 | Medium | 6.1 | 2017-05-05 | Trend Micro OfficeScan 11.0 before SP1 CP 6325 (with Agent Module Build before 6152) and XG before CP 1352 has XSS via a crafted URI using a blocked website. |
CVE-2017-1156 | High | 8.8 | 2017-05-05 | IBM WebSphere Portal 8.5 and 9.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a sp… |