2017 CVEs (page 122)
Page 122 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-8799 | Critical | 9.8 | 2017-05-05 | Untrusted input execution via igetwild in all iRODS versions before 4.1.11 and 4.2.1 allows other iRODS users (potentially anonymous) to execute remote shell c… |
CVE-2017-8796 | Critical | 9.8 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because mysql_real_escape_string is misused, seos/courier/communication_p2p.php allows SQ… |
CVE-2017-8795 | Medium | 6.1 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in home/seos/courier/smtpg_add.html with the param parameter. |
CVE-2017-8794 | Critical | 10.0 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. Because a regular expression (intended to match local https URLs) lacks an initial ^ char… |
CVE-2017-8793 | High | 8.8 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. By sending a POST request to home/seos/courier/web/wmProgressstat.html.php with an attack… |
CVE-2017-8792 | Medium | 6.1 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in home/seos/courier/user_add.html with the param parameter. |
CVE-2017-8791 | Medium | 6.1 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is a home/seos/courier/login.html auth_params CRLF attack vector. |
CVE-2017-8790 | Critical | 9.8 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDAP Injectio… |
CVE-2017-8789 | Critical | 9.8 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. A report_error.php?year='payload SQL injection vector exists. |
CVE-2017-8788 | Medium | 6.1 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is a CRLF vulnerability in settings_global_text_edit.php allowing ?display=x%0Dnewl… |
CVE-2017-8760 | Medium | 6.1 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in courier/1000@/index.html with the auth_params parameter. The device tries… |
CVE-2017-8304 | Medium | 6.1 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. courier/1000@/oauth/playground/callback.html allows XSS with a crafted URI. |
CVE-2017-8303 | Critical | 9.8 | 2017-05-05 | An issue was discovered on Accellion FTA devices before FTA_9_12_180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method p… |
CVE-2017-8080 | High | 8.8 | 2017-05-05 | Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image upload… |
CVE-2017-6557 | High | 8.8 | 2017-05-05 | SQL injection vulnerability in ArrayOS before AG 9.4.0.135, when the portal bookmark function is enabled, allows remote authenticated users to execute arbitrar… |
CVE-2017-8787 | High | 8.8 | 2017-05-05 | The PoDoFo::PdfXRefStreamParserObject::ReadXRefStreamEntry function in base/PdfXRefStreamParserObject.cpp:224 in PoDoFo 0.9.5 allows remote attackers to cause… |
CVE-2017-8060 | Medium | 5.9 | 2017-05-05 | Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proximate attacker to si… |
CVE-2017-8059 | High | 8.1 | 2017-05-05 | Acceptance of invalid/self-signed TLS certificates in "Foxit PDF - PDF reader, editor, form, signature" before 5.4 for iOS allows a man-in-the-middle and/or ph… |
CVE-2017-8058 | Medium | 5.9 | 2017-05-05 | Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker t… |
CVE-2017-5919 | Medium | 5.9 | 2017-05-05 | The 21st Century Insurance app 10.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers an… |
CVE-2017-5918 | Medium | 5.9 | 2017-05-05 | The Banco de Costa Rica BCR Movil app 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof server… |
CVE-2017-5916 | Medium | 5.9 | 2017-05-05 | The America's First Federal Credit Union (FCU) Mobile Banking app 3.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-mi… |
CVE-2017-5915 | Medium | 5.9 | 2017-05-05 | The Emirates NBD Bank P.J.S.C Emirates NBD KSA app 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) for iOS does not verify X.509 certificates from SS… |
CVE-2017-5914 | Medium | 5.9 | 2017-05-05 | The DOT IT Banque Zitouna app 2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and ob… |
CVE-2017-5913 | Medium | 5.9 | 2017-05-05 | The TradeKing Forex for iPhone app 1.2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers… |
CVE-2017-5912 | Medium | 5.9 | 2017-05-05 | The FOREX.com FOREXTrader for iPhone app 2.9.12 through 2.9.14 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atta… |
CVE-2017-5911 | Medium | 5.9 | 2017-05-05 | The Banco Santander Mexico SA Supermovil app 3.5 through 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attack… |
CVE-2017-5909 | Medium | 5.9 | 2017-05-05 | The Electronic Funds Source (EFS) Mobile Driver Source app 2.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atta… |
CVE-2017-5907 | Medium | 5.9 | 2017-05-05 | The Great Southern Bank Great Southern Mobile Banking app before 4.0.4 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-mid… |
CVE-2017-5906 | Medium | 5.9 | 2017-05-05 | The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-… |
CVE-2017-5905 | Medium | 5.9 | 2017-05-05 | The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obt… |
CVE-2017-5902 | Medium | 5.9 | 2017-05-05 | The PayQuicker app 1.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sens… |
CVE-2017-5901 | Medium | 5.9 | 2017-05-05 | The State Bank of India State Bank Anywhere app 5.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to… |
CVE-2017-3213 | Medium | 5.9 | 2017-05-05 | The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof s… |
CVE-2017-3212 | Medium | 5.9 | 2017-05-05 | The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-mid… |
CVE-2017-8786 | Critical | 9.8 | 2017-05-05 | pcre2test.c in PCRE2 10.23 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a cr… |
CVE-2017-8768 | Critical | 9.8 | 2017-05-04 | Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command exec… |
CVE-2017-3733 | High | 7.5 | 2017-05-04 | During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause… |
CVE-2017-3732 | Medium | 5.9 | 2017-05-04 | There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affec… |
CVE-2017-3731 | High | 7.5 | 2017-05-04 | If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to per… |
CVE-2017-3730 | High | 7.5 | 2017-05-04 | In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to… |
CVE-2017-8778 | Medium | 6.1 | 2017-05-04 | GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document. |
CVE-2017-8780 | Medium | 4.8 | 2017-05-04 | GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator, as demonstrated by a malformed P element. |
CVE-2017-8779 | High | 7.5 | 2017-05-04 | rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory… |
CVE-2017-8295 | Medium | 5.9 | 2017-05-04 | WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passw… |
CVE-2017-4983 | Medium | 6.7 | 2017-05-04 | EMC Data Domain OS 5.2 through 5.7 before 5.7.3.0 and 6.0 before 6.0.1.0 is affected by a privilege escalation vulnerability that may potentially be exploited… |
CVE-2017-8776 | High | 7.5 | 2017-05-04 | Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316, and Quick Heal AntiVirus Pro 10.1.0.316 have approximately 165 PE files in the d… |
CVE-2017-8775 | Critical | 9.8 | 2017-05-04 | Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316, and Quick Heal AntiVirus Pro 10.1.0.316 are vulnerable to Memory Corruption whil… |
CVE-2017-8774 | Critical | 9.8 | 2017-05-04 | Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316, and Quick Heal AntiVirus Pro 10.1.0.316 are vulnerable to Memory Corruption whil… |
CVE-2017-8773 | Critical | 9.8 | 2017-05-04 | Quick Heal Internet Security 10.1.0.316, Quick Heal Total Security 10.1.0.316, and Quick Heal AntiVirus Pro 10.1.0.316 are vulnerable to Out of Bounds Write on… |
CVE-2017-8765 | Medium | 6.5 | 2017-05-04 | The function named ReadICONImage in coders\icon.c in ImageMagick 7.0.5-5 has a memory leak vulnerability which can cause memory exhaustion via a crafted ICON f… |
CVE-2017-8763 | Medium | 6.1 | 2017-05-04 | Cross-site scripting (XSS) vulnerability in modules/Base/Box/check_for_new_version.php in EPESI in Telaxus/EPESI 1.8.2 and earlier allows remote attackers to i… |
CVE-2017-8762 | Medium | 5.4 | 2017-05-03 | GeniXCMS 1.0.2 has XSS triggered by an authenticated user who submits a page, as demonstrated by a crafted oncut attribute in a B element. |
CVE-2017-6629 | Medium | 5.3 | 2017-05-03 | A vulnerability in the ImageID parameter of Cisco Unity Connection 10.5(2) could allow an unauthenticated, remote attacker to access files in arbitrary locatio… |
CVE-2017-6628 | Medium | 6.8 | 2017-05-03 | A vulnerability in SMART-SSL Accelerator functionality for Cisco Wide Area Application Services (WAAS) 6.2.1, 6.2.1a, and 6.2.3a could allow an unauthenticated… |
CVE-2017-6626 | Medium | 5.3 | 2017-05-03 | A vulnerability in the Cisco Finesse Notification Service for Cisco Unified Contact Center Enterprise (UCCE) 11.5(1) and 11.6(1) could allow an unauthenticated… |
CVE-2017-6625 | High | 7.1 | 2017-05-03 | A "Cisco Firepower Threat Defense 6.0.0 through 6.2.2 and Cisco ASA with FirePOWER Module Denial of Service" vulnerability in the access control policy of Cisc… |
CVE-2017-6624 | Medium | 5.3 | 2017-05-03 | A vulnerability in Cisco IOS 15.5(3)M Software for Cisco CallManager Express (CME) could allow an unauthenticated, remote attacker to make unauthorized phone c… |
CVE-2017-6620 | Medium | 5.8 | 2017-05-03 | A vulnerability in the remote management access control list (ACL) feature of the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated, remote at… |
CVE-2017-7229 | Critical | 9.1 | 2017-05-03 | PGP/MIME encrypted messages injected into a Vaultive O365 (before 4.5.21) frontend via IMAP or SMTP have their Content-Type changed from 'Content-Type: multipa… |
CVE-2017-5481 | High | 8.8 | 2017-05-03 | Trend Micro OfficeScan 11.0 before SP1 CP 6325 and XG before CP 1352 allows remote authenticated users to gain privileges by leveraging a leak of an encrypted… |
CVE-2017-7995 | Low | 3.8 | 2017-05-03 | Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to inform… |
CVE-2017-5240 | High | 7.5 | 2017-05-03 | Editions of Rapid7 AppSpider Pro prior to version 6.14.060 contain a heap-based buffer overflow in the FLAnalyzer.exe component. A malicious or malformed Flash… |
CVE-2017-5236 | High | 7.8 | 2017-05-03 | Editions of Rapid7 AppSpider Pro installers prior to version 6.14.060 contain a DLL preloading vulnerability, wherein it is possible for the installer to load… |
CVE-2017-8459 | Medium | 5.3 | 2017-05-03 | Brave 0.12.4 has a Status Bar Obfuscation issue in which a redirection target is shown in a possibly unexpected way. NOTE: third parties dispute this issue bec… |
CVE-2017-8458 | Medium | 6.5 | 2017-05-03 | Brave 0.12.4 has a URI Obfuscation issue in which a string such as https://safe.example.com@unsafe.example.com/ is displayed without a clear UI indication that… |
CVE-2017-8455 | High | 7.8 | 2017-05-03 | Foxit Reader before 8.2.1 and PhantomPDF before 8.2.1 have an out-of-bounds read that allows remote attackers to obtain sensitive information or possibly execu… |
CVE-2017-8454 | High | 8.8 | 2017-05-03 | Foxit Reader before 8.2.1 and PhantomPDF before 8.2.1 have an out-of-bounds read that allows remote attackers to obtain sensitive information or possibly execu… |
CVE-2017-8453 | High | 8.8 | 2017-05-03 | Foxit Reader before 8.2.1 and PhantomPDF before 8.2.1 have an out-of-bounds read that allows remote attackers to obtain sensitive information or possibly execu… |
CVE-2017-7432 | Critical | 9.8 | 2017-05-03 | Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a webshell upload vulnerability. |
CVE-2017-7431 | High | 8.8 | 2017-05-03 | Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have persistent CSRF in object management. |
CVE-2017-7430 | Medium | 6.1 | 2017-05-03 | Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a persistent XSS vulnerability in Framework. |
CVE-2017-7428 | Medium | 5.3 | 2017-05-03 | NetIQ iManager 3.x before 3.0.3.1 has an issue in the renegotiation of connection parameters with Tomcat. |
CVE-2017-0331 | High | 7.8 | 2017-05-02 | An elevation of privilege vulnerability in the NVIDIA video driver could enable a local malicious application to execute arbitrary code within the context of t… |
CVE-2017-8421 | Medium | 5.5 | 2017-05-02 | The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak… |
CVE-2017-7476 | Critical | 9.8 | 2017-05-02 | Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is in the save_abbr function in time_rz.c. |
CVE-2017-7216 | Medium | 6.5 | 2017-05-02 | The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to obtain sensitive information via unspecified reques… |
CVE-2017-8419 | High | 7.8 | 2017-05-02 | LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows remote attackers to cause a denial of service (stac… |
CVE-2017-8418 | Low | 3.3 | 2017-05-02 | RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other users. |
CVE-2017-8112 | Medium | 6.5 | 2017-05-02 | hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and CPU consumption) via t… |
CVE-2017-8086 | Medium | 6.5 | 2017-05-02 | Memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of serv… |
CVE-2017-7483 | High | 7.5 | 2017-05-02 | Rxvt 2.7.10 is vulnerable to a denial of service attack by passing the value -2^31 inside a terminal escape code, which results in a non-invertible integer tha… |
CVE-2017-7440 | Medium | 6.5 | 2017-05-02 | Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows… |
CVE-2017-6551 | Critical | 9.8 | 2017-05-02 | Pexip Infinity before 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary code via vectors related to Conferencing… |
CVE-2017-5689 | Critical | 9.8 | 2017-05-02 | An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Stand… |
CVE-2017-8403 | High | 8.8 | 2017-05-01 | 360fly 4K cameras allow unauthenticated Wi-Fi password changes and complete access with REST by using the Bluetooth Low Energy pairing procedure, which is avai… |
CVE-2017-8401 | Medium | 6.5 | 2017-05-01 | In SWFTools 0.9.2, an out-of-bounds read of heap data can occur in the function png_load() in lib/png.c:724. This issue can be triggered by a malformed PNG fil… |
CVE-2017-8400 | High | 8.8 | 2017-05-01 | In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the function png_load() in lib/png.c:755. This issue can be triggered by a malformed PNG fi… |
CVE-2017-6565 | High | 8.8 | 2017-05-01 | On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the roleDiag user, which can be obtained by exploiting CVE-2013-7247, has the ability to upload file… |
CVE-2017-6564 | Medium | 6.5 | 2017-05-01 | On Franklin Fueling Systems TS-550 evo 2.3.0.7332 devices, the Guest user, which contains the lowest privileges, can post to the idSourceFileName parameter fou… |
CVE-2017-8399 | Critical | 9.8 | 2017-05-01 | PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a "pattern with very many captures." |
CVE-2017-8398 | High | 7.5 | 2017-05-01 | dwarf.c in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. This vulnerability causes pr… |
CVE-2017-8397 | High | 7.5 | 2017-05-01 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 and an invalid write of… |
CVE-2017-8396 | High | 7.5 | 2017-05-01 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 because the existing rel… |
CVE-2017-8395 | High | 7.5 | 2017-05-01 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid write of size 8 because of missing a ma… |
CVE-2017-8394 | High | 7.5 | 2017-05-01 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 4 due to NULL pointer dere… |
CVE-2017-8393 | High | 7.5 | 2017-05-01 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assu… |
CVE-2017-8392 | High | 7.5 | 2017-05-01 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 8 because of missing a che… |
CVE-2017-8388 | Medium | 5.3 | 2017-05-01 | GeniXCMS 1.0.2 allows remote attackers to bypass the alertDanger MSG_USER_EMAIL_EXIST protection mechanism via a register.php?act=edit&id=1 request. |
CVE-2017-8377 | High | 8.8 | 2017-05-01 | GeniXCMS 1.0.2 has SQL Injection in inc/lib/Control/Backend/menus.control.php via the menuid parameter. |