2017 CVEs (page 123)
Page 123 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-8376 | Medium | 5.4 | 2017-05-01 | GeniXCMS 1.0.2 has XSS triggered by an authenticated comment that is mishandled during a mouse operation by an administrator. |
CVE-2017-6128 | High | 7.5 | 2017-05-01 | An attacker may be able to cause a denial-of-service (DoS) attack against the sshd component in F5 BIG-IP, Enterprise Manager, BIG-IQ, and iWorkflow. |
CVE-2017-5631 | Medium | 6.1 | 2017-05-01 | An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., "usr") that is transmitted in the login.php… |
CVE-2017-8385 | Medium | 5.3 | 2017-05-01 | Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message. |
CVE-2017-8384 | Medium | 6.1 | 2017-05-01 | Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOT… |
CVE-2017-8383 | Medium | 5.3 | 2017-05-01 | Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder. |
CVE-2017-8378 | Critical | 9.8 | 2017-05-01 | Heap-based buffer overflow in the PdfParser::ReadObjects function in base/PdfParser.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (a… |
CVE-2017-8374 | Medium | 5.5 | 2017-05-01 | The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and applica… |
CVE-2017-8373 | High | 7.8 | 2017-05-01 | The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer overflow and appl… |
CVE-2017-8372 | Medium | 4.7 | 2017-05-01 | The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion fa… |
CVE-2017-6520 | Critical | 9.1 | 2017-05-01 | The Multicast DNS (mDNS) responder used in BOSE Soundtouch 30 inadvertently responds to IPv4 unicast queries with source addresses that are not link-local, whi… |
CVE-2017-6519 | Critical | 9.1 | 2017-05-01 | avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote att… |
CVE-2017-8371 | Medium | 6.8 | 2017-04-30 | Schneider Electric StruxureWare Data Center Expert before 7.4.0 uses cleartext RAM storage for passwords, which might allow remote attackers to obtain sensitiv… |
CVE-2017-8367 | High | 7.8 | 2017-04-30 | Buffer overflow in Ether Software Easy MOV Converter 1.4.24, Easy DVD Creator, Easy MPEG/AVI/DIVX/WMV/RM to DVD, Easy Avi/Divx/Xvid to DVD Burner, Easy MPEG to… |
CVE-2017-8366 | Critical | 9.8 | 2017-04-30 | The strescape function in ec_strings.c in Ettercap 0.8.2 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash… |
CVE-2017-8365 | Medium | 6.5 | 2017-04-30 | The i2les_array function in pcm.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a craf… |
CVE-2017-8364 | High | 7.8 | 2017-04-30 | The read_buf function in stream.c in rzip 2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possib… |
CVE-2017-8363 | Medium | 6.5 | 2017-04-30 | The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application… |
CVE-2017-8362 | Medium | 6.5 | 2017-04-30 | The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (invalid read and application crash) via a cr… |
CVE-2017-8361 | High | 8.8 | 2017-04-30 | The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or po… |
CVE-2017-8081 | High | 8.8 | 2017-04-30 | Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbit… |
CVE-2017-8359 | Critical | 9.8 | 2017-04-30 | Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function in core/lib/surface/ca… |
CVE-2017-8358 | Critical | 9.8 | 2017-04-30 | LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpeg… |
CVE-2017-8357 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadEPTImage function in ept.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8356 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadSUNImage function in sun.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8355 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadMTVImage function in mtv.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8354 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadBMPImage function in bmp.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8353 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadPICTImage function in pict.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8352 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadXWDImage function in xwd.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8351 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadPCDImage function in pcd.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8350 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadJNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8349 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadSFWImage function in sfw.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8348 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadMATImage function in mat.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8347 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadEXRImage function in exr.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8346 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadDCMImage function in dcm.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8345 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadMNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8344 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadPCXImage function in pcx.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8343 | Medium | 6.5 | 2017-04-30 | In ImageMagick 7.0.5-5, the ReadAAIImage function in aai.c allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-8339 | Medium | 5.5 | 2017-04-30 | PSKMAD.sys in Panda Free Antivirus 18.0 allows local users to cause a denial of service (BSoD) via a crafted DeviceIoControl request to \\.\PSMEMDriver. |
CVE-2017-7721 | High | 7.8 | 2017-04-30 | IrfanView version 4.44 (32bit) with FPX Plugin before 4.45 has an Access Violation and crash in processing a FlashPix (.FPX) file. |
CVE-2017-8342 | High | 8.1 | 2017-04-30 | Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method. |
CVE-2017-8327 | Medium | 6.5 | 2017-04-29 | The bmpr_read_uncompressed function in imagew-bmp.c in libimageworsener.a in ImageWorsener before 1.3.1 allows remote attackers to cause a denial of service (m… |
CVE-2017-8326 | High | 8.8 | 2017-04-29 | libimageworsener.a in ImageWorsener before 1.3.1 has "left shift cannot be represented in type int" undefined behavior issues, which might allow remote attacke… |
CVE-2017-8325 | High | 8.8 | 2017-04-29 | The iw_process_cols_to_intermediate function in imagew-main.c in libimageworsener.a in ImageWorsener before 1.3.1 allows remote attackers to cause a denial of… |
CVE-2017-8114 | High | 8.8 | 2017-04-29 | Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The… |
CVE-2017-7957 | High | 7.5 | 2017-04-29 | XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshal… |
CVE-2017-7981 | High | 8.8 | 2017-04-29 | Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project Wiki component because the proc_open PHP… |
CVE-2017-6553 | Critical | 9.8 | 2017-04-29 | Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full access to the policy server via an ACT… |
CVE-2017-7945 | Critical | 9.8 | 2017-04-29 | The GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, 7.1.x before 7.1.9, and 8.x before 8.0.2 provides different… |
CVE-2017-7644 | Medium | 6.5 | 2017-04-29 | The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, and 7.1.x before 7.1.9 allows remote authenticated users to obtain… |
CVE-2017-6250 | High | 8.8 | 2017-04-28 | NVIDIA GeForce Experience contains a vulnerability in NVIDIA Web Helper.exe, where untrusted script execution may lead to violation of application execution po… |
CVE-2017-1194 | High | 8.8 | 2017-04-28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unau… |
CVE-2017-1141 | Medium | 4.3 | 2017-04-28 | IBM Insights Foundation for Energy 1.0, 1.5, and 1.6 could allow an authenticated user to obtain sensitive information from error messages. IBM X-Force ID: 121… |
CVE-2017-2156 | High | 7.8 | 2017-04-28 | Untrusted search path vulnerability in Vivaldi installer for Windows prior to version 1.7.735.48 allows an attacker to execute arbitrary code via a specially c… |
CVE-2017-2155 | High | 8.8 | 2017-04-28 | Buffer overflow in Hoozin Viewer 2, 3, 4.1.5.15 and earlier, 5.1.2.13 and earlier, and 6.0.3.09 and earlier allows remote attackers to execute arbitrary code v… |
CVE-2017-2154 | High | 7.8 | 2017-04-28 | Untrusted search path vulnerability in Hanako 2017, Hanako 2016, Hanako 2015, Hanako Pro 3, JUST Office 3 [Standard], JUST Office 3 [Eco Print Package], JUST O… |
CVE-2017-2153 | High | 7.5 | 2017-04-28 | SEIL/x86 Fuji 1.70 to 5.62, SEIL/BPV4 5.00 to 5.62, SEIL/X1 1.30 to 5.62, SEIL/X2 1.30 to 5.62, SEIL/B1 1.00 to 5.62 allows remote attackers to cause a denial… |
CVE-2017-2152 | Medium | 6.8 | 2017-04-28 | WNC01WH firmware 1.0.0.9 and earlier allows authenticated attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2017-2151 | Medium | 6.1 | 2017-04-28 | Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified v… |
CVE-2017-2150 | Medium | 5.3 | 2017-04-28 | Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted captcha_cha… |
CVE-2017-2149 | High | 8.8 | 2017-04-28 | Untrusted search path vulnerability in installers of the software for SDHC/SDXC Memory Card with embedded NFC functionality Software Update Tool V1.00.03 and e… |
CVE-2017-2148 | Medium | 5.4 | 2017-04-28 | Cross-site scripting vulnerability in WN-AC1167GR firmware version 1.04 and earlier allows remote authenticated attackers to inject arbitrary web script or HTM… |
CVE-2017-2147 | Medium | 6.1 | 2017-04-28 | Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified v… |
CVE-2017-2143 | Medium | 5.3 | 2017-04-28 | CS-Cart Japanese Edition v4.3.10-jp-1 and earlier, CS-Cart Multivendor Japanese Edition v4.3.10-jp-1 and earlier allows remote attackers to bypass access restr… |
CVE-2017-2142 | Critical | 9.8 | 2017-04-28 | Buffer overflow in WN-G300R3 firmware Ver.1.03 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2017-2141 | High | 7.2 | 2017-04-28 | WN-G300R3 firmware 1.03 and earlier allows attackers with administrator rights to execute arbitrary OS commands via unspecified vectors. |
CVE-2017-2140 | High | 8.8 | 2017-04-28 | Tablacus Explorer 17.3.30 and earlier allows arbitrary scripts to be executed in the context of the application due to specially crafted directory. |
CVE-2017-2139 | Medium | 5.3 | 2017-04-28 | CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remot… |
CVE-2017-2137 | Low | 3.7 | 2017-04-28 | ProSAFE Plus Configuration Utility prior to 2.3.29 allows remote attackers to bypass access restriction and change configurations of the switch via SOAP reques… |
CVE-2017-2136 | Medium | 6.1 | 2017-04-28 | Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially cra… |
CVE-2017-2135 | Medium | 6.1 | 2017-04-28 | Cross-site scripting vulnerability in WP Statistics version 12.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified v… |
CVE-2017-2134 | Medium | 6.1 | 2017-04-28 | Cross-site scripting vulnerability in ASSETBASE 8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2017-2130 | High | 7.8 | 2017-04-28 | Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer version Ver. 3.7.13 and earlier allows remote attackers to gain priv… |
CVE-2017-2128 | High | 8.8 | 2017-04-28 | Security guide for website operators allows remote attackers to execute arbitrary OS commands via specially crafted saved data. |
CVE-2017-2127 | Medium | 5.4 | 2017-04-28 | Cross-site scripting vulnerability in YOP Poll versions prior to 5.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2017-2125 | High | 8.8 | 2017-04-28 | Privilege escalation vulnerability in CentreCOM AR260S V2 remote authenticated attackers to gain privileges via the guest account. |
CVE-2017-2124 | Medium | 6.1 | 2017-04-28 | Cross-site scripting vulnerability in OneThird CMS v1.73 Heaven's Door and earlier allows remote attackers to inject arbitrary web script or HTML via contact.p… |
CVE-2017-2123 | Medium | 6.1 | 2017-04-28 | Cross-site scripting vulnerability in OneThird CMS v1.73 Heaven's Door and earlier allows remote attackers to inject arbitrary web script or HTML via language… |
CVE-2017-2120 | High | 7.2 | 2017-04-28 | SQL injection vulnerability in the WBCE CMS 1.1.10 and earlier allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vect… |
CVE-2017-2119 | High | 8.6 | 2017-04-28 | Directory traversal vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors. |
CVE-2017-2118 | Medium | 6.1 | 2017-04-28 | Cross-site scripting vulnerability in WBCE CMS 1.1.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2017-2117 | Medium | 4.9 | 2017-04-28 | Directory traversal vulnerability in CubeCart versions prior to 6.1.5 allows attacker with administrator rights to read arbitrary files via unspecified vectors. |
CVE-2017-2116 | Medium | 4.3 | 2017-04-28 | Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to delete "customapp" templates via unspecified vectors. |
CVE-2017-2115 | Medium | 4.3 | 2017-04-28 | Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to bypass access restriction to obtain "customapp" information via unspecified vectors. |
CVE-2017-2114 | Medium | 5.4 | 2017-04-28 | Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.5.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecifi… |
CVE-2017-2113 | High | 8.8 | 2017-04-28 | Buffer overflow in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware v… |
CVE-2017-2112 | High | 8.8 | 2017-04-28 | TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and ear… |
CVE-2017-2111 | Medium | 6.1 | 2017-04-28 | HTTP header injection vulnerability in TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier… |
CVE-2017-2110 | Medium | 5.9 | 2017-04-28 | The Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle a… |
CVE-2017-2109 | Low | 2.5 | 2017-04-28 | Cybozu KUNAI for Android 3.0.4 to 3.0.5.1 allow remote attackers to obtain log information through a malicious Android application. |
CVE-2017-2108 | High | 7.8 | 2017-04-28 | Untrusted search path vulnerability in PrimeDrive Desktop Application 1.4.3 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an… |
CVE-2017-2107 | High | 7.8 | 2017-04-28 | Untrusted search path vulnerability in Self-extracting archive files created by 7-ZIP32.DLL 9.22.00.01 and earlier allows remote attackers to gain privileges v… |
CVE-2017-2106 | Medium | 6.1 | 2017-04-28 | Multiple cross-site scripting vulnerabilities in Webmin versions prior to 1.830 allows remote attackers to inject arbitrary web script or HTML via unspecified… |
CVE-2017-2105 | Medium | 5.9 | 2017-04-28 | The TVer App for Android 3.2.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and o… |
CVE-2017-2104 | Medium | 5.9 | 2017-04-28 | The Business LaLa Call App for Android 1.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… |
CVE-2017-2103 | Medium | 5.9 | 2017-04-28 | The LaLa Call App for Android 2.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers… |
CVE-2017-2102 | High | 8.8 | 2017-04-28 | Cross-site request forgery (CSRF) vulnerability in Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attacker… |
CVE-2017-2101 | High | 7.3 | 2017-04-28 | Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote attackers to bypass authentication to perform arbitrary ope… |
CVE-2017-2100 | Medium | 6.3 | 2017-04-28 | Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.1 and earlier allows remote attackers to conduct DNS rebinding attacks via unspecified… |
CVE-2017-2099 | Medium | 6.3 | 2017-04-28 | Hands-on Vulnerability Learning Tool "AppGoat" for Web Application V3.0.0 and earlier allows remote code execution via unspecified vectors. |