2017 CVEs (page 127)
Page 127 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2334 | High | 7.5 | 2017-04-24 | An information leak vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based maliciou… |
CVE-2017-2333 | Medium | 6.5 | 2017-04-24 | A persistent denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious… |
CVE-2017-2332 | High | 8.8 | 2017-04-24 | An insufficient authentication vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious… |
CVE-2017-2331 | High | 7.3 | 2017-04-24 | A firewall bypass vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based malicious… |
CVE-2017-2330 | Medium | 6.2 | 2017-04-24 | A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, loca… |
CVE-2017-2329 | Medium | 6.2 | 2017-04-24 | An insufficient authentication vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unprivileg… |
CVE-2017-2328 | Medium | 5.5 | 2017-04-24 | An information leak vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unprivileged, authent… |
CVE-2017-2327 | Medium | 5.5 | 2017-04-24 | A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an authenticated malicio… |
CVE-2017-2326 | Medium | 6.5 | 2017-04-24 | An information disclosure vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unprivileged, a… |
CVE-2017-2325 | Medium | 6.5 | 2017-04-24 | A buffer overflow vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an authenticated malicious… |
CVE-2017-2324 | Medium | 5.3 | 2017-04-24 | A command injection vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based maliciou… |
CVE-2017-2323 | High | 7.5 | 2017-04-24 | A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious attacker cra… |
CVE-2017-2321 | High | 8.6 | 2017-04-24 | A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-… |
CVE-2017-2320 | Critical | 10.0 | 2017-04-24 | A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-… |
CVE-2017-2319 | High | 8.3 | 2017-04-24 | A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious attacker to compromise the sys… |
CVE-2017-2318 | Medium | 6.5 | 2017-04-24 | A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an authenticated malicious user to read lo… |
CVE-2017-2317 | High | 8.6 | 2017-04-24 | A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unpr… |
CVE-2017-2316 | Medium | 6.5 | 2017-04-24 | A buffer overflow vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an authenticated malicious… |
CVE-2017-2315 | High | 7.5 | 2017-04-24 | On Juniper Networks EX Series Ethernet Switches running affected Junos OS versions, a vulnerability in IPv6 processing has been discovered that may allow a spe… |
CVE-2017-2313 | High | 7.5 | 2017-04-24 | Juniper Networks devices running affected Junos OS versions may be impacted by the receipt of a crafted BGP UPDATE which can lead to an rpd (routing process da… |
CVE-2017-2312 | Medium | 6.5 | 2017-04-24 | On Juniper Networks devices running Junos OS affected versions and with LDP enabled, a specific LDP packet destined to the RE (Routing Engine) will consume a s… |
CVE-2017-8085 | Medium | 6.1 | 2017-04-24 | In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php. |
CVE-2017-7944 | Medium | 6.1 | 2017-04-24 | XOOPS Core 2.5.8.1 has XSS due to unescaped HTML output of an Install DB failure error message in page_dbsettings.php. |
CVE-2017-7852 | High | 8.8 | 2017-04-24 | D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the device's settings vi… |
CVE-2017-8082 | Medium | 6.5 | 2017-04-24 | concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote attackers to disable the entire installation by merely tricking an admin… |
CVE-2017-8078 | Medium | 5.3 | 2017-04-23 | On the TP-Link TL-SG108E 1.0, the upgrade process can be requested remotely without authentication (httpupg.cgi with a parameter called cmd). This affects the… |
CVE-2017-8077 | High | 7.5 | 2017-04-23 | On the TP-Link TL-SG108E 1.0, there is a hard-coded ciphering key (a long string beginning with Ei2HNryt). This affects the 1.1.2 Build 20141017 Rel.50749 firm… |
CVE-2017-8076 | Critical | 9.8 | 2017-04-23 | On the TP-Link TL-SG108E 1.0, admin network communications are RC4 encoded, even though RC4 is deprecated. This affects the 1.1.2 Build 20141017 Rel.50749 firm… |
CVE-2017-8075 | Critical | 9.8 | 2017-04-23 | On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "Switch Info" log lines where passwords are in cleartext. This affects the 1.1… |
CVE-2017-8074 | Critical | 9.8 | 2017-04-23 | On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "SEND data" log lines where passwords are encoded in hexadecimal. This affects… |
CVE-2017-8073 | High | 7.5 | 2017-04-23 | WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function du… |
CVE-2017-8072 | High | 7.8 | 2017-04-23 | The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a z… |
CVE-2017-8071 | Medium | 5.5 | 2017-04-23 | drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 uses a spinlock without considering that sleeping is possible in a USB HID request callback, wh… |
CVE-2017-8070 | High | 7.8 | 2017-04-23 | drivers/net/usb/catc.c in the Linux kernel 4.9.x before 4.9.11 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a den… |
CVE-2017-8069 | High | 7.8 | 2017-04-23 | drivers/net/usb/rtl8150.c in the Linux kernel 4.9.x before 4.9.11 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a… |
CVE-2017-8068 | High | 7.8 | 2017-04-23 | drivers/net/usb/pegasus.c in the Linux kernel 4.9.x before 4.9.11 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a… |
CVE-2017-8067 | High | 7.8 | 2017-04-23 | drivers/char/virtio_console.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local u… |
CVE-2017-8066 | High | 7.8 | 2017-04-23 | drivers/net/can/usb/gs_usb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.2 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local use… |
CVE-2017-8065 | High | 7.8 | 2017-04-23 | crypto/ccm.c in the Linux kernel 4.9.x and 4.10.x through 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a… |
CVE-2017-8064 | High | 7.8 | 2017-04-23 | drivers/media/usb/dvb-usb-v2/dvb_usb_core.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which… |
CVE-2017-8063 | High | 7.8 | 2017-04-23 | drivers/media/usb/dvb-usb/cxusb.c in the Linux kernel 4.9.x and 4.10.x before 4.10.12 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows loc… |
CVE-2017-8062 | High | 7.8 | 2017-04-23 | drivers/media/usb/dvb-usb/dw2102.c in the Linux kernel 4.9.x and 4.10.x before 4.10.4 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows loc… |
CVE-2017-8061 | High | 7.8 | 2017-04-23 | drivers/media/usb/dvb-usb/dvb-usb-firmware.c in the Linux kernel 4.9.x and 4.10.x before 4.10.7 interacts incorrectly with the CONFIG_VMAP_STACK option, which… |
CVE-2017-8056 | Medium | 5.3 | 2017-04-22 | WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. This causes the Firebox wgagent p… |
CVE-2017-8055 | Medium | 5.3 | 2017-04-22 | WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. A login request that contains a blank password sent to the XML-RPC age… |
CVE-2017-8054 | Medium | 5.5 | 2017-04-22 | The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (infinite recursion… |
CVE-2017-8053 | Medium | 5.5 | 2017-04-22 | PoDoFo 0.9.5 allows denial of service (infinite recursion and stack consumption) via a crafted PDF file in PoDoFo::PdfParser::ReadDocumentStructure (PdfParser… |
CVE-2017-8052 | Medium | 6.1 | 2017-04-22 | Craft CMS before 2.6.2974 allows XSS attacks. |
CVE-2017-7991 | Critical | 9.8 | 2017-04-22 | Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/e… |
CVE-2017-8051 | Critical | 9.8 | 2017-04-21 | Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tns_ap… |
CVE-2017-8050 | High | 7.5 | 2017-04-21 | Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password. |
CVE-2017-7994 | Medium | 6.5 | 2017-04-21 | The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference… |
CVE-2017-7992 | Medium | 6.1 | 2017-04-21 | Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via… |
CVE-2017-7951 | High | 8.8 | 2017-04-21 | WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context. |
CVE-2017-7409 | Medium | 6.1 | 2017-04-21 | Palo Alto Networks PAN-OS before 7.0.15 has XSS in the GlobalProtect external interface via crafted request parameters, aka PAN-SA-2017-0011 and PAN-70674. |
CVE-2017-7220 | High | 8.8 | 2017-04-21 | OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized "UPDATE dm_dbo.dm_user_s S… |
CVE-2017-7990 | High | 8.8 | 2017-04-21 | The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a… |
CVE-2017-6619 | High | 8.8 | 2017-04-20 | A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker to execute arbitrary… |
CVE-2017-6618 | Medium | 5.4 | 2017-04-20 | A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker to perform a cross-s… |
CVE-2017-6617 | Medium | 5.4 | 2017-04-20 | A vulnerability in the session identification management functionality of the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow… |
CVE-2017-6616 | High | 8.8 | 2017-04-20 | A vulnerability in the web-based GUI of Cisco Integrated Management Controller (IMC) 3.0(1c) could allow an authenticated, remote attacker to execute arbitrary… |
CVE-2017-6615 | Medium | 6.3 | 2017-04-20 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE 3.16 could allow an authenticated, remote attacker to cause a denial… |
CVE-2017-6614 | Medium | 6.5 | 2017-04-20 | A vulnerability in the file-download feature of the web user interface for Cisco FindIT Network Probe Software 1.0.0 could allow an authenticated, remote attac… |
CVE-2017-6613 | Medium | 5.8 | 2017-04-20 | A vulnerability in the DNS input packet processor for Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to cause the DNS process to… |
CVE-2017-6611 | Medium | 6.1 | 2017-04-20 | A vulnerability in the web framework code of Cisco Prime Infrastructure 2.2(2) could allow an unauthenticated, remote attacker to conduct a cross-site scriptin… |
CVE-2017-6610 | High | 7.7 | 2017-04-20 | A vulnerability in the Internet Key Exchange Version 1 (IKEv1) XAUTH code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload… |
CVE-2017-6609 | High | 7.7 | 2017-04-20 | A vulnerability in the IPsec code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of the affected system. The vulnerabili… |
CVE-2017-6608 | High | 8.6 | 2017-04-20 | A vulnerability in the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) code of Cisco ASA Software could allow an unauthenticated, remote attacker… |
CVE-2017-6607 | High | 8.7 | 2017-04-20 | A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause an affected device to reload or corrupt the info… |
CVE-2017-4969 | Medium | 6.5 | 2017-04-20 | The Cloud Controller in Cloud Foundry cf-release versions prior to v255 allows authenticated developer users to exceed memory and disk quotas for tasks. |
CVE-2017-3863 | High | 8.6 | 2017-04-20 | Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated… |
CVE-2017-3862 | High | 8.6 | 2017-04-20 | Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated… |
CVE-2017-3861 | High | 8.6 | 2017-04-20 | Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated… |
CVE-2017-3860 | High | 8.6 | 2017-04-20 | Multiple vulnerabilities in the EnergyWise module of Cisco IOS (12.2 and 15.0 through 15.6) and Cisco IOS XE (3.2 through 3.18) could allow an unauthenticated… |
CVE-2017-3808 | High | 7.5 | 2017-04-20 | A vulnerability in the Session Initiation Protocol (SIP) UDP throttling process of Cisco Unified Communications Manager (Cisco Unified CM) could allow an unaut… |
CVE-2017-3793 | Medium | 4.0 | 2017-04-20 | A vulnerability in the TCP normalizer of Cisco Adaptive Security Appliance (ASA) Software (8.0 through 8.7 and 9.0 through 9.6) and Cisco Firepower Threat Defe… |
CVE-2017-1122 | High | 7.4 | 2017-04-20 | IBM Security Guardium 8.2, 9.0, and 10.0 contains a vulnerability that could allow a local attacker with CLI access to inject arbitrary commands which would be… |
CVE-2017-5160 | Medium | 5.3 | 2017-04-20 | An Inadequate Encryption Strength issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The software will co… |
CVE-2017-5158 | Critical | 9.8 | 2017-04-20 | An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. Credentials may be exposed to… |
CVE-2017-5156 | High | 8.8 | 2017-04-20 | A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The client request may be… |
CVE-2017-5183 | Medium | 6.1 | 2017-04-20 | NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field of a signed AuthnRe… |
CVE-2017-2806 | Medium | 4.3 | 2017-04-20 | An exploitable arbitrary read exists in the XLS parsing of the Lexmark Perspective Document Filters conversion functionality. A crafted XLS document can lead t… |
CVE-2017-2784 | High | 8.1 | 2017-04-20 | An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x bef… |
CVE-2017-7718 | Medium | 5.5 | 2017-04-20 | hw/display/cirrus_vga_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU proce… |
CVE-2017-5190 | Low | 3.1 | 2017-04-20 | NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue… |
CVE-2017-7982 | Medium | 5.5 | 2017-04-20 | Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service… |
CVE-2017-7938 | Medium | 6.6 | 2017-04-20 | Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cause a denial of service (application cra… |
CVE-2017-7692 | High | 8.8 | 2017-04-20 | SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in… |
CVE-2017-7283 | High | 8.8 | 2017-04-20 | An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore… |
CVE-2017-7282 | Medium | 5.5 | 2017-04-20 | An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed… |
CVE-2017-6919 | High | 7.5 | 2017-04-20 | Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the si… |
CVE-2017-7979 | High | 7.8 | 2017-04-19 | The cookie feature in the packet action API implementation in net/sched/act_api.c in the Linux kernel 4.11.x through 4.11-rc7 mishandles the tb nlattr array, w… |
CVE-2017-7978 | High | 7.5 | 2017-04-19 | Samsung Android devices with L(5.0/5.1), M(6.0), and N(7.x) software allow attackers to obtain sensitive information by reading a world-readable log file after… |
CVE-2017-7976 | High | 7.1 | 2017-04-19 | Artifex jbig2dec 0.13 allows out-of-bounds writes and reads because of an integer overflow in the jbig2_image_compose function in jbig2_image.c during operatio… |
CVE-2017-7975 | High | 7.8 | 2017-04-19 | Artifex jbig2dec 0.13, as used in Ghostscript, allows out-of-bounds writes because of an integer overflow in the jbig2_build_huffman_table function in jbig2_hu… |
CVE-2017-7964 | Critical | 10.0 | 2017-04-19 | Zyxel WRE6505 devices have a default TELNET password of 1234 for the root and admin accounts, which makes it easier for remote attackers to conduct DNS hijacki… |
CVE-2017-7963 | High | 7.5 | 2017-04-19 | The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and appli… |
CVE-2017-7962 | Medium | 5.5 | 2017-04-19 | The iwgif_read_image function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (divide-by-zero… |
CVE-2017-7961 | High | 7.8 | 2017-04-19 | The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an "outside the range of representable values of type long" undefined behavior… |
CVE-2017-7960 | Medium | 5.5 | 2017-04-19 | The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-rea… |