2017 CVEs (page 133)
Page 133 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2416 | High | 7.8 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before… |
CVE-2017-2415 | High | 8.8 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. watchOS before 3… |
CVE-2017-2414 | Medium | 5.3 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "DataAccess" component. It allows remote attackers to ac… |
CVE-2017-2413 | High | 7.8 | 2017-04-02 | An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "QuickTime" component. It allows remote attackers t… |
CVE-2017-2412 | Medium | 5.9 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "iTunes Store" component. It allows man-in-the-middle at… |
CVE-2017-2410 | High | 7.8 | 2017-04-02 | An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Kernel" component. It allows attackers to execute… |
CVE-2017-2409 | High | 7.1 | 2017-04-02 | An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Menus" component. It allows attackers to obtain se… |
CVE-2017-2408 | High | 7.8 | 2017-04-02 | An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "IOATAFamily" component. It allows attackers to exe… |
CVE-2017-2407 | High | 7.8 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before… |
CVE-2017-2406 | High | 7.8 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before… |
CVE-2017-2405 | High | 8.8 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit Web Inspector" c… |
CVE-2017-2404 | Low | 3.3 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Quick Look" component. It allows remote attackers to tr… |
CVE-2017-2403 | High | 8.8 | 2017-04-02 | An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Printing" component. A format-string vulnerability… |
CVE-2017-2402 | Critical | 9.8 | 2017-04-02 | An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves mishandling of profile uninstall actions in the "MCX Cl… |
CVE-2017-2401 | High | 7.8 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before… |
CVE-2017-2400 | Medium | 5.3 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "SafariViewController" component. It allows attackers to… |
CVE-2017-2399 | Medium | 4.6 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Pasteboard" component. It allows physically proximate a… |
CVE-2017-2398 | High | 7.8 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. The issue involves the "Kernel" component. It… |
CVE-2017-2397 | Low | 2.4 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Accounts" component. It allows physically proximate att… |
CVE-2017-2396 | High | 8.8 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involve… |
CVE-2017-2395 | High | 8.8 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involve… |
CVE-2017-2394 | High | 8.8 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involve… |
CVE-2017-2393 | Medium | 6.1 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Safari Reader" component. It allows remote attackers to… |
CVE-2017-2392 | High | 7.8 | 2017-04-02 | An issue was discovered in certain Apple products. Safari before 10.1 is affected. The issue involves the "WebKit" component. It allows attackers to execute ar… |
CVE-2017-2391 | Medium | 5.3 | 2017-04-02 | An issue was discovered in certain Apple products. Pages before 6.1, Numbers before 4.1, and Keynote before 7.1 on macOS and Pages before 3.1, Numbers before 3… |
CVE-2017-2390 | Medium | 5.5 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before… |
CVE-2017-2389 | High | 8.1 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "Safari" component. It a… |
CVE-2017-2388 | Medium | 5.5 | 2017-04-02 | An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "IOFireWireFamily" component. It allows attackers t… |
CVE-2017-2386 | Medium | 6.5 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involve… |
CVE-2017-2385 | Medium | 5.5 | 2017-04-02 | An issue was discovered in certain Apple products. Safari before 10.1 is affected. The issue involves the "Safari Login AutoFill" component. It allows local us… |
CVE-2017-2384 | Low | 3.3 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves mishandling of deletion within the SQLite subsystem of the "… |
CVE-2017-2383 | Low | 3.1 | 2017-04-02 | An issue was discovered in certain Apple products. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. The issue involves clea… |
CVE-2017-2382 | High | 7.5 | 2017-04-02 | An issue was discovered in certain Apple products. macOS Server before 5.3 is affected. The issue involves the "Wiki Server" component. It allows remote attack… |
CVE-2017-2381 | High | 8.8 | 2017-04-02 | An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "sudo" component. It allows remote authenticated us… |
CVE-2017-2380 | High | 7.5 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the Simple Certificate Enrollment Protocol (SCEP) implemen… |
CVE-2017-2379 | High | 7.8 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before… |
CVE-2017-2378 | High | 8.8 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves bookmark creation in the "We… |
CVE-2017-2377 | High | 7.5 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit Web Inspector" c… |
CVE-2017-2376 | High | 7.5 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "Safari" component. It a… |
CVE-2017-2367 | Medium | 6.5 | 2017-04-02 | An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involve… |
CVE-2017-7396 | High | 7.5 | 2017-04-01 | In TigerVNC 1.7.1 (CConnection.cxx CConnection::CConnection), an unauthenticated client can cause a small memory leak in the server. |
CVE-2017-7395 | Medium | 6.5 | 2017-04-01 | In TigerVNC 1.7.1 (SMsgReader.cxx SMsgReader::readClientCutText), by causing an integer overflow, an authenticated client can crash the server. |
CVE-2017-7394 | High | 7.5 | 2017-04-01 | In TigerVNC 1.7.1 (SSecurityPlain.cxx SSecurityPlain::processMsg), unauthenticated users can crash the server by sending long usernames. |
CVE-2017-7393 | High | 8.8 | 2017-04-01 | In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially… |
CVE-2017-7392 | High | 7.5 | 2017-04-01 | In TigerVNC 1.7.1 (SSecurityVeNCrypt.cxx SSecurityVeNCrypt::SSecurityVeNCrypt), an unauthenticated client can cause a small memory leak in the server. |
CVE-2017-7391 | Medium | 6.1 | 2017-04-01 | A Cross-Site Scripting (XSS) was discovered in 'Magmi 0.7.22'. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to… |
CVE-2017-7390 | Medium | 6.1 | 2017-04-01 | A Cross-Site Scripting (XSS) was discovered in 'SocialNetwork v1.2.1'. The vulnerability exists due to insufficient filtration of user-supplied data (mail) pas… |
CVE-2017-7389 | Medium | 6.1 | 2017-04-01 | Multiple Cross-Site Scripting (XSS) were discovered in 'openeclass Release_3.5.4'. The vulnerabilities exist due to insufficient filtration of user-supplied da… |
CVE-2017-7388 | Medium | 6.1 | 2017-04-01 | A Cross-Site Scripting (XSS) was discovered in 'wallacepos v1.4.1'. The vulnerability exists due to insufficient filtration of user-supplied data (token) passe… |
CVE-2017-7387 | Medium | 6.1 | 2017-04-01 | TheFirstQuestion/HelpMeWatchWho before 2017-03-28 is vulnerable to a reflected XSS in HelpMeWatchWho-master/unaired.php (episodeID parameter). |
CVE-2017-7386 | Medium | 6.1 | 2017-04-01 | citymont/symetrie v.0.9.6 is vulnerable to a reflected XSS in symetrie-master/app/commands/page.php (model parameter). |
CVE-2017-7374 | High | 7.8 | 2017-03-31 | Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of service (NULL pointer dereference) or poss… |
CVE-2017-2775 | High | 7.5 | 2017-03-31 | An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016 b… |
CVE-2017-1171 | Medium | 4.3 | 2017-03-31 | The IBM TRIRIGA Application Platform 3.3, 3,4, and 3,5 contain a vulnerability that could allow an authenticated user to execute Application actions they do no… |
CVE-2017-1154 | Medium | 6.5 | 2017-03-31 | IBM Algorithmics One-Algo Risk Application 4.9.1, 5.0, and 5.1.0 could allow a user to gain access to files in the local environment which should not be viewed… |
CVE-2017-3010 | Critical | 9.8 | 2017-03-31 | Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability in th… |
CVE-2017-3009 | High | 7.5 | 2017-03-31 | Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable buffer overflow vulnerability in the… |
CVE-2017-7363 | Medium | 6.1 | 2017-03-31 | Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack. |
CVE-2017-7362 | Medium | 6.1 | 2017-03-31 | Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack. |
CVE-2017-7361 | Medium | 6.1 | 2017-03-31 | Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack. |
CVE-2017-7360 | Medium | 6.1 | 2017-03-31 | Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack. |
CVE-2017-7359 | Medium | 6.1 | 2017-03-31 | Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack. |
CVE-2017-7309 | Medium | 4.8 | 2017-03-31 | A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (… |
CVE-2017-7241 | Medium | 4.8 | 2017-03-31 | A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to in… |
CVE-2017-6973 | Medium | 4.8 | 2017-03-31 | A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code t… |
CVE-2017-2647 | High | 7.8 | 2017-03-31 | The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system cras… |
CVE-2017-7346 | Medium | 5.5 | 2017-03-30 | The vmw_gb_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.7 does not validate certain levels data, w… |
CVE-2017-7253 | High | 8.8 | 2017-03-30 | Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1. Use the default low-privilege credentials to list all users via a request to a certai… |
CVE-2017-6412 | High | 8.1 | 2017-03-30 | In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310. |
CVE-2017-6184 | Medium | 4.7 | 2017-03-30 | In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injectio… |
CVE-2017-6183 | High | 7.2 | 2017-03-30 | In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's configuration utilities for adding (and detecting) Active Directory servers was vulner… |
CVE-2017-6182 | Critical | 9.8 | 2017-03-30 | In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injectio… |
CVE-2017-5185 | High | 7.5 | 2017-03-30 | A vulnerability was discovered in NetIQ Sentinel Server 8.0 before 8.0.1 that may allow remote denial of service. |
CVE-2017-5184 | Medium | 5.3 | 2017-03-30 | A vulnerability was discovered in NetIQ Sentinel Server 8.0 before 8.0.1 that may allow leakage of information (account enumeration). |
CVE-2017-7324 | Critical | 9.8 | 2017-03-30 | setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter. |
CVE-2017-7323 | High | 8.1 | 2017-03-30 | The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier use http://rest.modx.com by default, which allows man-in-the-middl… |
CVE-2017-7322 | High | 8.1 | 2017-03-30 | The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows ma… |
CVE-2017-7321 | Critical | 9.8 | 2017-03-30 | setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the config_key parameter to the… |
CVE-2017-7320 | Medium | 6.1 | 2017-03-30 | setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to con… |
CVE-2017-7318 | Critical | 9.8 | 2017-03-30 | Siklu EtherHaul devices before 7.4.0 are vulnerable to a remote command execution (RCE) vulnerability. This vulnerability allows a remote attacker to execute c… |
CVE-2017-7290 | High | 7.2 | 2017-03-30 | SQL injection vulnerability in XOOPS 2.5.7.2 and other versions before 2.5.8.1 allows remote authenticated administrators to execute arbitrary SQL commands via… |
CVE-2017-7310 | High | 7.8 | 2017-03-29 | A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9, DiskPulse before 10.6, DiskSavvy befo… |
CVE-2017-4980 | High | 7.5 | 2017-03-29 | EMC Isilon OneFS is affected by a path traversal vulnerability that may potentially be exploited by attackers to compromise the affected system. Affected versi… |
CVE-2017-4977 | High | 7.0 | 2017-03-29 | EMC RSA Archer Security Operations Management with RSA Unified Collector Framework versions prior to 1.3.1.52 contain a sensitive information disclosure vulner… |
CVE-2017-7308 | High | 7.8 | 2017-03-29 | The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate certain block-size data, which allows loca… |
CVE-2017-7258 | High | 7.5 | 2017-03-29 | HTTP Exploit in eMLi Portal in AuroMeera Technometrix Pvt. Ltd. eMLi allows an Attacker to View Restricted Information or (even more seriously) execute powerfu… |
CVE-2017-5226 | Critical | 10.0 | 2017-03-29 | When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into th… |
CVE-2017-7304 | High | 7.5 | 2017-03-29 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 8) because of missing a c… |
CVE-2017-7303 | High | 7.5 | 2017-03-29 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 4) because of missing a c… |
CVE-2017-7302 | High | 7.5 | 2017-03-29 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a swap_std_reloc_out function in bfd/aoutx.h that is vulnerable… |
CVE-2017-7301 | High | 7.5 | 2017-03-29 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that has an of… |
CVE-2017-7300 | High | 7.5 | 2017-03-29 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that is vulner… |
CVE-2017-7299 | Medium | 5.5 | 2017-03-29 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an invalid read (of size 8) because the code to emit relocs (bf… |
CVE-2017-7285 | High | 7.5 | 2017-03-29 | A vulnerability in the network stack of MikroTik Version 6.38.5 released 2017-03-09 could allow an unauthenticated remote attacker to exhaust all available CPU… |
CVE-2017-5900 | Medium | 5.4 | 2017-03-29 | Cross-site scripting (XSS) vulnerability in the NetComm NB16WV-02 router with firmware NB16WV_R0.09 allows remote authenticated users to inject arbitrary web s… |
CVE-2017-5671 | High | 8.8 | 2017-03-29 | Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x before 10.12.013309 have /usr/bin/lua insta… |
CVE-2017-7298 | Medium | 5.4 | 2017-03-29 | In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element. |
CVE-2017-7294 | High | 7.8 | 2017-03-29 | The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.6 does not validate addition of certain level… |
CVE-2017-6864 | Medium | 5.4 | 2017-03-29 | The integrated web server in Siemens RUGGEDCOM ROX I (all versions) at port 10000/TCP could allow an authenticated user to perform stored Cross-Site Scripting… |
CVE-2017-2689 | High | 8.8 | 2017-03-29 | Siemens RUGGEDCOM ROX I (all versions) allow an authenticated user to bypass access restrictions in the web interface at port 10000/TCP to obtain privileged fi… |