2017 CVEs (page 134)
Page 134 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2688 | High | 8.8 | 2017-03-29 | The integrated web server in Siemens RUGGEDCOM ROX I (all versions) at port 10000/TCP could allow remote attackers to perform actions with the privileges of an… |
CVE-2017-2687 | Medium | 6.1 | 2017-03-29 | Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability in the integrated web server at port 10000/TCP which is prone to reflected Cross-Site Scripting… |
CVE-2017-2686 | Medium | 6.5 | 2017-03-29 | Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability that could allow an authenticated user to read arbitrary files through the web interface at port… |
CVE-2017-7297 | High | 8.8 | 2017-03-29 | Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. This is fixed in versions rancher/server:v1.2… |
CVE-2017-7277 | High | 7.1 | 2017-03-28 | The TCP stack in the Linux kernel through 4.10.6 mishandles the SCM_TIMESTAMPING_OPT_STATS feature, which allows local users to obtain sensitive information fr… |
CVE-2017-0882 | Medium | 6.3 | 2017-03-28 | Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7… |
CVE-2017-0881 | Medium | 4.3 | 2017-03-28 | An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an… |
CVE-2017-6964 | High | 7.8 | 2017-03-28 | dmcrypt-get-device, as shipped in the eject package of Debian and Ubuntu, does not check the return value of the (1) setuid or (2) setgid function, which might… |
CVE-2017-1153 | High | 8.8 | 2017-03-27 | IBM TRIRIGA Report Manager 3.2 through 3.5 contains a vulnerability that could allow an authenticated user to execute actions that they do not have access to… |
CVE-2017-1143 | Medium | 5.3 | 2017-03-27 | IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Stri… |
CVE-2017-1142 | Medium | 6.5 | 2017-03-27 | IBM Kenexa LCMS Premier on Cloud 9.x and 10.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for t… |
CVE-2017-1120 | Medium | 6.1 | 2017-03-27 | IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2017-5239 | High | 7.5 | 2017-03-27 | Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS Tracke… |
CVE-2017-5238 | Medium | 5.3 | 2017-03-27 | Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variable to another, ove… |
CVE-2017-5237 | High | 7.5 | 2017-03-27 | Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a factory default confi… |
CVE-2017-7275 | Medium | 5.5 | 2017-03-27 | The ReadPCXImage function in coders/pcx.c in ImageMagick 7.0.4.9 allows remote attackers to cause a denial of service (attempted large memory allocation and ap… |
CVE-2017-7274 | Medium | 5.5 | 2017-03-27 | The r_pkcs7_parse_cms function in libr/util/r_pkcs7.c in radare2 1.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and appli… |
CVE-2017-7273 | Medium | 6.6 | 2017-03-27 | The cp_report_fixup function in drivers/hid/hid-cypress.c in the Linux kernel 3.2 and 4.x before 4.9.4 allows physically proximate attackers to cause a denial… |
CVE-2017-7272 | High | 7.4 | 2017-03-27 | PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is… |
CVE-2017-7271 | Medium | 6.1 | 2017-03-27 | Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary w… |
CVE-2017-7191 | Critical | 9.8 | 2017-03-27 | The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service (use-after-free) and possibly execute arbitrary code via unspeci… |
CVE-2017-7183 | High | 7.5 | 2017-03-27 | The TFTP server in ExtraPuTTY 0.30 and earlier allows remote attackers to cause a denial of service (crash) via a large (1) read or (2) write TFTP protocol mes… |
CVE-2017-6542 | Critical | 9.8 | 2017-03-27 | The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol messa… |
CVE-2017-6464 | Medium | 6.5 | 2017-03-27 | NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive. |
CVE-2017-6463 | Medium | 6.5 | 2017-03-27 | NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config d… |
CVE-2017-6462 | High | 7.8 | 2017-03-27 | Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have u… |
CVE-2017-6460 | High | 8.8 | 2017-03-27 | Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a… |
CVE-2017-6459 | Medium | 5.5 | 2017-03-27 | The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to an argument with mul… |
CVE-2017-6458 | High | 8.8 | 2017-03-27 | Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact… |
CVE-2017-6455 | High | 7.0 | 2017-03-27 | NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPI_DLLS environment variable. |
CVE-2017-6452 | High | 7.8 | 2017-03-27 | Stack-based buffer overflow in the Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via an appli… |
CVE-2017-6451 | High | 7.8 | 2017-03-27 | The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf… |
CVE-2017-6878 | Medium | 5.4 | 2017-03-27 | Cross-site scripting (XSS) vulnerability in MetInfo 5.3.15 allows remote authenticated users to inject arbitrary web script or HTML via the name_2 parameter to… |
CVE-2017-5973 | Medium | 5.5 | 2017-03-27 | The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite lo… |
CVE-2017-5932 | High | 7.8 | 2017-03-27 | The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a comma… |
CVE-2017-5931 | High | 8.8 | 2017-03-27 | Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process cr… |
CVE-2017-5899 | High | 7.0 | 2017-03-27 | Directory traversal vulnerability in the setuid root helper binary in S-nail (later S-mailx) before 14.8.16 allows local users to write to arbitrary files and… |
CVE-2017-5850 | High | 7.5 | 2017-03-27 | httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using an HTTP Range header. |
CVE-2017-5330 | High | 7.8 | 2017-03-27 | ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications. |
CVE-2017-6957 | High | 8.1 | 2017-03-27 | Stack-based buffer overflow in the firmware in Broadcom Wi-Fi HardMAC SoC chips, when the firmware supports CCKM Fast and Secure Roaming and the feature is ena… |
CVE-2017-7269 | Critical | 9.8 | 2017-03-27 | Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allow… |
CVE-2017-6069 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5 has CSRF in admin/blog/add/. The attacker can add any tag, and can optionally insert XSS via the tags parameter. |
CVE-2017-6068 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter. |
CVE-2017-6067 | Medium | 6.1 | 2017-03-27 | Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field. |
CVE-2017-6066 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/. The attacker can perform any Edit Language action, and can optionally insert XSS via the title parameter. |
CVE-2017-6013 | Critical | 9.8 | 2017-03-27 | Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter. |
CVE-2017-6003 | Medium | 6.1 | 2017-03-27 | dotCMS 3.7.0 has XSS reachable from ext/languages_manager/edit_language in portal/layout via the bottom two form fields. |
CVE-2017-6002 | High | 8.8 | 2017-03-27 | Subrion CMS 4.0.5.10 has CSRF in admin/blog/add/. The attacker can add any blog entry, and can optionally insert XSS into that entry via the body parameter. |
CVE-2017-5622 | Medium | 5.9 | 2017-03-26 | With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious… |
CVE-2017-2645 | Medium | 6.1 | 2017-03-26 | In Moodle 3.x, XSS can occur via attachments to evidence of prior learning. |
CVE-2017-2644 | Medium | 6.1 | 2017-03-26 | In Moodle 3.x, XSS can occur via evidence of prior learning. |
CVE-2017-2643 | Medium | 5.3 | 2017-03-26 | In Moodle 3.2.x, global search displays user names for unauthenticated users. |
CVE-2017-2641 | Critical | 9.8 | 2017-03-26 | In Moodle 2.x and 3.x, SQL injection can occur via user preferences. |
CVE-2017-7266 | Medium | 6.1 | 2017-03-26 | Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespecti… |
CVE-2017-7264 | Medium | 5.3 | 2017-03-26 | Use-after-free vulnerability in the fz_subsample_pixmap function in fitz/pixmap.c in Artifex MuPDF 1.10a allows remote attackers to cause a denial of service (… |
CVE-2017-7263 | High | 7.8 | 2017-03-26 | The bm_readbody_bmp function in bitmap_io.c in Potrace 1.14 allows remote attackers to cause a denial of service (heap-based buffer over-read and application c… |
CVE-2017-7262 | Medium | 5.5 | 2017-03-25 | The AMD Ryzen processor with AGESA microcode through 2017-01-27 allows local users to cause a denial of service (system hang) via an application that makes a l… |
CVE-2017-7261 | Medium | 5.5 | 2017-03-24 | The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.5 does not check for a zero value of certain… |
CVE-2017-7257 | Medium | 5.4 | 2017-03-24 | XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter. Someone must login to conduct the attack. |
CVE-2017-7256 | Medium | 5.4 | 2017-03-24 | XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter. Someone must login to conduct the attack. |
CVE-2017-7255 | Medium | 5.4 | 2017-03-24 | XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter. Someone must login to conduct the attack. |
CVE-2017-7243 | High | 7.5 | 2017-03-24 | Eclipse tinydtls 0.8.2 for Eclipse IoT allows remote attackers to cause a denial of service (DTLS peer crash) by sending a "Change cipher spec" packet without… |
CVE-2017-7240 | High | 7.5 | 2017-03-24 | An issue was discovered on Miele Professional PST10 devices. The corresponding embedded webserver "PST10 WebServer" typically listens to port 80 and is prone t… |
CVE-2017-5511 | Critical | 9.8 | 2017-03-24 | coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow. |
CVE-2017-5510 | High | 7.8 | 2017-03-24 | coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write. |
CVE-2017-5509 | High | 7.8 | 2017-03-24 | coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write. |
CVE-2017-5508 | Medium | 5.5 | 2017-03-24 | Heap-based buffer overflow in the PushQuantumPixel function in ImageMagick before 6.9.7-3 and 7.x before 7.0.4-3 allows remote attackers to cause a denial of s… |
CVE-2017-5507 | High | 7.5 | 2017-03-24 | Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a denial of service (memory consumption) via… |
CVE-2017-5506 | High | 7.8 | 2017-03-24 | Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file. |
CVE-2017-5337 | Critical | 9.8 | 2017-03-24 | Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified i… |
CVE-2017-5336 | Critical | 9.8 | 2017-03-24 | Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to… |
CVE-2017-5335 | High | 7.5 | 2017-03-24 | The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (o… |
CVE-2017-5334 | Critical | 9.8 | 2017-03-24 | Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecifi… |
CVE-2017-6087 | High | 8.8 | 2017-03-24 | EyesOfNetwork ("EON") 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected_events[] parameter i… |
CVE-2017-5869 | High | 8.8 | 2017-03-24 | Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to upload and execute a… |
CVE-2017-5644 | Medium | 5.5 | 2017-03-24 | Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an… |
CVE-2017-6369 | High | 8.8 | 2017-03-24 | Insufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'sys… |
CVE-2017-6507 | Medium | 5.9 | 2017-03-24 | An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit fi… |
CVE-2017-5199 | High | 8.8 | 2017-03-24 | The editbanner feature in SolarWinds LEM (aka SIEM) through 6.3.1 allows remote authenticated users to execute arbitrary code by editing /usr/local/contego/scr… |
CVE-2017-5198 | High | 8.8 | 2017-03-24 | SolarWinds LEM (aka SIEM) before 6.3.1 has an incorrect sudo configuration, which allows local users to obtain root access by editing /usr/local/contego/script… |
CVE-2017-7251 | Medium | 6.1 | 2017-03-23 | A Cross-Site Scripting (XSS) was discovered in pi-engine/pi 2.5.0. The vulnerability exists due to insufficient filtration of user-supplied data (preview) pass… |
CVE-2017-7250 | Medium | 6.1 | 2017-03-23 | A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data (action… |
CVE-2017-7249 | Medium | 6.1 | 2017-03-23 | Multiple Cross-Site Scripting (XSS) were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied dat… |
CVE-2017-7248 | Medium | 6.1 | 2017-03-23 | A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data (type)… |
CVE-2017-7247 | Medium | 6.1 | 2017-03-23 | Multiple Cross-Site Scripting (XSS) were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied dat… |
CVE-2017-7246 | High | 7.8 | 2017-03-23 | Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (… |
CVE-2017-7245 | High | 7.8 | 2017-03-23 | Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (… |
CVE-2017-7244 | Medium | 5.5 | 2017-03-23 | The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted… |
CVE-2017-6950 | Critical | 9.8 | 2017-03-23 | SAP GUI 7.2 through 7.5 allows remote attackers to bypass intended security policy restrictions and execute arbitrary code via a crafted ABAP code, aka SAP Sec… |
CVE-2017-6911 | Medium | 6.6 | 2017-03-23 | USB Pratirodh is prone to sensitive information disclosure. It stores sensitive information such as username and password in simple usb.xml. An attacker with p… |
CVE-2017-6895 | Critical | 9.8 | 2017-03-23 | USB Pratirodh allows remote attackers to conduct XML External Entity (XXE) attacks via XML data in usb.xml. |
CVE-2017-6517 | Critical | 9.8 | 2017-03-23 | Microsoft Skype 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This… |
CVE-2017-7242 | Medium | 6.1 | 2017-03-23 | Multiple Cross-Site Scripting (XSS) were discovered in admin/modules components in SLiMS 7 Cendana through 2017-03-23: the keywords parameter to bibliography/c… |
CVE-2017-7199 | High | 7.8 | 2017-03-23 | Nessus 6.6.2 - 6.10.3 contains a flaw related to insecure permissions that may allow a local attacker to escalate privileges when the software is running in Ag… |
CVE-2017-6361 | Critical | 9.8 | 2017-03-23 | QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. |
CVE-2017-6360 | Critical | 9.8 | 2017-03-23 | QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors. |
CVE-2017-6359 | Critical | 9.8 | 2017-03-23 | QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors. |
CVE-2017-6191 | High | 7.8 | 2017-03-23 | Buffer overflow in APNGDis 2.8 and below allows a remote attacker to execute arbitrary code via a crafted filename. |
CVE-2017-5897 | Critical | 9.8 | 2017-03-23 | The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6… |
CVE-2017-5538 | Critical | 9.8 | 2017-03-23 | The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core_linux.c in the GPU driver on Samsung devices with M(6.0) and N(7.0) software and Exynos AP chipset… |