2017 CVEs (page 137)
Page 137 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-0051 | Medium | 5.4 | 2017-03-17 | Microsoft Windows 10 1607 and Windows Server 2016 allow remote attackers to cause a denial of service (application hang) via a crafted Office document, aka "Mi… |
CVE-2017-0050 | High | 7.8 | 2017-03-17 | The kernel API in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7; Windows 8; Windows 10 Gold, 1511, and 1607; Windows RT 8.1; Windo… |
CVE-2017-0049 | Medium | 4.3 | 2017-03-17 | The VBScript engine in Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "… |
CVE-2017-0047 | High | 7.8 | 2017-03-17 | The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an… |
CVE-2017-0045 | Medium | 5.5 | 2017-03-17 | Windows DVD Maker in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows Vista SP2 does not properly parse crafted .msdvd files, which allows attack… |
CVE-2017-0043 | Medium | 5.3 | 2017-03-17 | Active Directory Federation Services in Microsoft Windows 10 1607, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and Windows Server 2016… |
CVE-2017-0042 | Low | 3.1 | 2017-03-17 | Windows Media Player in Microsoft Windows 8.1; Windows Server 2012 R2; Windows RT 8.1; Windows 7 SP1; Windows 2008 SP2 and R2 SP1, Windows Server 2016; Windows… |
CVE-2017-0040 | High | 7.5 | 2017-03-17 | The scripting engine in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupt… |
CVE-2017-0039 | High | 7.8 | 2017-03-17 | Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle dynamic link library (DLL) loading, which allows local users to gain privileges via a crafted applica… |
CVE-2017-0035 | High | 7.5 | 2017-03-17 | A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. Thes… |
CVE-2017-0034 | High | 7.5 | 2017-03-17 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in a way that en… |
CVE-2017-0033 | Medium | 4.3 | 2017-03-17 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a crafted web site, aka "Microsoft Browser Spoofing Vulnerabi… |
CVE-2017-0032 | High | 7.5 | 2017-03-17 | A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. Thes… |
CVE-2017-0031 | High | 7.8 | 2017-03-17 | Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Word 2007 SP3, and Word 2010 SP2 allow remote attackers to execute arbitrary code or cause a denial o… |
CVE-2017-0030 | High | 7.8 | 2017-03-17 | Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Office Web Apps Server 2010 SP2, Word 2007 SP3, Word 2010 SP2, and Word Automation Services on ShareP… |
CVE-2017-0029 | Medium | 5.5 | 2017-03-17 | Microsoft Office 2010 SP2, Word 2010 SP2, Word 2013 RT SP1, and Word 2016 allow remote attackers to cause a denial of service (application hang) via a crafted… |
CVE-2017-0027 | Medium | 4.7 | 2017-03-17 | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2013 SP1 allow… |
CVE-2017-0026 | High | 7.8 | 2017-03-17 | The kernel-mode drivers in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allow local users to gain privileges via a crafted application, ak… |
CVE-2017-0025 | High | 7.8 | 2017-03-17 | The kernel-mode drivers in Microsoft Windows Vista; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT… |
CVE-2017-0024 | High | 7.8 | 2017-03-17 | The kernel-mode drivers in Microsoft Windows 10 1607 and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevat… |
CVE-2017-0023 | High | 7.5 | 2017-03-17 | The PDF library in Microsoft Edge; Windows 8.1; Windows Server 2012 and R2; Windows RT 8.1; and Windows 10, 1511, and 1607 allows remote attackers to execute a… |
CVE-2017-0022 | Medium | 6.5 | 2017-03-17 | Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows… |
CVE-2017-0021 | Critical | 9.0 | 2017-03-17 | Hyper-V in Microsoft Windows 10 1607 and Windows Server 2016 does not properly validate vSMB packet data, which allows attackers to execute arbitrary code on a… |
CVE-2017-0020 | High | 7.8 | 2017-03-17 | Microsoft Excel 2016, Excel 2010 SP2, Excel 2013 RT SP1, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code or cause a denial… |
CVE-2017-0019 | High | 7.8 | 2017-03-17 | Microsoft Word 2016 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft O… |
CVE-2017-0018 | High | 7.5 | 2017-03-17 | Microsoft Internet Explorer 10 and 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site… |
CVE-2017-0017 | Medium | 6.1 | 2017-03-17 | The RegEx class in the XSS filter in Microsoft Edge allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive information via… |
CVE-2017-0016 | Medium | 5.9 | 2017-03-17 | Microsoft Windows 10 Gold, 1511, and 1607; Windows 8.1; Windows RT 8.1; Windows Server 2012 R2, and Windows Server 2016 do not properly handle certain requests… |
CVE-2017-0015 | High | 7.5 | 2017-03-17 | A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. Thes… |
CVE-2017-0014 | High | 7.5 | 2017-03-17 | The Windows Graphics Component in Microsoft Office 2010 SP2; Windows Server 2008 R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows R… |
CVE-2017-0012 | Medium | 4.3 | 2017-03-17 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a crafted web site, aka "Microsoft Browser Spoofing Vulnerabi… |
CVE-2017-0011 | Medium | 4.3 | 2017-03-17 | Microsoft Edge allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability." This… |
CVE-2017-0010 | High | 7.5 | 2017-03-17 | A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. Thes… |
CVE-2017-0009 | Medium | 4.3 | 2017-03-17 | Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Brow… |
CVE-2017-0008 | Medium | 4.3 | 2017-03-17 | Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explo… |
CVE-2017-0007 | Medium | 5.5 | 2017-03-17 | Device Guard in Microsoft Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows remote attackers to modify PowerShell script without invalidating associa… |
CVE-2017-0006 | High | 7.8 | 2017-03-17 | Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3 allow remote attackers to execute arbit… |
CVE-2017-0005 | High | 7.8 | 2017-03-17 | The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an… |
CVE-2017-0001 | High | 7.8 | 2017-03-17 | The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold an… |
CVE-2017-6952 | High | 8.8 | 2017-03-16 | Integer overflow in the cs_winkernel_malloc function in winkernel_mm.c in Capstone 3.0.4 and earlier allows attackers to cause a denial of service (heap-based… |
CVE-2017-6951 | Medium | 5.5 | 2017-03-16 | The keyring_search_aux function in security/keys/keyring.c in the Linux kernel through 3.14.79 allows local users to cause a denial of service (NULL pointer de… |
CVE-2017-6949 | High | 8.1 | 2017-03-16 | An issue was discovered in CHICKEN Scheme through 4.12.0. When using a nonstandard CHICKEN-specific extension to allocate an SRFI-4 vector in unmanaged memory… |
CVE-2017-5857 | Medium | 6.5 | 2017-03-16 | Memory leak in the virgl_cmd_resource_unref function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial o… |
CVE-2017-5856 | Medium | 6.5 | 2017-03-16 | Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of s… |
CVE-2017-5667 | Medium | 6.5 | 2017-03-16 | The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service… |
CVE-2017-5643 | High | 7.4 | 2017-03-16 | Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE. |
CVE-2017-5617 | High | 7.4 | 2017-03-16 | The SVG Salamander (aka svgSalamander) library, when used in a web application, allows remote attackers to conduct server-side request forgery (SSRF) attacks v… |
CVE-2017-5505 | Medium | 5.5 | 2017-03-16 | The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted… |
CVE-2017-6510 | High | 7.5 | 2017-03-16 | Easy File Sharing FTP Server version 3.6 is vulnerable to a directory traversal vulnerability which allows an attacker to list and download any file from any f… |
CVE-2017-6381 | High | 8.1 | 2017-03-16 | A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htac… |
CVE-2017-6379 | High | 7.5 | 2017-03-16 | Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This… |
CVE-2017-6377 | High | 7.5 | 2017-03-16 | When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an… |
CVE-2017-6061 | Medium | 4.7 | 2017-03-16 | Cross-site scripting (XSS) vulnerability in the help component of SAP BusinessObjects Financial Consolidation 10.0.0.1933 allows remote attackers to inject arb… |
CVE-2017-6023 | Critical | 9.8 | 2017-03-16 | An issue was discovered in Fatek Automation PLC Ethernet Module. The affected Ether_cfg software configuration tool runs on the following Fatek PLCs: CBEH vers… |
CVE-2017-3854 | High | 8.8 | 2017-03-15 | A vulnerability in the mesh code of Cisco Wireless LAN Controller (WLC) software could allow an unauthenticated, remote attacker to impersonate a WLC in a mesh… |
CVE-2017-3846 | High | 8.6 | 2017-03-15 | A vulnerability in the Client Manager Server of Cisco Workload Automation and Cisco Tidal Enterprise Scheduler could allow an unauthenticated, remote attacker… |
CVE-2017-3831 | Critical | 9.8 | 2017-03-15 | A vulnerability in the web-based GUI of Cisco Mobility Express 1800 Series Access Points could allow an unauthenticated, remote attacker to bypass authenticati… |
CVE-2017-3819 | High | 8.8 | 2017-03-15 | A privilege escalation vulnerability in the Secure Shell (SSH) subsystem in the StarOS operating system for Cisco ASR 5000 Series, ASR 5500 Series, ASR 5700 Se… |
CVE-2017-5937 | Medium | 6.5 | 2017-03-15 | The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS users to cause a den… |
CVE-2017-5898 | Medium | 5.5 | 2017-03-15 | Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID Card device emulator… |
CVE-2017-5849 | Medium | 5.5 | 2017-03-15 | tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-b… |
CVE-2017-6918 | Medium | 4.3 | 2017-03-15 | CSRF exists in BigTree CMS 4.2.16 with the value[#][*] parameter to the admin/settings/update/ page. The Navigation Social can be changed. |
CVE-2017-6917 | Medium | 4.3 | 2017-03-15 | CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Colophon can be changed. |
CVE-2017-6916 | Medium | 4.3 | 2017-03-15 | CSRF exists in BigTree CMS 4.1.18 with the nav-social[#] parameter to the admin/settings/update/ page. The Navigation Social can be changed. |
CVE-2017-6915 | Medium | 4.3 | 2017-03-15 | CSRF exists in BigTree CMS 4.1.18 with the colophon parameter to the admin/settings/update/ page. The Colophon can be changed. |
CVE-2017-6914 | High | 7.1 | 2017-03-15 | CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page. A user can be deleted. |
CVE-2017-5522 | Critical | 9.8 | 2017-03-15 | Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial… |
CVE-2017-6443 | Medium | 6.1 | 2017-03-15 | Cross-site scripting (XSS) vulnerability in EPSON TMNet WebConfig 1.00 allows remote attackers to inject arbitrary web script or HTML via the W_AD1 parameter t… |
CVE-2017-6430 | Medium | 5.5 | 2017-03-15 | The compile_tree function in ef_compiler.c in the Etterfilter utility in Ettercap 0.8.2 and earlier allows remote attackers to cause a denial of service (out-o… |
CVE-2017-6429 | High | 7.8 | 2017-03-15 | Buffer overflow in the tcpcapinfo utility in Tcpreplay before 4.2.0 Beta 1 allows remote attackers to have unspecified impact via a pcap file with an over-size… |
CVE-2017-6189 | High | 7.3 | 2017-03-15 | Untrusted search path vulnerability in Amazon Kindle for PC before 1.19 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Tr… |
CVE-2017-5580 | High | 7.1 | 2017-03-15 | The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (ou… |
CVE-2017-5579 | Medium | 6.5 | 2017-03-15 | Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of servi… |
CVE-2017-5578 | Medium | 6.5 | 2017-03-15 | Memory leak in the virtio_gpu_resource_attach_backing function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a d… |
CVE-2017-5552 | Medium | 6.5 | 2017-03-15 | Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a den… |
CVE-2017-5537 | Medium | 5.3 | 2017-03-15 | The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which… |
CVE-2017-5526 | Medium | 6.5 | 2017-03-15 | Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and… |
CVE-2017-5525 | Medium | 6.5 | 2017-03-15 | Memory leak in hw/audio/ac97.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QE… |
CVE-2017-5496 | Critical | 9.8 | 2017-03-15 | Sawmill Enterprise 8.7.9 allows remote attackers to gain login access by leveraging knowledge of a password hash. |
CVE-2017-5359 | High | 7.5 | 2017-03-15 | EasyCom SQL iPlug allows remote attackers to cause a denial of service via the D$EVAL parameter to the default URI. |
CVE-2017-5358 | Critical | 9.8 | 2017-03-15 | Stack-based buffer overflows in php_Easycom5_3_0.dll in EasyCom for PHP 4.0.0.29 allows remote attackers to execute arbitrary code via the server argument to t… |
CVE-2017-6852 | High | 7.8 | 2017-03-15 | Heap-based buffer overflow in the jpc_dec_decodepkt function in jpc_t2dec.c in JasPer 2.0.10 allows remote attackers to have unspecified impact via a crafted i… |
CVE-2017-6851 | Medium | 5.5 | 2017-03-15 | The jas_matrix_bindsub function in jas_seq.c in JasPer 2.0.10 allows remote attackers to cause a denial of service (invalid read) via a crafted image. |
CVE-2017-6850 | Medium | 5.5 | 2017-03-15 | The jp2_cdef_destroy function in jp2_cod.c in JasPer before 2.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafte… |
CVE-2017-6849 | Medium | 5.5 | 2017-03-15 | The PoDoFo::PdfColorGray::~PdfColorGray function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference… |
CVE-2017-6848 | Medium | 5.5 | 2017-03-15 | The PoDoFo::PdfXObject::PdfXObject function in PdfXObject.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference) v… |
CVE-2017-6847 | Medium | 5.5 | 2017-03-15 | The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) vi… |
CVE-2017-6846 | Medium | 5.5 | 2017-03-15 | The GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace function in graphicsstack.h in PoDoFo 0.9.4 allows remote attackers to cause a denial of ser… |
CVE-2017-6845 | Medium | 5.5 | 2017-03-15 | The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a c… |
CVE-2017-6844 | High | 7.8 | 2017-03-15 | Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a… |
CVE-2017-6843 | High | 7.8 | 2017-03-15 | Heap-based buffer overflow in the PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to have unspecified impact v… |
CVE-2017-6842 | Medium | 5.5 | 2017-03-15 | The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference… |
CVE-2017-6841 | Medium | 5.5 | 2017-03-15 | The GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement function in graphicsstack.h in PoDoFo 0.9.5 allows remote attackers to cause a denial of servi… |
CVE-2017-6840 | Medium | 5.5 | 2017-03-15 | The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (invalid read) via a craf… |
CVE-2017-6828 | High | 7.8 | 2017-03-15 | Heap-based buffer overflow in the readValue function in FileHandle.cpp in audiofile (aka libaudiofile and Audio File Library) 0.3.6 allows remote attackers to… |
CVE-2017-6827 | High | 7.8 | 2017-03-15 | Heap-based buffer overflow in the MSADPCM::initializeCoefficients function in MSADPCM.cpp in audiofile (aka libaudiofile and Audio File Library) 0.3.6 allows r… |
CVE-2017-6505 | Medium | 6.5 | 2017-03-15 | The ohci_service_ed_list function in hw/usb/hcd-ohci.c in QEMU (aka Quick Emulator) before 2.9.0 allows local guest OS users to cause a denial of service (infi… |
CVE-2017-6440 | Medium | 5.0 | 2017-03-15 | The parse_data_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a craf… |
CVE-2017-6439 | Medium | 5.0 | 2017-03-15 | Heap-based buffer overflow in the parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out… |
CVE-2017-6438 | High | 7.3 | 2017-03-15 | Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (ou… |