2017 CVEs (page 140)
Page 140 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-0461 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0460 | High | 7.0 | 2017-03-08 | An elevation of privilege vulnerability in the Qualcomm networking driver could enable a local malicious application to execute arbitrary code within the conte… |
CVE-2017-0459 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0458 | High | 7.0 | 2017-03-08 | An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2017-0457 | High | 7.0 | 2017-03-08 | An elevation of privilege vulnerability in the Qualcomm ADSPRPC driver could enable a local malicious application to execute arbitrary code within the context… |
CVE-2017-0456 | High | 7.0 | 2017-03-08 | An elevation of privilege vulnerability in the Qualcomm IPA driver could enable a local malicious application to execute arbitrary code within the context of t… |
CVE-2017-0455 | High | 7.8 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm bootloader could help to enable a local malicious application to to execute arbitrary code within the c… |
CVE-2017-0453 | High | 7.0 | 2017-03-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0452 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission level… |
CVE-2017-0338 | High | 7.8 | 2017-03-08 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2017-0337 | High | 7.8 | 2017-03-08 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2017-0336 | Medium | 5.5 | 2017-03-08 | An information disclosure vulnerability in the NVIDIA GPU driver could enable a local malicious application to access data outside of its permission levels. Th… |
CVE-2017-0335 | High | 7.8 | 2017-03-08 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2017-0334 | Medium | 5.5 | 2017-03-08 | An information disclosure vulnerability in the NVIDIA GPU driver could enable a local malicious application to access data outside of its permission levels. Th… |
CVE-2017-0333 | High | 7.8 | 2017-03-08 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2017-0307 | High | 7.8 | 2017-03-08 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2017-0306 | High | 7.8 | 2017-03-08 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2017-6518 | Medium | 6.1 | 2017-03-08 | Cross-site scripting (XSS) vulnerability in /sanadata/seo/index.asp in SANADATA SanaCMS 7.3 allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2017-2636 | High | 7.0 | 2017-03-07 | Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by s… |
CVE-2017-6511 | Medium | 6.1 | 2017-03-07 | andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in application/classes/ap… |
CVE-2017-5681 | High | 7.5 | 2017-03-07 | The RSA-CRT implementation in the Intel QuickAssist Technology (QAT) Engine for OpenSSL versions prior to 0.5.19 may allow remote attackers to obtain private R… |
CVE-2017-1133 | Medium | 5.4 | 2017-03-07 | IBM QRadar 7.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intend… |
CVE-2017-1124 | Low | 2.9 | 2017-03-07 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference #: 199805… |
CVE-2017-6509 | Medium | 6.1 | 2017-03-07 | Smith0r/burgundy-cms before 2017-03-06 is vulnerable to a reflected XSS in admin/components/menu/views/menuitems.php (id parameter). |
CVE-2017-3159 | Critical | 9.8 | 2017-03-07 | Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws. |
CVE-2017-6508 | Medium | 6.1 | 2017-03-07 | CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequen… |
CVE-2017-6411 | High | 8.8 | 2017-03-06 | Cross Site Request Forgery (CSRF) on D-Link DSL-2730U C1 IN_1.00 devices allows remote attackers to change the DNS or firewall configuration or any password. |
CVE-2017-5999 | High | 7.5 | 2017-03-06 | An issue was discovered in sysPass 2.x before 2.1, in which an algorithm was never sufficiently reviewed by cryptographers. The fact that inc/SP/Core/Crypt.cla… |
CVE-2017-5633 | High | 8.0 | 2017-03-06 | Multiple cross-site request forgery (CSRF) vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to (1) change the adm… |
CVE-2017-5197 | Medium | 6.1 | 2017-03-06 | There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. The attack vector is a page name. An example payload is a crafted JavaScript event handle… |
CVE-2017-6504 | Medium | 6.1 | 2017-03-06 | WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking. |
CVE-2017-6503 | Medium | 6.1 | 2017-03-06 | WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS. |
CVE-2017-6502 | Medium | 5.5 | 2017-03-06 | An issue was discovered in ImageMagick 6.9.7. A specially crafted webp file could lead to a file-descriptor leak in libmagickcore (thus, a DoS). |
CVE-2017-6501 | Medium | 5.5 | 2017-03-06 | An issue was discovered in ImageMagick 6.9.7. A specially crafted xcf file could lead to a NULL pointer dereference. |
CVE-2017-6500 | Medium | 5.5 | 2017-03-06 | An issue was discovered in ImageMagick 6.9.7. A specially crafted sun file triggers a heap-based buffer over-read. |
CVE-2017-6499 | Medium | 5.5 | 2017-03-06 | An issue was discovered in Magick++ in ImageMagick 6.9.7. A specially crafted file creating a nested exception could lead to a memory leak (thus, a DoS). |
CVE-2017-6498 | Medium | 5.5 | 2017-03-06 | An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS. |
CVE-2017-6497 | High | 7.5 | 2017-03-06 | An issue was discovered in ImageMagick 6.9.7. A specially crafted psd file could lead to a NULL pointer dereference (thus, a DoS). |
CVE-2017-6416 | Critical | 9.8 | 2017-03-06 | An issue was discovered in SysGauge 1.5.18. A buffer overflow vulnerability in SMTP connection verification leads to arbitrary code execution. The attack vecto… |
CVE-2017-6351 | High | 8.1 | 2017-03-06 | The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password. Once the device is set to DEBUG mode… |
CVE-2017-6334 | High | 8.8 | 2017-03-06 | dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metachara… |
CVE-2017-6446 | Medium | 6.1 | 2017-03-05 | XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters. |
CVE-2017-6492 | High | 7.2 | 2017-03-05 | SQL Injection was discovered in adm_program/modules/dates/dates_function.php in Admidio 3.2.5. The POST parameter dat_cat_id is concatenated into a SQL query w… |
CVE-2017-6491 | Medium | 6.1 | 2017-03-05 | Multiple Cross-Site Scripting (XSS) issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data (to… |
CVE-2017-6490 | Medium | 6.1 | 2017-03-05 | Multiple Cross-Site Scripting (XSS) issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data (ci… |
CVE-2017-6489 | Medium | 6.1 | 2017-03-05 | Multiple Cross-Site Scripting (XSS) issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data (el… |
CVE-2017-6488 | Medium | 6.1 | 2017-03-05 | Multiple Cross-Site Scripting (XSS) issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data (vi… |
CVE-2017-6487 | Medium | 6.1 | 2017-03-05 | Multiple Cross-Site Scripting (XSS) issues were discovered in EPESI 1.8.1.1. The vulnerabilities exist due to insufficient filtration of user-supplied data (st… |
CVE-2017-6486 | Medium | 6.1 | 2017-03-05 | A Cross-Site Scripting (XSS) issue was discovered in reasoncms before 4.7.1. The vulnerability exists due to insufficient filtration of user-supplied data (nyr… |
CVE-2017-6485 | Medium | 6.1 | 2017-03-05 | A Cross-Site Scripting (XSS) issue was discovered in php-calendar before 2017-03-03. The vulnerability exists due to insufficient filtration of user-supplied d… |
CVE-2017-6484 | Medium | 6.1 | 2017-03-05 | Multiple Cross-Site Scripting (XSS) issues were discovered in INTER-Mediator 5.5. The vulnerabilities exist due to insufficient filtration of user-supplied dat… |
CVE-2017-6483 | Medium | 6.1 | 2017-03-05 | Multiple Cross-Site Scripting (XSS) issues were discovered in ATutor 2.2.2. The vulnerabilities exist due to insufficient filtration of user-supplied data pass… |
CVE-2017-6481 | Medium | 6.1 | 2017-03-05 | Multiple Cross-Site Scripting (XSS) issues were discovered in phpipam 1.2. The vulnerabilities exist due to insufficient filtration of user-supplied data passe… |
CVE-2017-6480 | Medium | 6.1 | 2017-03-05 | groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php (path parameter). |
CVE-2017-6479 | Medium | 6.1 | 2017-03-05 | FenixHosting/fenix-open-source before 2017-03-04 is vulnerable to a reflected XSS in forums/search.php (search-by-topic parameter). |
CVE-2017-6478 | Medium | 6.1 | 2017-03-05 | paintballrefjosh/MaNGOSWebV4 before 4.0.8 is vulnerable to a reflected XSS in install/index.php (step parameter). |
CVE-2017-6445 | High | 8.1 | 2017-03-05 | The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and 8.0.4 uses neither encrypted connections nor signed updates. A… |
CVE-2017-6474 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser infinite loop, triggered by a malformed capture file. This was addressed in w… |
CVE-2017-6473 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a K12 file parser crash, triggered by a malformed capture file. This was addressed in wiretap/k12.c b… |
CVE-2017-6472 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an RTMPT dissector infinite loop, triggered by packet injection or a malformed capture file. This was… |
CVE-2017-6471 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a WSP infinite loop, triggered by packet injection or a malformed capture file. This was addressed in… |
CVE-2017-6470 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an IAX2 infinite loop, triggered by packet injection or a malformed capture file. This was addressed… |
CVE-2017-6469 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet injection or a malformed capture file. This was addresse… |
CVE-2017-6468 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser crash, triggered by a malformed capture file. This was addressed in wiretap/n… |
CVE-2017-6467 | High | 7.5 | 2017-03-04 | In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a Netscaler file parser infinite loop, triggered by a malformed capture file. This was addressed in w… |
CVE-2017-5867 | Medium | 6.5 | 2017-03-03 | ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a denial of service (s… |
CVE-2017-5866 | Medium | 4.3 | 2017-03-03 | The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows rem… |
CVE-2017-5865 | Low | 3.7 | 2017-03-03 | The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error message… |
CVE-2017-5836 | High | 7.5 | 2017-03-03 | The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated… |
CVE-2017-5835 | High | 7.5 | 2017-03-03 | libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero. |
CVE-2017-5834 | Medium | 5.5 | 2017-03-03 | The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file. |
CVE-2017-5833 | Medium | 6.1 | 2017-03-03 | Cross-site scripting (XSS) vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to in… |
CVE-2017-5832 | Medium | 5.4 | 2017-03-03 | Cross-site scripting (XSS) vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user'… |
CVE-2017-5831 | Medium | 5.9 | 2017-03-03 | Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack… |
CVE-2017-5830 | Critical | 9.8 | 2017-03-03 | Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts. |
CVE-2017-5616 | Medium | 6.1 | 2017-03-03 | Cross-site scripting (XSS) vulnerability in cgiemail and cgiecho allows remote attackers to inject arbitrary web script or HTML via the addendum parameter. |
CVE-2017-5615 | Medium | 6.1 | 2017-03-03 | cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location. |
CVE-2017-5614 | Medium | 6.1 | 2017-03-03 | Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors i… |
CVE-2017-5613 | High | 7.8 | 2017-03-03 | Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file. |
CVE-2017-5571 | Medium | 6.1 | 2017-03-03 | Open redirect vulnerability in the lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) 11.14.1 and earlier, as used in Citrix License Ser… |
CVE-2017-5356 | High | 7.5 | 2017-03-03 | Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) with… |
CVE-2017-5196 | High | 7.5 | 2017-03-03 | Irssi 0.8.18 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via vectors involving strings that are not UTF8. |
CVE-2017-5195 | High | 7.5 | 2017-03-03 | Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code. |
CVE-2017-5194 | High | 7.5 | 2017-03-03 | Use-after-free vulnerability in Irssi before 0.8.21 allows remote attackers to cause a denial of service (crash) via an invalid nick message. |
CVE-2017-5193 | High | 7.5 | 2017-03-03 | The nickcmp function in Irssi before 0.8.21 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a message without a n… |
CVE-2017-2290 | High | 8.8 | 2017-03-03 | On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with a… |
CVE-2017-6104 | High | 7.5 | 2017-03-02 | Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0. |
CVE-2017-6103 | Medium | 6.1 | 2017-03-02 | Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1.1. |
CVE-2017-6102 | Medium | 6.1 | 2017-03-02 | Persistent XSS in wordpress plugin rockhoist-badges v1.2.2. |
CVE-2017-5235 | High | 7.8 | 2017-03-02 | Rapid7 Metasploit Pro installers prior to version 4.13.0-2017022101 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a… |
CVE-2017-5234 | High | 7.8 | 2017-03-02 | Rapid7 Insight Collector installers prior to version 1.0.16 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a maliciou… |
CVE-2017-5233 | High | 7.8 | 2017-03-02 | Rapid7 AppSpider Pro installers prior to version 6.14.053 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious… |
CVE-2017-5232 | High | 7.8 | 2017-03-02 | All editions of Rapid7 Nexpose installers prior to version 6.4.24 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a ma… |
CVE-2017-5231 | High | 7.1 | 2017-03-02 | All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cm… |
CVE-2017-5230 | High | 7.2 | 2017-03-02 | The Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is encrypted with a static password of 'r@p1d7k3y5t0r3' which is not modifiabl… |
CVE-2017-5229 | High | 7.1 | 2017-03-02 | All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi Clipboard.parse_dump… |
CVE-2017-5228 | High | 7.1 | 2017-03-02 | All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download() funct… |
CVE-2017-6413 | High | 8.6 | 2017-03-02 | The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM… |
CVE-2017-6410 | Medium | 5.5 | 2017-03-02 | kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Aut… |
CVE-2017-6409 | Critical | 9.8 | 2017-03-02 | An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. Unauthenticated CORBA interfaces permit inappropriate acc… |