2017 CVEs (page 141)
Page 141 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-6408 | High | 7.0 | 2017-03-02 | An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. A local-privilege-escalation race condition in pbx_exchan… |
CVE-2017-6407 | High | 8.8 | 2017-03-02 | An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2. Privileged remote command execution on NetBackup Server and Cli… |
CVE-2017-6406 | High | 8.8 | 2017-03-02 | An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2. Arbitrary privileged command execution, using whitelist directo… |
CVE-2017-6405 | High | 7.5 | 2017-03-02 | An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. Hostname-based security is open to DNS spoofing. |
CVE-2017-6404 | Medium | 5.5 | 2017-03-02 | An issue was discovered in Veritas NetBackup Before 7.7 and NetBackup Appliance Before 2.7. There are world-writable log files, allowing destruction or spoofin… |
CVE-2017-6403 | Critical | 9.8 | 2017-03-02 | An issue was discovered in Veritas NetBackup Before 8.0 and NetBackup Appliance Before 3.0. NetBackup Cloud Storage Service uses a hardcoded username and passw… |
CVE-2017-6402 | Medium | 6.5 | 2017-03-02 | An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. Denial of service affecting NetBackup server can occur. |
CVE-2017-6401 | High | 7.8 | 2017-03-02 | An issue was discovered in Veritas NetBackup before 8.0 and NetBackup Appliance before 3.0. Local arbitrary command execution can occur when using bpcd and bpn… |
CVE-2017-6400 | High | 8.8 | 2017-03-02 | An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2. Privileged command execution on NetBackup Server and Client can… |
CVE-2017-6399 | High | 8.8 | 2017-03-02 | An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2. Privileged remote command execution on NetBackup Server and Cli… |
CVE-2017-6397 | Medium | 6.1 | 2017-03-02 | An issue was discovered in FlightAirMap v1.0-beta.10. The vulnerability exists due to insufficient filtration of user-supplied data in multiple parameters pass… |
CVE-2017-6396 | Medium | 6.1 | 2017-03-02 | An issue was discovered in WPO-Foundation WebPageTest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "webpage… |
CVE-2017-6395 | Medium | 6.1 | 2017-03-02 | An issue was discovered in HashOver 2.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the 'hashover/scripts/widget-o… |
CVE-2017-6394 | Medium | 6.1 | 2017-03-02 | Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-sup… |
CVE-2017-6393 | Medium | 6.1 | 2017-03-02 | An issue was discovered in NagVis 1.9b12. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "nagvis-master/share/user… |
CVE-2017-6392 | Medium | 6.1 | 2017-03-02 | An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "server-Lyn… |
CVE-2017-6391 | Medium | 6.1 | 2017-03-02 | An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "admin_cons… |
CVE-2017-6390 | Medium | 6.1 | 2017-03-02 | An issue was discovered in whatanime.ga before c334dd8499a681587dd4199e90b0aa0eba814c1d. The vulnerability exists due to insufficient filtration of user-suppli… |
CVE-2017-6384 | High | 7.5 | 2017-03-02 | Memory leak in the login_user function in saslserv/main.c in saslserv/main.so in Atheme 7.2.7 allows a remote unauthenticated attacker to consume memory and ca… |
CVE-2017-6062 | High | 8.6 | 2017-03-02 | The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM… |
CVE-2017-6415 | Medium | 5.5 | 2017-03-02 | The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference and a… |
CVE-2017-6387 | Medium | 5.5 | 2017-03-02 | The dex_loadcode function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (out-of-bounds read and application cra… |
CVE-2017-6319 | High | 7.8 | 2017-03-02 | The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (buffer overflow and applicatio… |
CVE-2017-3826 | High | 7.5 | 2017-03-01 | A vulnerability in the Stream Control Transmission Protocol (SCTP) decoder of the Cisco NetFlow Generation Appliance (NGA) with software before 1.1(1a) could a… |
CVE-2017-6353 | Medium | 5.5 | 2017-03-01 | net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states, which allows local… |
CVE-2017-6348 | Medium | 5.5 | 2017-03-01 | The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before 4.9.13 improperly manages lock dropping, which allows local users to cause a denia… |
CVE-2017-6347 | High | 7.8 | 2017-03-01 | The ip_cmsg_recv_checksum function in net/ipv4/ip_sockglue.c in the Linux kernel before 4.10.1 has incorrect expectations about skb data layout, which allows l… |
CVE-2017-6346 | High | 7.0 | 2017-03-01 | Race condition in net/packet/af_packet.c in the Linux kernel before 4.9.13 allows local users to cause a denial of service (use-after-free) or possibly have un… |
CVE-2017-6345 | High | 7.8 | 2017-03-01 | The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in required circumstances, which allows local users to cau… |
CVE-2017-5995 | High | 7.5 | 2017-03-01 | The NetApp ONTAP Select Deploy administration utility 2.0 through 2.2.1 might allow remote attackers to obtain sensitive information via unspecified vectors. |
CVE-2017-2685 | High | 7.4 | 2017-03-01 | Siemens SINUMERIK Integrate Operate Clients between 2.0.3.00.016 (including) and 2.0.6 (excluding) and between 3.0.4.00.032 (including) and 3.0.6 (excluding) c… |
CVE-2017-5981 | Medium | 5.5 | 2017-03-01 | seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (assertion failure and crash) via a crafted ZIP file. |
CVE-2017-5980 | Medium | 5.5 | 2017-03-01 | The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a… |
CVE-2017-5979 | Medium | 5.5 | 2017-03-01 | The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a craft… |
CVE-2017-5978 | Medium | 5.5 | 2017-03-01 | The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a craft… |
CVE-2017-5977 | Medium | 5.5 | 2017-03-01 | The zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (invalid memory read and crash) vi… |
CVE-2017-5976 | Medium | 5.5 | 2017-03-01 | Heap-based buffer overflow in the zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 all… |
CVE-2017-5975 | Medium | 5.5 | 2017-03-01 | Heap-based buffer overflow in the __zzip_get64 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attac… |
CVE-2017-5974 | Medium | 5.5 | 2017-03-01 | Heap-based buffer overflow in the __zzip_get32 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 allows remote attac… |
CVE-2017-5886 | High | 7.8 | 2017-03-01 | Heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function in PdfTokenizer.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified i… |
CVE-2017-5855 | Medium | 5.5 | 2017-03-01 | The PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer derefere… |
CVE-2017-5854 | Medium | 5.5 | 2017-03-01 | base/PdfOutputStream.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file. |
CVE-2017-5853 | High | 7.8 | 2017-03-01 | Integer overflow in base/PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file. |
CVE-2017-5852 | Medium | 5.5 | 2017-03-01 | The PoDoFo::PdfPage::GetInheritedKeyFromObject function in base/PdfVariant.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (infinite l… |
CVE-2017-5851 | Medium | 5.5 | 2017-03-01 | The free_options function in options_manager.c in mp3splt 2.6.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a… |
CVE-2017-5666 | Medium | 5.5 | 2017-03-01 | The free_options function in options_manager.c in mp3splt 2.6.2 allows remote attackers to cause a denial of service (invalid free and crash) via a crafted fil… |
CVE-2017-5665 | Medium | 5.5 | 2017-03-01 | The splt_cue_export_to_file function in cue.c in libmp3splt 0.9.2 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via… |
CVE-2017-5504 | Medium | 5.5 | 2017-03-01 | The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) vi… |
CVE-2017-5503 | Medium | 5.5 | 2017-03-01 | The dec_clnpass function in libjasper/jpc/jpc_t1dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory write and crash)… |
CVE-2017-5502 | Medium | 5.5 | 2017-03-01 | libjasper/jp2/jp2_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value. |
CVE-2017-5501 | Medium | 5.5 | 2017-03-01 | Integer overflow in libjasper/jpc/jpc_tsfb.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted file. |
CVE-2017-5500 | Medium | 5.5 | 2017-03-01 | libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value. |
CVE-2017-5499 | Medium | 5.5 | 2017-03-01 | Integer overflow in libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted file. |
CVE-2017-5498 | Medium | 5.5 | 2017-03-01 | libjasper/include/jasper/jas_math.h in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negat… |
CVE-2017-5682 | High | 7.3 | 2017-02-28 | Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI Libra… |
CVE-2017-5982 | High | 7.5 | 2017-02-28 | Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash… |
CVE-2017-5885 | Critical | 9.8 | 2017-02-28 | Multiple integer overflows in the (1) vnc_connection_server_message and (2) vnc_color_map_set functions in gtk-vnc before 0.7.0 allow remote servers to cause a… |
CVE-2017-5884 | High | 7.8 | 2017-02-28 | gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x… |
CVE-2017-5581 | Critical | 9.8 | 2017-02-28 | Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1 allows remote servers to execute arbitrary code via an RRE message wit… |
CVE-2017-2683 | High | 8.2 | 2017-02-27 | A non-privileged user of the Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could perform a persistent Cross-Site Scripting (XSS) a… |
CVE-2017-2682 | High | 8.8 | 2017-02-27 | The Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could allow a remote attacker to perform a Cross-Site Request Forgery (CSRF) att… |
CVE-2017-6350 | Critical | 9.8 | 2017-02-27 | An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree le… |
CVE-2017-6349 | Critical | 9.8 | 2017-02-27 | An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length… |
CVE-2017-6344 | Medium | 5.9 | 2017-02-27 | XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document. |
CVE-2017-6343 | High | 8.1 | 2017-02-27 | The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Softwa… |
CVE-2017-6342 | Critical | 9.8 | 2017-02-27 | An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS… |
CVE-2017-6341 | Medium | 5.9 | 2017-02-27 | Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19… |
CVE-2017-6297 | Medium | 5.9 | 2017-02-27 | The L2TP Client in MikroTik RouterOS versions 6.83.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to vi… |
CVE-2017-5946 | Critical | 9.8 | 2017-02-27 | The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker… |
CVE-2017-5928 | Low | 3.7 | 2017-02-27 | The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a performance.now "T… |
CVE-2017-5927 | High | 7.5 | 2017-02-27 | Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern ARM processors. By perform… |
CVE-2017-5926 | High | 7.5 | 2017-02-27 | Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern AMD processors. By perform… |
CVE-2017-5925 | High | 7.5 | 2017-02-27 | Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern Intel processors. By perfo… |
CVE-2017-0037 | High | 8.1 | 2017-02-26 | Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningEle… |
CVE-2017-2791 | High | 7.5 | 2017-02-24 | JustSystems Ichitaro 2016 Trial contains a vulnerability that exists when trying to open a specially crafted PowerPoint file. Due to the application incorrectl… |
CVE-2017-2790 | High | 8.8 | 2017-02-24 | When processing a record type of 0x3c from a Workbook stream from an Excel file (.xls), JustSystems Ichitaro Office trusts that the size is greater than zero… |
CVE-2017-2789 | High | 8.8 | 2017-02-24 | When copying filedata into a buffer, JustSystems Ichitaro Office 2016 Trial will calculate two values to determine how much data to copy from the document. If… |
CVE-2017-5669 | High | 7.8 | 2017-02-24 | The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows lo… |
CVE-2017-6310 | High | 7.8 | 2017-02-24 | An issue was discovered in tnef before 1.4.13. Four type confusions have been identified in the file_add_mapi_attrs() function. These might lead to invalid rea… |
CVE-2017-6309 | High | 7.8 | 2017-02-24 | An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and writ… |
CVE-2017-6308 | High | 7.8 | 2017-02-24 | An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been identified in the functions that wrap mem… |
CVE-2017-6307 | High | 7.8 | 2017-02-24 | An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and wr… |
CVE-2017-6306 | High | 7.8 | 2017-02-24 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "9 of 9. Directory Traversal using the filename; SanitizeFilename functi… |
CVE-2017-6305 | High | 7.8 | 2017-02-24 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "8 of 9. Out of Bounds read and write." |
CVE-2017-6304 | High | 7.8 | 2017-02-24 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "7 of 9. Out of Bounds read." |
CVE-2017-6303 | High | 7.8 | 2017-02-24 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "6 of 9. Invalid Write and Integer Overflow." |
CVE-2017-6302 | High | 7.8 | 2017-02-24 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "5 of 9. Integer Overflow." |
CVE-2017-6301 | High | 7.8 | 2017-02-24 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "4 of 9. Out of Bounds Reads." |
CVE-2017-6300 | High | 7.8 | 2017-02-24 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "3 of 9. Buffer Overflow in version field in lib/tnef-types.h." |
CVE-2017-6299 | Medium | 5.5 | 2017-02-24 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "2 of 9. Infinite Loop / DoS in the TNEFFillMapi function in lib/ytnef.c… |
CVE-2017-6298 | High | 7.8 | 2017-02-24 | An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "1 of 9. Null Pointer Deref / calloc return value not checked." |
CVE-2017-6197 | Medium | 5.5 | 2017-02-24 | The r_read_* functions in libr/include/r_endian.h in radare2 1.2.1 allow remote attackers to cause a denial of service (NULL pointer dereference and applicatio… |
CVE-2017-6196 | High | 7.8 | 2017-02-24 | Multiple use-after-free vulnerabilities in the gx_image_enum_begin function in base/gxipixel.c in Ghostscript before ecceafe3abba2714ef9b432035fe0739d9b1a283 a… |
CVE-2017-6099 | Medium | 6.1 | 2017-02-24 | Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject a… |
CVE-2017-6076 | Medium | 5.5 | 2017-02-24 | In versions of wolfSSL before 3.10.2 the function fp_mul_comba makes it easier to extract RSA key information for a malicious user who has access to view cache… |
CVE-2017-6100 | High | 7.5 | 2017-02-23 | tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP. |
CVE-2017-6214 | High | 7.5 | 2017-02-23 | The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11 allows remote attackers to cause a denial of service (infinite loop and soft l… |
CVE-2017-6206 | High | 7.5 | 2017-02-23 | D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28, and DGS-1510-20 Websmart devices with firmware before 1.31.B003 allo… |
CVE-2017-6205 | Critical | 9.8 | 2017-02-23 | D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28, and DGS-1510-20 Websmart devices with firmware before 1.31.B003 allo… |
CVE-2017-6187 | Critical | 9.8 | 2017-02-22 | Buffer overflow in the built-in web server in DiskSavvy Enterprise 9.4.18 allows remote attackers to execute arbitrary code via a long URI in a GET request. |