2017 CVEs (page 142)
Page 142 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-6077 | Critical | 9.8 | 2017-02-22 | ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters… |
CVE-2017-6188 | Medium | 5.5 | 2017-02-22 | Munin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled. Setting multiple upper_limit GET parameters allows overwriting any file… |
CVE-2017-5586 | Critical | 9.8 | 2017-02-22 | OpenText Documentum D2 (formerly EMC Documentum D2) 4.x allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to… |
CVE-2017-5585 | High | 8.8 | 2017-02-22 | OpenText Documentum Content Server (formerly EMC Documentum Content Server) 7.3, when PostgreSQL Database is used and return_top_results_row_based config optio… |
CVE-2017-3847 | Medium | 5.4 | 2017-02-22 | A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS)… |
CVE-2017-3845 | Medium | 6.1 | 2017-02-22 | A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross… |
CVE-2017-3844 | Medium | 4.3 | 2017-02-22 | A vulnerability in exporting functions of the user interface for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to view file… |
CVE-2017-3843 | Medium | 4.3 | 2017-02-22 | A vulnerability in the file download functions for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to download system files t… |
CVE-2017-3842 | Medium | 5.3 | 2017-02-22 | A vulnerability in the web-based management interface of the Cisco Intrusion Prevention System Device Manager (IDM) could allow an unauthenticated, remote atta… |
CVE-2017-3841 | High | 7.5 | 2017-02-22 | A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to disclose sensitive info… |
CVE-2017-3840 | Medium | 6.1 | 2017-02-22 | A vulnerability in the web interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to redirect a user to a ma… |
CVE-2017-3839 | Medium | 4.3 | 2017-02-22 | An XML External Entity vulnerability in the web-based user interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote att… |
CVE-2017-3838 | Medium | 6.1 | 2017-02-22 | A vulnerability in Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to conduct a DOM-based cross-site scripting (XSS) a… |
CVE-2017-3837 | High | 8.1 | 2017-02-22 | An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS), formerly Acano Conferencing Server, could allow an authe… |
CVE-2017-3836 | Medium | 4.3 | 2017-02-22 | A vulnerability in the web framework Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. More Informat… |
CVE-2017-3835 | High | 8.8 | 2017-02-22 | A vulnerability in the sponsor portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access notices owned by other us… |
CVE-2017-3833 | Medium | 6.1 | 2017-02-22 | A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting… |
CVE-2017-3830 | High | 7.5 | 2017-02-22 | A vulnerability in an internal API of the Cisco Meeting Server (CMS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) conditi… |
CVE-2017-3829 | Medium | 6.1 | 2017-02-22 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager Switches could allow an unauthenticated, remote attacker to condu… |
CVE-2017-3828 | Medium | 6.1 | 2017-02-22 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager Switches could allow an unauthenticated, remote attacker to condu… |
CVE-2017-3827 | Medium | 5.8 | 2017-02-22 | A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) and Web Securit… |
CVE-2017-3821 | Medium | 6.1 | 2017-02-22 | A vulnerability in the serviceability page of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct reflected cross-s… |
CVE-2017-2684 | Critical | 9.0 | 2017-02-22 | Siemens SIMATIC Logon prior to V1.5 SP3 Update 2 could allow an attacker with knowledge of a valid user name, and physical or network access to the affected sy… |
CVE-2017-6127 | High | 8.8 | 2017-02-21 | Multiple cross-site request forgery (CSRF) vulnerabilities in the access portal on the DIGISOL DG-HR1400 Wireless Router with firmware 1.00.02 allow remote att… |
CVE-2017-6098 | High | 7.2 | 2017-02-21 | A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign_save.php (Requires authentication… |
CVE-2017-6097 | High | 7.2 | 2017-02-21 | A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign/count_of_send.php (Requires authen… |
CVE-2017-6096 | High | 7.2 | 2017-02-21 | A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/view-list.php (Requires authenticatio… |
CVE-2017-6095 | Critical | 9.8 | 2017-02-21 | A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/csvexport.php (Unauthenticated) with… |
CVE-2017-6078 | Medium | 5.5 | 2017-02-21 | FastStone MaxView 3.0 and 3.1 allows user-assisted attackers to cause a denial of service (application crash) via a malformed BMP image with a crafted biSize f… |
CVE-2017-6072 | Medium | 5.3 | 2017-02-21 | CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin. |
CVE-2017-6071 | Medium | 5.3 | 2017-02-21 | CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml. |
CVE-2017-6070 | Critical | 9.8 | 2017-02-21 | CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter i… |
CVE-2017-5959 | Critical | 9.8 | 2017-02-21 | CSRF token bypass in GeniXCMS before 1.0.2 could result in escalation of privileges. The forgotpassword.php page can be used to acquire a token. |
CVE-2017-5881 | High | 7.8 | 2017-02-21 | GOM Player 2.3.10.5266 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted fpx fil… |
CVE-2017-0038 | Medium | 5.5 | 2017-02-20 | gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201… |
CVE-2017-2374 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. GarageBand before 10.1.6 is affected. The issue involves the "Projects" component. It allows remote attacker… |
CVE-2017-2373 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue i… |
CVE-2017-2372 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. GarageBand before 10.1.5 is affected. Logic Pro X before 10.3 is affected. The issue involves the "Projects"… |
CVE-2017-2371 | Medium | 6.5 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WebKit" component, which allows remote attackers to l… |
CVE-2017-2370 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. macOS before 10.12.3 is affected. tvOS before 10.1.1 is affected. watchOS bef… |
CVE-2017-2369 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue i… |
CVE-2017-2368 | Medium | 5.5 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "Contacts" component. It allows remote attackers to ca… |
CVE-2017-2366 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes bef… |
CVE-2017-2365 | Medium | 6.5 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue i… |
CVE-2017-2364 | Medium | 6.5 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. The issue involves the "WebKit" component… |
CVE-2017-2363 | Medium | 6.5 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. watchOS bef… |
CVE-2017-2362 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue i… |
CVE-2017-2361 | Medium | 6.1 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12.3 is affected. The issue involves the "Help Viewer" component, which allows XSS attacks v… |
CVE-2017-2360 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. macOS before 10.12.3 is affected. tvOS before 10.1.1 is affected. watchOS bef… |
CVE-2017-2359 | Medium | 6.5 | 2017-02-20 | An issue was discovered in certain Apple products. Safari before 10.0.3 is affected. The issue involves the "Safari" component, which allows remote attackers t… |
CVE-2017-2358 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12.3 is affected. The issue involves the "Graphics Drivers" component. It allows attackers t… |
CVE-2017-2357 | Low | 3.3 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12.3 is affected. The issue involves the "IOAudioFamily" component. It allows attackers to o… |
CVE-2017-2356 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes bef… |
CVE-2017-2355 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes bef… |
CVE-2017-2354 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes bef… |
CVE-2017-2353 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12.3 is affected. The issue involves the "Bluetooth" component. It allows attackers to execu… |
CVE-2017-2352 | Medium | 4.6 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "Unlock with iPhone"… |
CVE-2017-2351 | Low | 2.4 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WiFi" component, which allows physically proximate at… |
CVE-2017-2350 | Medium | 6.5 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue i… |
CVE-2017-6074 | High | 7.8 | 2017-02-18 | The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN sta… |
CVE-2017-6001 | High | 7.0 | 2017-02-18 | Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent p… |
CVE-2017-5986 | Medium | 5.5 | 2017-02-18 | Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (ass… |
CVE-2017-6065 | High | 8.8 | 2017-02-17 | SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS through 1.0.2 allows remote authenticated users to execute arbitrary SQL c… |
CVE-2017-6055 | High | 7.8 | 2017-02-17 | XML external entity (XXE) vulnerability in eParakstitajs 3 before 1.3.9 and eParaksts Java lib before 2.5.13 allows remote attackers to read arbitrary files or… |
CVE-2017-6056 | High | 7.5 | 2017-02-17 | It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via… |
CVE-2017-6014 | High | 7.5 | 2017-02-17 | In Wireshark 2.2.4 and earlier, a crafted or malformed STANAG 4607 capture file will cause an infinite loop and memory exhaustion. If the packet size field in… |
CVE-2017-5998 | Medium | 5.4 | 2017-02-17 | Cross-site scripting (XSS) vulnerability in InterSect Alliance SNARE Epilog for UNIX version 1.5 allows remote authenticated users to inject arbitrary web scri… |
CVE-2017-5344 | Critical | 9.8 | 2017-02-17 | An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter() function which is called by the web accessible path /categoriesServlet performs str… |
CVE-2017-5027 | Medium | 4.3 | 2017-02-17 | Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inline content securit… |
CVE-2017-5026 | Medium | 4.3 | 2017-02-17 | Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from being displayed by swapped out frames, which allowed a remote att… |
CVE-2017-5025 | Medium | 5.5 | 2017-02-17 | FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentia… |
CVE-2017-5024 | Medium | 5.5 | 2017-02-17 | FFmpeg in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to perform proper bounds checking, which allowed a remote attacker to potentia… |
CVE-2017-5023 | Medium | 4.3 | 2017-02-17 | Type confusion in Histogram in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to poten… |
CVE-2017-5022 | Medium | 4.3 | 2017-02-17 | Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to properly enforce unsafe-inline content securit… |
CVE-2017-5021 | Medium | 4.3 | 2017-02-17 | A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to perform an out o… |
CVE-2017-5020 | Medium | 6.1 | 2017-02-17 | Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to require a user gesture for powerful download operations… |
CVE-2017-5019 | Medium | 6.3 | 2017-02-17 | A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially expl… |
CVE-2017-5018 | Medium | 6.1 | 2017-02-17 | Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, had an insufficiently strict content security policy on the Chrom… |
CVE-2017-5017 | Medium | 4.3 | 2017-02-17 | Interactions with the OS in Google Chrome prior to 56.0.2924.76 for Mac insufficiently cleared video memory, which allowed a remote attacker to possibly extrac… |
CVE-2017-5016 | Medium | 6.5 | 2017-02-17 | Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to prevent certain UI elements from being display… |
CVE-2017-5015 | Medium | 6.5 | 2017-02-17 | Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled Unicode glyphs, which allowed a remote attack… |
CVE-2017-5014 | Medium | 6.3 | 2017-02-17 | Heap buffer overflow during image processing in Skia in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a… |
CVE-2017-5013 | Medium | 6.5 | 2017-02-17 | Google Chrome prior to 56.0.2924.76 for Linux incorrectly handled new tab page navigations in non-selected tabs, which allowed a remote attacker to spoof the c… |
CVE-2017-5012 | High | 8.8 | 2017-02-17 | A heap buffer overflow in V8 in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to pote… |
CVE-2017-5011 | Medium | 6.5 | 2017-02-17 | Google Chrome prior to 56.0.2924.76 for Windows insufficiently sanitized DevTools URLs, which allowed a remote attacker who convinced a user to install a malic… |
CVE-2017-5010 | Medium | 6.1 | 2017-02-17 | Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, resolved promises in an inappropriate context, which all… |
CVE-2017-5009 | High | 8.8 | 2017-02-17 | WebRTC in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to perform proper bounds checking, which allowed… |
CVE-2017-5008 | Medium | 6.1 | 2017-02-17 | Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed attacker controlled JavaScript to be run during… |
CVE-2017-5007 | Medium | 6.1 | 2017-02-17 | Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled the sequence of events when closing… |
CVE-2017-5006 | Medium | 6.1 | 2017-02-17 | Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, incorrectly handled object owner relationships, which al… |
CVE-2017-5357 | High | 7.5 | 2017-02-17 | regex.c in GNU ed before 1.14.1 allows attackers to cause a denial of service (crash) via a malformed command, which triggers an invalid free. |
CVE-2017-6011 | Medium | 5.5 | 2017-02-16 | An issue was discovered in icoutils 0.31.1. An out-of-bounds read leading to a buffer overflow was observed in the "simple_vec" function in the "extract.c" sou… |
CVE-2017-6010 | Medium | 5.5 | 2017-02-16 | An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be tr… |
CVE-2017-6009 | Medium | 5.5 | 2017-02-16 | An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "decode_ne_resource_id" function in the "restable.c" source file. This is hap… |
CVE-2017-6004 | High | 7.5 | 2017-02-16 | The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote at… |
CVE-2017-0324 | High | 7.8 | 2017-02-15 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of a… |
CVE-2017-0323 | High | 7.8 | 2017-02-15 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid u… |
CVE-2017-0322 | High | 7.8 | 2017-02-15 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where a value passed from a user to t… |
CVE-2017-0321 | High | 8.8 | 2017-02-15 | All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user inpu… |
CVE-2017-0320 | Medium | 5.5 | 2017-02-15 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper handling of values may cause a denial… |