2017 CVEs (page 143)
Page 143 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-0319 | Medium | 5.5 | 2017-02-15 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper handling of values may cause a denial… |
CVE-2017-0318 | Medium | 5.5 | 2017-02-15 | All versions of NVIDIA Linux GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper validation of an input parameter may ca… |
CVE-2017-0317 | High | 7.5 | 2017-02-15 | All versions of NVIDIA GPU and GeForce Experience installer contain a vulnerability where it fails to set proper permissions on the package extraction path thu… |
CVE-2017-0315 | High | 7.8 | 2017-02-15 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where an attempt to… |
CVE-2017-0314 | High | 7.8 | 2017-02-15 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) implementation of the SubmitCommandVirtual DD… |
CVE-2017-0313 | High | 7.8 | 2017-02-15 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) implementation of the SubmitCommandVirtual DD… |
CVE-2017-0312 | High | 7.8 | 2017-02-15 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscapeID 0x100008b where u… |
CVE-2017-0311 | High | 8.8 | 2017-02-15 | NVIDIA GPU Display Driver R378 contains a vulnerability in the kernel mode layer handler where improper access control may lead to denial of service or possibl… |
CVE-2017-0310 | Medium | 6.5 | 2017-02-15 | All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper access controls allowing unprivileged user to… |
CVE-2017-0309 | High | 8.8 | 2017-02-15 | All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where multiple integer overflows may cause improper memory a… |
CVE-2017-0308 | High | 8.8 | 2017-02-15 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where untrusted inp… |
CVE-2017-3801 | High | 8.8 | 2017-02-15 | A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitrary workflow items… |
CVE-2017-5997 | High | 7.5 | 2017-02-15 | The SAP Message Server HTTP daemon in SAP KERNEL 7.21-7.49 allows remote attackers to cause a denial of service (memory consumption and process crash) via mult… |
CVE-2017-5992 | High | 8.2 | 2017-02-15 | Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document. |
CVE-2017-5896 | Medium | 5.5 | 2017-02-15 | Heap-based buffer overflow in the fz_subsample_pixmap function in fitz/pixmap.c in MuPDF 1.10a allows remote attackers to cause a denial of service (out-of-bou… |
CVE-2017-5991 | High | 7.5 | 2017-02-15 | An issue was discovered in Artifex MuPDF before 1912de5f08e90af1d9d0a9791f58ba3afdb9d465. The pdf_run_xobject function in pdf-op-run.c encounters a NULL pointe… |
CVE-2017-5990 | Medium | 6.1 | 2017-02-15 | An issue was discovered in PhreeBooksERP before 2017-02-13. The vulnerability exists due to insufficient filtration of user-supplied data in the "form" HTTP GE… |
CVE-2017-2996 | High | 8.8 | 2017-02-15 | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in Primetime SDK. Successful exploitation could lead to… |
CVE-2017-2995 | High | 8.8 | 2017-02-15 | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable type confusion vulnerability related to the MessageChannel class. Successful exploitatio… |
CVE-2017-2994 | High | 8.8 | 2017-02-15 | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in Primetime SDK event dispatch. Successful exploitation co… |
CVE-2017-2993 | High | 8.8 | 2017-02-15 | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability related to event handlers. Successful exploitation could le… |
CVE-2017-2992 | High | 8.8 | 2017-02-15 | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability when parsing an MP4 header. Successful exploitation could le… |
CVE-2017-2991 | High | 8.8 | 2017-02-15 | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in the h264 codec (related to decompression). Successful… |
CVE-2017-2990 | High | 8.8 | 2017-02-15 | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in the h264 decompression routine. Successful exploitati… |
CVE-2017-2988 | High | 8.8 | 2017-02-15 | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability when performing garbage collection. Successful exploitat… |
CVE-2017-2987 | High | 8.8 | 2017-02-15 | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable integer overflow vulnerability related to Flash Broker COM. Successful exploitation coul… |
CVE-2017-2986 | High | 8.8 | 2017-02-15 | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the Flash Video (FLV) codec. Successful exploitation coul… |
CVE-2017-2985 | High | 8.8 | 2017-02-15 | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in the ActionScript 3 BitmapData class. Successful exploita… |
CVE-2017-2984 | High | 8.8 | 2017-02-15 | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the h264 decoder routine. Successful exploitation could l… |
CVE-2017-2982 | High | 8.8 | 2017-02-15 | Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in a routine related to player shutdown. Successful exploit… |
CVE-2017-2981 | High | 7.5 | 2017-02-15 | Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclos… |
CVE-2017-2980 | High | 7.5 | 2017-02-15 | Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclos… |
CVE-2017-2979 | High | 7.5 | 2017-02-15 | Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclos… |
CVE-2017-2978 | High | 7.5 | 2017-02-15 | Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclos… |
CVE-2017-2977 | High | 7.5 | 2017-02-15 | Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclos… |
CVE-2017-2976 | High | 7.5 | 2017-02-15 | Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclos… |
CVE-2017-2975 | High | 7.5 | 2017-02-15 | Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclos… |
CVE-2017-2974 | High | 7.5 | 2017-02-15 | Adobe Digital Editions versions 4.5.3 and earlier have an exploitable buffer over-read vulnerability. Successful exploitation could lead to information disclos… |
CVE-2017-2973 | Critical | 9.8 | 2017-02-15 | Adobe Digital Editions versions 4.5.3 and earlier have an exploitable heap overflow vulnerability. Successful exploitation could lead to arbitrary code executi… |
CVE-2017-2969 | Medium | 6.1 | 2017-02-15 | Adobe Campaign versions 16.4 Build 8724 and earlier have a cross-site scripting (XSS) vulnerability. |
CVE-2017-2968 | Critical | 9.1 | 2017-02-15 | Adobe Campaign versions 16.4 Build 8724 and earlier have a code injection vulnerability. |
CVE-2017-5972 | High | 7.5 | 2017-02-14 | The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows rem… |
CVE-2017-5970 | High | 7.5 | 2017-02-14 | The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows attackers to cause a denial of service (system crash) via… |
CVE-2017-5967 | Medium | 4.0 | 2017-02-14 | The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is enabled, allows local users to discover real PID values (as distinguished from… |
CVE-2017-5149 | High | 8.9 | 2017-02-13 | An issue was discovered in St. Jude Medical Merlin@home, versions prior to Version 8.2.2 (RF models: EX1150; Inductive models: EX1100; and Inductive models: EX… |
CVE-2017-1121 | Medium | 5.4 | 2017-02-13 | IBM WebSphere Application Server 7.0, 8.0, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2017-5169 | High | 7.5 | 2017-02-13 | An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Cross Site Request Forgery vulnerabilities have been identifi… |
CVE-2017-5168 | High | 7.5 | 2017-02-13 | An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Path Traversal vulnerabilities have been identified. The flaw… |
CVE-2017-5167 | High | 8.6 | 2017-02-13 | An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Users do not have any option to change their own passwords. |
CVE-2017-5166 | Critical | 9.8 | 2017-02-13 | An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. An INFORMATION EXPOSURE flaw can be used to gain privileged access to… |
CVE-2017-5165 | High | 7.6 | 2017-02-13 | An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. There is no CSRF Token generated per page and/or per (sensitive) func… |
CVE-2017-5164 | Medium | 6.1 | 2017-02-13 | An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Input sent from a malicious client is not properly verified by the se… |
CVE-2017-5163 | Medium | 5.9 | 2017-02-13 | An issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. After an administrator downloads a configuration fil… |
CVE-2017-5162 | Critical | 9.8 | 2017-02-13 | An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Lack of authentication for remote service gives access to application… |
CVE-2017-5161 | High | 7.2 | 2017-02-13 | An issue was discovered in Sielco Sistemi Winlog Lite SCADA Software, versions prior to Version 3.02.01, and Winlog Pro SCADA Software, versions prior to Versi… |
CVE-2017-5159 | Critical | 9.8 | 2017-02-13 | An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the upda… |
CVE-2017-5157 | Medium | 6.1 | 2017-02-13 | An issue was discovered in Schneider Electric homeLYnk Controller, LSS100100, all versions prior to V1.5.0. The homeLYnk controller is susceptible to a cross-s… |
CVE-2017-5155 | High | 7.3 | 2017-02-13 | An issue was discovered in Schneider Electric Wonderware Historian 2014 R2 SP1 P01 and earlier. Wonderware Historian creates logins with default passwords, whi… |
CVE-2017-5154 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Advantech WebAccess Version 8.1. To be able to exploit the SQL injection vulnerability, an attacker must supply malformed input to t… |
CVE-2017-5153 | High | 7.8 | 2017-02-13 | An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated… |
CVE-2017-5152 | Critical | 9.1 | 2017-02-13 | An issue was discovered in Advantech WebAccess Version 8.1. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able… |
CVE-2017-5151 | High | 7.3 | 2017-02-13 | An issue was discovered in VideoInsight Web Client Version 6.3.5.11 and previous versions. A SQL Injection vulnerability has been identified, which may allow r… |
CVE-2017-5146 | High | 7.5 | 2017-02-13 | An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Sensitive information is store… |
CVE-2017-5145 | Critical | 10.0 | 2017-02-13 | An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of thi… |
CVE-2017-5144 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. The access control flaw allows… |
CVE-2017-5143 | High | 8.6 | 2017-02-13 | An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user without authe… |
CVE-2017-5142 | Critical | 9.1 | 2017-02-13 | An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user with low priv… |
CVE-2017-5141 | Medium | 6.0 | 2017-02-13 | An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can esta… |
CVE-2017-5140 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Password is stored i… |
CVE-2017-5139 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Any user is able to… |
CVE-2017-3902 | Medium | 5.4 | 2017-02-13 | Cross-site scripting (XSS) vulnerability in the Web user interface (UI) in Intel Security ePO 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows authenticated users to inje… |
CVE-2017-3896 | Medium | 5.9 | 2017-02-13 | Unvalidated parameter vulnerability in the remote log viewing capability in Intel Security McAfee Agent 5.0.x versions prior to 5.0.4.449 allows remote attacke… |
CVE-2017-5964 | Medium | 6.1 | 2017-02-12 | An issue was discovered in Emoncms through 9.8.0. The vulnerability exists due to insufficient filtration of user-supplied data in multiple HTTP GET parameters… |
CVE-2017-5963 | Medium | 6.1 | 2017-02-12 | An issue was discovered in caddy (for TYPO3) before 7.2.10. The vulnerability exists due to insufficient filtration of user-supplied data in the "paymillToken"… |
CVE-2017-5962 | Medium | 6.1 | 2017-02-12 | An issue was discovered in contexts_wurfl (for TYPO3) before 0.4.2. The vulnerability exists due to insufficient filtration of user-supplied data in the "force… |
CVE-2017-5961 | Medium | 6.1 | 2017-02-12 | An issue was discovered in ionize through 1.0.8. The vulnerability exists due to insufficient filtration of user-supplied data in the "path" HTTP GET parameter… |
CVE-2017-5960 | Medium | 6.1 | 2017-02-12 | An issue was discovered in Phalcon Eye through 0.4.1. The vulnerability exists due to insufficient filtration of user-supplied data in multiple HTTP GET parame… |
CVE-2017-3302 | High | 7.5 | 2017-02-12 | Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and… |
CVE-2017-5954 | Critical | 9.8 | 2017-02-10 | An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize() function can be exploited to achieve arb… |
CVE-2017-5953 | Critical | 9.8 | 2017-02-10 | vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory all… |
CVE-2017-5945 | Medium | 6.1 | 2017-02-10 | An issue was discovered in the PoodLL Filter plugin through 3.0.20 for Moodle. The vulnerability exists due to insufficient filtration of user-supplied data in… |
CVE-2017-5942 | Medium | 6.1 | 2017-02-10 | An issue was discovered in the WP Mail plugin before 1.2 for WordPress. The replyto parameter when composing a mail allows for a reflected XSS. This would allo… |
CVE-2017-5858 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5606 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5605 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5604 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5603 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5602 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5593 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5592 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5591 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5590 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5589 | Medium | 5.9 | 2017-02-09 | An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in th… |
CVE-2017-5941 | Critical | 9.8 | 2017-02-09 | An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() function can be exploited to achieve arbi… |
CVE-2017-5940 | High | 8.8 | 2017-02-09 | Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user file… |
CVE-2017-5180 | High | 8.8 | 2017-02-09 | Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an… |
CVE-2017-3813 | High | 7.8 | 2017-02-09 | A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local at… |
CVE-2017-3807 | High | 8.8 | 2017-02-09 | A vulnerability in Common Internet Filesystem (CIFS) code in the Clientless SSL VPN functionality of Cisco ASA Software, Major Releases 9.0-9.6, could allow an… |
CVE-2017-5634 | Medium | 6.6 | 2017-02-09 | The Norwegian Air Shuttle (aka norwegian.com) airline kiosk allows physically proximate attackers to bypass the intended "Please select booking identification"… |
CVE-2017-5848 | High | 7.5 | 2017-02-09 | The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (inval… |