2017 CVEs (page 144)
Page 144 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-5941 | Critical | 9.8 | 2017-02-09 | An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() function can be exploited to achieve arbi… |
CVE-2017-5940 | High | 8.8 | 2017-02-09 | Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user file… |
CVE-2017-5180 | High | 8.8 | 2017-02-09 | Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an… |
CVE-2017-3813 | High | 7.8 | 2017-02-09 | A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local at… |
CVE-2017-3807 | High | 8.8 | 2017-02-09 | A vulnerability in Common Internet Filesystem (CIFS) code in the Clientless SSL VPN functionality of Cisco ASA Software, Major Releases 9.0-9.6, could allow an… |
CVE-2017-5634 | Medium | 6.6 | 2017-02-09 | The Norwegian Air Shuttle (aka norwegian.com) airline kiosk allows physically proximate attackers to bypass the intended "Please select booking identification"… |
CVE-2017-5848 | High | 7.5 | 2017-02-09 | The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (inval… |
CVE-2017-5847 | High | 7.5 | 2017-02-09 | The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of… |
CVE-2017-5846 | Medium | 5.5 | 2017-02-09 | The gst_asf_demux_process_ext_stream_props function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows remote attackers to cau… |
CVE-2017-5845 | High | 7.5 | 2017-02-09 | The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of serv… |
CVE-2017-5844 | Medium | 5.5 | 2017-02-09 | The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a den… |
CVE-2017-5843 | High | 7.5 | 2017-02-09 | Multiple use-after-free vulnerabilities in the (1) gst_mini_object_unref, (2) gst_tag_list_unref, and (3) gst_mxf_demux_update_essence_tracks functions in GStr… |
CVE-2017-5842 | Medium | 5.5 | 2017-02-09 | The html_context_handle_element function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a denial o… |
CVE-2017-5841 | High | 7.5 | 2017-02-09 | The gst_avi_demux_parse_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of serv… |
CVE-2017-5840 | High | 7.5 | 2017-02-09 | The qtdemux_parse_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of service… |
CVE-2017-5839 | High | 7.5 | 2017-02-09 | The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly limit recursion, whi… |
CVE-2017-5838 | High | 7.5 | 2017-02-09 | The gst_date_time_new_from_iso8601_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a denial of service (out-of… |
CVE-2017-5837 | Medium | 5.5 | 2017-02-09 | The gst_riff_create_audio_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers to cause a den… |
CVE-2017-1128 | Medium | 5.4 | 2017-02-08 | IBM Rational DOORS Next Generation 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2017-1127 | Medium | 5.4 | 2017-02-08 | IBM Rational DOORS Next Generation 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i… |
CVE-2017-2765 | Critical | 9.8 | 2017-02-08 | EMC Isilon InsightIQ 4.1.0, 4.0.1, 4.0.0, 3.2.2, 3.2.1, 3.2.0, 3.1.1, 3.1.0, 3.0.1, 3.0.0 is affected by an authentication bypass vulnerability that could pote… |
CVE-2017-5933 | Medium | 5.9 | 2017-02-08 | Citrix NetScaler ADC and NetScaler Gateway 10.5 before Build 65.11, 11.0 before Build 69.12/69.123, and 11.1 before Build 51.21 randomly generates GCM nonces… |
CVE-2017-0451 | Medium | 4.7 | 2017-02-08 | An information disclosure vulnerability in the Qualcomm sound driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0450 | High | 7.8 | 2017-02-08 | An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged… |
CVE-2017-0449 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0448 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2017-0447 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the HTC touchscreen driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2017-0446 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the HTC touchscreen driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2017-0445 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the HTC touchscreen driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2017-0444 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Realtek sound driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0443 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0442 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0441 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0440 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0439 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0438 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0437 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0436 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0435 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0434 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the con… |
CVE-2017-0433 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the con… |
CVE-2017-0432 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the MediaTek driver could enable a local malicious application to execute arbitrary code within the context of the k… |
CVE-2017-0430 | High | 7.8 | 2017-02-08 | An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2017-0429 | High | 7.8 | 2017-02-08 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2017-0428 | High | 7.8 | 2017-02-08 | An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the… |
CVE-2017-0427 | High | 7.8 | 2017-02-08 | An elevation of privilege vulnerability in the kernel file system could enable a local malicious application to execute arbitrary code within the context of th… |
CVE-2017-0426 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in the Filesystem could enable a local malicious application to access data outside of its permission levels. This issu… |
CVE-2017-0425 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue i… |
CVE-2017-0424 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in AOSP Messaging could enable a remote attacker using a special crafted file to access data outside of its permission… |
CVE-2017-0423 | Medium | 5.3 | 2017-02-08 | An elevation of privilege vulnerability in Bluetooth could enable a proximate attacker to manage access to documents on the device. This issue is rated as Mode… |
CVE-2017-0422 | High | 7.5 | 2017-02-08 | A denial of service vulnerability in Bionic DNS could enable a remote attacker to use a specially crafted network packet to cause a device hang or reboot. This… |
CVE-2017-0421 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in the Framework APIs could enable a local malicious application to bypass operating system protections that isolate ap… |
CVE-2017-0420 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in AOSP Mail could enable a local malicious application to bypass operating system protections that isolate application… |
CVE-2017-0419 | High | 7.8 | 2017-02-08 | An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged… |
CVE-2017-0418 | High | 7.8 | 2017-02-08 | An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged… |
CVE-2017-0417 | High | 7.8 | 2017-02-08 | An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged… |
CVE-2017-0416 | High | 7.8 | 2017-02-08 | An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged… |
CVE-2017-0415 | High | 7.8 | 2017-02-08 | An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged… |
CVE-2017-0414 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate applic… |
CVE-2017-0413 | Medium | 5.5 | 2017-02-08 | An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate applic… |
CVE-2017-0412 | High | 7.8 | 2017-02-08 | An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a priv… |
CVE-2017-0411 | High | 7.8 | 2017-02-08 | An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a priv… |
CVE-2017-0410 | High | 7.8 | 2017-02-08 | An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a priv… |
CVE-2017-0409 | High | 7.8 | 2017-02-08 | A remote code execution vulnerability in libstagefright could enable an attacker using a specially crafted file to execute arbitrary code in the context of an… |
CVE-2017-0408 | High | 7.8 | 2017-02-08 | A remote code execution vulnerability in libgdx could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivil… |
CVE-2017-0407 | High | 7.8 | 2017-02-08 | A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and d… |
CVE-2017-0406 | High | 7.8 | 2017-02-08 | A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and d… |
CVE-2017-0405 | High | 7.8 | 2017-02-08 | A remote code execution vulnerability in Surfaceflinger could enable an attacker using a specially crafted file to cause memory corruption during media file an… |
CVE-2017-5677 | Critical | 9.8 | 2017-02-06 | PEAR HTML_AJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. It allows remote code execution. In one viewpoint, the root… |
CVE-2017-5595 | Medium | 5.5 | 2017-02-06 | A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to r… |
CVE-2017-5368 | High | 8.8 | 2017-02-06 | ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF (Cross Site Request Forgery) which allows a remote attack to make… |
CVE-2017-5367 | Medium | 6.1 | 2017-02-06 | Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, w… |
CVE-2017-5879 | Critical | 9.8 | 2017-02-06 | An issue was discovered in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated users via an HTTP GET request and which… |
CVE-2017-5877 | Medium | 6.1 | 2017-02-06 | XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us/locations/index direction parameter. |
CVE-2017-5876 | Medium | 6.1 | 2017-02-06 | XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /news-events/events date parameter. |
CVE-2017-5875 | Medium | 5.4 | 2017-02-06 | XSS was discovered in dotCMS 3.7.0, with an authenticated attack against the /myAccount addressID parameter. |
CVE-2017-5577 | Medium | 5.5 | 2017-02-06 | The vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM driver in the Linux kernel before 4.9.7 does not set an errno value upon certain… |
CVE-2017-5576 | High | 7.8 | 2017-02-06 | Integer overflow in the vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM driver in the Linux kernel before 4.9.7 allows local users t… |
CVE-2017-5551 | Medium | 4.4 | 2017-02-06 | The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, wh… |
CVE-2017-5550 | Medium | 5.5 | 2017-02-06 | Off-by-one error in the pipe_advance function in lib/iov_iter.c in the Linux kernel before 4.9.5 allows local users to obtain sensitive information from uninit… |
CVE-2017-5549 | Medium | 5.5 | 2017-02-06 | The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory contents into a log e… |
CVE-2017-5548 | High | 7.8 | 2017-02-06 | drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to caus… |
CVE-2017-5547 | High | 7.8 | 2017-02-06 | drivers/hid/hid-corsair.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a d… |
CVE-2017-5546 | High | 7.8 | 2017-02-06 | The freelist-randomization feature in mm/slab.c in the Linux kernel 4.8.x and 4.9.x before 4.9.5 allows local users to cause a denial of service (duplicate fre… |
CVE-2017-2596 | Medium | 6.5 | 2017-02-06 | The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c in the Linux kernel through 4.9.8 improperly emulates the VMXON instruction, which allows KVM L1 gues… |
CVE-2017-2583 | High | 8.4 | 2017-02-06 | The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5 improperly emulates a "MOV SS, NULL selector" instruction… |
CVE-2017-5137 | Medium | 6.2 | 2017-02-05 | An issue was discovered on SendQuick Entera and Avera devices before 2HF16. An attacker could request and download the SMS logs from an unauthenticated perspec… |
CVE-2017-5136 | High | 7.5 | 2017-02-05 | An issue was discovered on SendQuick Entera and Avera devices before 2HF16. The application failed to check the access control of the request which could resul… |
CVE-2017-5882 | Medium | 6.1 | 2017-02-04 | Cross-site scripting (XSS) vulnerability in index.asp in SANADATA SanaCMS 7.3 allows remote attackers to inject arbitrary web script or HTML via the search par… |
CVE-2017-5880 | Medium | 6.5 | 2017-02-04 | Splunk Web in Splunk Enterprise versions 6.5.x before 6.5.2, 6.4.x before 6.4.5, 6.3.x before 6.3.9, 6.2.x before 6.2.13, 6.1.x before 6.1.12, 6.0.x before 6.0… |
CVE-2017-3824 | Medium | 6.8 | 2017-02-03 | A vulnerability in the handling of list headers in Cisco cBR Series Converged Broadband Routers could allow an unauthenticated, remote attacker to cause the de… |
CVE-2017-3822 | Medium | 5.3 | 2017-02-03 | A vulnerability in the logging subsystem of the Cisco Firepower Threat Defense (FTD) Firepower Device Manager (FDM) could allow an unauthenticated, remote atta… |
CVE-2017-3820 | Medium | 6.5 | 2017-02-03 | A vulnerability in Simple Network Management Protocol (SNMP) functions of Cisco ASR 1000 Series Aggregation Services Routers running Cisco IOS XE Software Rele… |
CVE-2017-3818 | Medium | 5.8 | 2017-02-03 | A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an… |
CVE-2017-3814 | Medium | 5.8 | 2017-02-03 | A vulnerability in Cisco Firepower System Software could allow an unauthenticated, remote attacker to maliciously bypass the appliance's ability to block certa… |
CVE-2017-3812 | Medium | 6.8 | 2017-02-03 | A vulnerability in the implementation of Common Industrial Protocol (CIP) functionality in Cisco Industrial Ethernet 2000 Series Switches could allow an unauth… |
CVE-2017-3810 | Medium | 5.4 | 2017-02-03 | A vulnerability in the web framework of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a web URL redirect attack against… |
CVE-2017-3809 | Medium | 5.8 | 2017-02-03 | A vulnerability in the Policy deployment module of the Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to prevent deplo… |
CVE-2017-3806 | Medium | 5.3 | 2017-02-03 | A vulnerability in CLI command processing in the Cisco Firepower 4100 Series Next-Generation Firewall and Cisco Firepower 9300 Security Appliance could allow a… |
CVE-2017-2768 | Critical | 9.8 | 2017-02-03 | EMC Network Configuration Manager (NCM) 9.3.x, EMC Network Configuration Manager (NCM) 9.4.0.x, EMC Network Configuration Manager (NCM) 9.4.1.x, EMC Network Co… |