2017 CVEs (page 147)
Page 147 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-3251 | Medium | 4.9 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.16 and earlier. Eas… |
CVE-2017-3250 | High | 7.3 | 2017-01-27 | Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3… |
CVE-2017-3249 | High | 7.3 | 2017-01-27 | Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3… |
CVE-2017-3248 | Critical | 9.8 | 2017-01-27 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10… |
CVE-2017-3247 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 2.1.1, 3.0.1… |
CVE-2017-3246 | Medium | 6.0 | 2017-01-27 | Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Patching). Supported versions that are affected are… |
CVE-2017-3245 | Medium | 4.7 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Direct Banking component of Oracle Financial Services Applications (subcomponent: Pre-Login). Supported versions that are… |
CVE-2017-3244 | Medium | 6.5 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 an… |
CVE-2017-3243 | Medium | 4.4 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Charsets). Supported versions that are affected are 5.5.53 and earlier. Diff… |
CVE-2017-3242 | Medium | 5.9 | 2017-01-27 | Vulnerability in the Oracle VM Server for Sparc component of Oracle Sun Systems Products Suite (subcomponent: LDOM Manager). Supported versions that are affect… |
CVE-2017-3241 | Critical | 9.0 | 2017-01-27 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u13… |
CVE-2017-3240 | Low | 3.3 | 2017-01-27 | Vulnerability in the RDBMS Security component of Oracle Database Server. The supported version that is affected is 12.1.0.2. Easily exploitable vulnerability a… |
CVE-2017-3239 | Low | 3.3 | 2017-01-27 | Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0… |
CVE-2017-3238 | Medium | 6.5 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.53 and earlier, 5.6… |
CVE-2017-3236 | Medium | 4.7 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2017-3235 | Low | 3.5 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2017-3231 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u131… |
CVE-2017-5599 | Medium | 6.1 | 2017-01-27 | An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a reflected Cross Site Scripting vulnerability which affects the raceMasterList… |
CVE-2017-5598 | High | 7.5 | 2017-01-27 | An issue was discovered in eClinicalWorks healow@work 8.0 build 8. This is a blind SQL injection within the EmployeePortalServlet, which can be exploited by un… |
CVE-2017-3805 | Medium | 5.3 | 2017-01-26 | A vulnerability in the web-based management interface of Cisco IOS and Cisco IOx Software could allow an unauthenticated, remote attacker to view confidential… |
CVE-2017-3804 | Medium | 6.1 | 2017-01-26 | A vulnerability in Intermediate System-to-Intermediate System (IS-IS) protocol packet processing of Cisco Nexus 5000, 6000, and 7000 Series Switches software c… |
CVE-2017-3803 | Medium | 4.7 | 2017-01-26 | A vulnerability in the Cisco IOS Software forwarding queue of Cisco 2960X and 3750X switches could allow an unauthenticated, adjacent attacker to cause a memor… |
CVE-2017-3802 | Medium | 6.1 | 2017-01-26 | A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against… |
CVE-2017-3800 | Medium | 5.8 | 2017-01-26 | A vulnerability in the content scanning engine of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attac… |
CVE-2017-3799 | Medium | 5.4 | 2017-01-26 | A vulnerability in a URL parameter of Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to perform site redirection. More Information… |
CVE-2017-3798 | Medium | 6.1 | 2017-01-26 | A cross-site scripting (XSS) filter bypass vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthent… |
CVE-2017-3797 | Medium | 5.3 | 2017-01-26 | A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to view the fully qualified domain name of the Cisco WebEx admin… |
CVE-2017-3796 | High | 7.2 | 2017-01-26 | A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute predetermined shell commands on other hosts. More Infor… |
CVE-2017-3795 | Medium | 5.4 | 2017-01-26 | A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct arbitrary password changes against any non-administrati… |
CVE-2017-3794 | High | 8.8 | 2017-01-26 | A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against an… |
CVE-2017-5597 | High | 7.5 | 2017-01-25 | In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the DHCPv6 dissector could go into a large loop, triggered by packet injection or a malformed capture file. Thi… |
CVE-2017-5596 | High | 7.5 | 2017-01-25 | In Wireshark 2.2.0 to 2.2.3 and 2.0.0 to 2.0.9, the ASTERIX dissector could go into an infinite loop, triggered by packet injection or a malformed capture file… |
CVE-2017-5594 | High | 7.5 | 2017-01-25 | An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug… |
CVE-2017-5495 | High | 7.5 | 2017-01-24 | All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of-Service of Quagga… |
CVE-2017-2972 | High | 7.8 | 2017-01-24 | Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption vulnerability in th… |
CVE-2017-2971 | High | 7.8 | 2017-01-24 | Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability in the JP… |
CVE-2017-2970 | High | 7.8 | 2017-01-24 | Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability in the XS… |
CVE-2017-2929 | Medium | 6.1 | 2017-01-24 | Adobe Acrobat Chrome extension version 15.1.0.3 and earlier have a DOM-based cross-site scripting vulnerability. Successful exploitation could lead to JavaScri… |
CVE-2017-5372 | High | 7.5 | 2017-01-23 | The function msp (aka MSPRuntimeInterface) in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obtain sensitive system information by leve… |
CVE-2017-5371 | High | 7.5 | 2017-01-23 | Odata Server in SAP Adaptive Server Enterprise (ASE) 16 allows remote attackers to cause a denial of service (process crash) via a series of crafted requests… |
CVE-2017-5570 | High | 8.8 | 2017-01-23 | An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the messageJson.jsp, which can only be exploited by… |
CVE-2017-5569 | Critical | 9.8 | 2017-01-23 | An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the template.jsp, which can be exploited without th… |
CVE-2017-5182 | High | 7.5 | 2017-01-23 | Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows com… |
CVE-2017-5575 | Critical | 9.8 | 2017-01-23 | SQL injection vulnerability in inc/lib/Options.class.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the modules par… |
CVE-2017-5574 | Critical | 9.8 | 2017-01-23 | SQL injection vulnerability in register.php in GeniXCMS before 1.0.0 allows unauthenticated users to execute arbitrary SQL commands via the activation paramete… |
CVE-2017-5563 | High | 8.8 | 2017-01-23 | LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff. |
CVE-2017-5556 | High | 8.1 | 2017-01-23 | The ConvertToPDF plugin in Foxit Reader before 8.2 and PhantomPDF before 8.2 on Windows, when the gflags app is enabled, allows remote attackers to cause a den… |
CVE-2017-5554 | High | 8.1 | 2017-01-23 | An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done with… |
CVE-2017-5553 | Medium | 5.4 | 2017-01-23 | Cross-site scripting (XSS) vulnerability in plugins/markdown_plugin/_markdown.plugin.php in b2evolution before 6.8.5 allows remote authenticated users to injec… |
CVE-2017-5544 | Medium | 5.9 | 2017-01-23 | An issue was discovered on FiberHome Fengine S5800 switches V210R240. An unauthorized attacker can access the device's SSH service, using a password cracking t… |
CVE-2017-5539 | Critical | 9.1 | 2017-01-23 | The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ..\/ to bypass the filter… |
CVE-2017-5545 | Critical | 9.1 | 2017-01-21 | The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a deni… |
CVE-2017-5543 | Critical | 9.8 | 2017-01-20 | includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt c… |
CVE-2017-5542 | Medium | 6.1 | 2017-01-20 | Cross-site scripting (XSS) vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to inject arbitrary… |
CVE-2017-5541 | Medium | 5.3 | 2017-01-20 | Directory traversal vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to rename arbitrary files v… |
CVE-2017-2578 | Medium | 6.1 | 2017-01-20 | In Moodle 3.x, there is XSS in the assignment submission page. |
CVE-2017-2576 | Medium | 5.3 | 2017-01-20 | In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums. |
CVE-2017-5521 | High | 8.1 | 2017-01-17 | An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They ar… |
CVE-2017-5520 | High | 8.8 | 2017-01-17 | The media rename feature in GeniXCMS through 0.0.8 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enable… |
CVE-2017-5519 | Critical | 9.8 | 2017-01-17 | SQL injection vulnerability in Posts.class.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
CVE-2017-5518 | High | 7.4 | 2017-01-17 | The media-file upload feature in GeniXCMS through 0.0.8 allows remote attackers to conduct SSRF attacks via a URL, as demonstrated by a URL with an intranet IP… |
CVE-2017-5517 | Critical | 9.8 | 2017-01-17 | SQL injection vulnerability in author.control.php in GeniXCMS through 0.0.8 allows remote attackers to execute arbitrary SQL commands via the type parameter. |
CVE-2017-5516 | Medium | 6.1 | 2017-01-17 | Multiple cross-site scripting (XSS) vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers to inject arbitrary web script or HTML v… |
CVE-2017-5515 | Medium | 5.4 | 2017-01-17 | Cross-site scripting (XSS) vulnerability in the user prompt function in GeniXCMS through 0.0.8 allows remote authenticated users to inject arbitrary web script… |
CVE-2017-5223 | Medium | 5.5 | 2017-01-16 | An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email messag… |
CVE-2017-5494 | Medium | 5.4 | 2017-01-15 | Multiple cross-site scripting (XSS) vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary w… |
CVE-2017-5480 | High | 8.1 | 2017-01-15 | Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated users to read or delete arbitrary files… |
CVE-2017-5493 | High | 7.5 | 2017-01-15 | wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier f… |
CVE-2017-5492 | High | 8.8 | 2017-01-15 | Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack th… |
CVE-2017-5491 | Medium | 5.3 | 2017-01-15 | wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com… |
CVE-2017-5490 | Medium | 6.1 | 2017-01-15 | Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote att… |
CVE-2017-5489 | High | 8.8 | 2017-01-15 | Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vecto… |
CVE-2017-5488 | Medium | 6.1 | 2017-01-15 | Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script… |
CVE-2017-5487 | Medium | 5.3 | 2017-01-15 | wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listi… |
CVE-2017-2584 | High | 7.1 | 2017-01-15 | arch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local users to obtain sensitive information from kernel memory or cause a denial of service (us… |
CVE-2017-5476 | High | 8.8 | 2017-01-14 | Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin. |
CVE-2017-5475 | High | 8.8 | 2017-01-14 | comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments. |
CVE-2017-5474 | Medium | 6.1 | 2017-01-14 | Open redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing a… |
CVE-2017-5473 | High | 8.8 | 2017-01-14 | Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated… |
CVE-2017-0398 | Medium | 5.5 | 2017-01-13 | An information disclosure vulnerability in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue i… |
CVE-2017-5364 | High | 7.8 | 2017-01-13 | Memory Corruption Vulnerability in Foxit PDF Toolkit v1.3 allows an attacker to cause Denial of Service and Remote Code Execution when the victim opens the spe… |
CVE-2017-3890 | Medium | 6.1 | 2017-01-13 | A reflected cross-site scripting vulnerability in the BlackBerry WatchDox Server components Appliance-X, version 1.8.1 and earlier, and vAPP, versions 4.6.0 to… |
CVE-2017-0404 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the kernel sound subsystem could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2017-0403 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the kernel performance subsystem could enable a local malicious application to execute arbitrary code within the con… |
CVE-2017-0402 | Medium | 5.5 | 2017-01-12 | An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to acces… |
CVE-2017-0401 | Medium | 5.5 | 2017-01-12 | An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in the Qualcomm audio post processor could enable a local maliciou… |
CVE-2017-0400 | Medium | 5.5 | 2017-01-12 | An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to acces… |
CVE-2017-0399 | Medium | 5.5 | 2017-01-12 | An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in the Qualcomm audio post processor could enable a local maliciou… |
CVE-2017-0397 | Medium | 5.5 | 2017-01-12 | An information disclosure vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable a local malicious application to access data outside of it… |
CVE-2017-0396 | Medium | 5.5 | 2017-01-12 | An information disclosure vulnerability in visualizer/EffectVisualizer.cpp in libeffects in Mediaserver could enable a local malicious application to access da… |
CVE-2017-0395 | Medium | 5.5 | 2017-01-12 | An elevation of privilege vulnerability in Contacts could enable a local malicious application to silently create contact information. This issue is rated as M… |
CVE-2017-0394 | High | 7.5 | 2017-01-12 | A denial of service vulnerability in Telephony could enable a remote attacker to cause a device hang or reboot. This issue is rated as High due to the possibil… |
CVE-2017-0393 | Medium | 5.5 | 2017-01-12 | A denial of service vulnerability in libvpx in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. Thi… |
CVE-2017-0392 | Medium | 5.5 | 2017-01-12 | A denial of service vulnerability in VBRISeeker.cpp in libstagefright in Mediaserver could enable a remote attacker to use a specially crafted file to cause a… |
CVE-2017-0391 | Medium | 5.5 | 2017-01-12 | A denial of service vulnerability in decoder/ihevcd_decode.c in libhevc in Mediaserver could enable a remote attacker to use a specially crafted file to cause… |
CVE-2017-0390 | Medium | 5.5 | 2017-01-12 | A denial of service vulnerability in Tremolo/dpen.s in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reb… |
CVE-2017-0389 | High | 7.5 | 2017-01-12 | A denial of service vulnerability in core networking could enable a remote attacker to use specially crafted network packet to cause a device hang or reboot. T… |
CVE-2017-0388 | Medium | 5.5 | 2017-01-12 | An elevation of privilege vulnerability in the External Storage Provider could enable a local secondary user to read data from an external storage SD card inse… |
CVE-2017-0387 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged… |
CVE-2017-0386 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the libnl library could enable a local malicious application to execute arbitrary code within the context of a privi… |