2017 CVEs (page 17)
Page 17 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-16890 | Medium | 5.5 | 2018-07-09 | SWFTools 0.9.2 has a divide-by-zero error in the wav_convert2mono function in lib/wav.c because the align value may be zero. |
CVE-2017-15851 | High | 7.8 | 2018-07-06 | Lack of copy_from_user and information leak in function "msm_ois_subdev_do_ioctl, file msm_ois.c can lead to a camera crash in all Android releases(Android for… |
CVE-2017-18159 | High | 7.8 | 2018-07-06 | In Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05, while processing… |
CVE-2017-18158 | High | 7.8 | 2018-07-06 | Possible buffer overflows and array out of bounds accesses in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Androi… |
CVE-2017-15856 | High | 7.0 | 2018-07-06 | Due to a race condition while processing the power stats debug file to read status, a double free condition can occur in Android releases from CAF using the li… |
CVE-2017-15824 | Medium | 5.5 | 2018-07-06 | In Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05, the function Upd… |
CVE-2017-14893 | Medium | 5.5 | 2018-07-06 | While flashing meta image, a buffer over-read may potentially occur when the image size is smaller than the image header size or is smaller than the image head… |
CVE-2017-14872 | Medium | 5.5 | 2018-07-06 | While flashing a meta image, a buffer over-read can potentially occur when the number of images are out of the maximum range of 32 in Android releases from CAF… |
CVE-2017-11088 | Critical | 9.8 | 2018-07-06 | Improper Input Validation in Linux io-prefetch in Snapdragon Mobile and Snapdragon Wear, A SQL injection vulnerability exists in versions MSM8909W, MSM8996AU… |
CVE-2017-1795 | Medium | 4.4 | 2018-07-06 | IBM WebSphere MQ 7.5, 8.0, and 9.0 through 9.0.4 could allow a local user to obtain highly sensitive information via trace logs in IBM WebSphere MQ Managed Fil… |
CVE-2017-1559 | Low | 3.1 | 2018-07-06 | Multiple IBM Rational products could disclose sensitive information by an attacker that intercepts vulnerable requests. IBM X-Force ID: 131758. |
CVE-2017-1509 | Medium | 4.3 | 2018-07-06 | IBM Jazz Foundation products could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid future attacks. IBM… |
CVE-2017-1488 | Low | 3.7 | 2018-07-06 | An undisclosed vulnerability in Jazz common products exists with potential for information disclosure. IBM X-Force ID: 128627. |
CVE-2017-1329 | Medium | 5.4 | 2018-07-06 | IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed… |
CVE-2017-1248 | Medium | 5.4 | 2018-07-06 | IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed… |
CVE-2017-1242 | Medium | 5.4 | 2018-07-06 | IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed… |
CVE-2017-1239 | Medium | 4.3 | 2018-07-06 | IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 could reveal sensitive information in HTTP 500 Internal Server Error responses. IBM X-Force ID: 124357. |
CVE-2017-1238 | Medium | 5.4 | 2018-07-06 | IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod… |
CVE-2017-1237 | Medium | 5.4 | 2018-07-06 | IBM Jazz based applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2017-2665 | Medium | 4.8 | 2018-07-06 | The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is… |
CVE-2017-16816 | Medium | 6.5 | 2018-07-05 | The condor_schedd component in HTCondor before 8.6.8 and 8.7.x before 8.7.5 allows remote authenticated users to cause a denial of service (daemon crash) by le… |
CVE-2017-11175 | Medium | 6.1 | 2018-07-05 | In J2 Innovations FIN Stack 4.0, the authentication webform is vulnerable to reflected XSS via the query string to /login. |
CVE-2017-16773 | Medium | 6.5 | 2018-07-05 | Improper authorization vulnerability in Highlight Preview in Synology Universal Search before 1.0.5-0135 allows remote authenticated users to bypass permission… |
CVE-2017-0929 | High | 7.5 | 2018-07-03 | DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access… |
CVE-2017-0921 | High | 8.1 | 2018-07-03 | GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController com… |
CVE-2017-0919 | High | 7.5 | 2018-07-03 | GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resul… |
CVE-2017-0913 | Medium | 4.7 | 2018-07-03 | Ubiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated user to read arbitrary files in the local file system. Note that by default, the local file system… |
CVE-2017-0912 | Medium | 5.4 | 2018-07-03 | Ubiquiti UCRM versions 2.5.0 to 2.7.7 are vulnerable to Stored Cross-site Scripting. Due to the lack sanitization, it is possible to inject arbitrary HTML code… |
CVE-2017-1717 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1715 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1691 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1690 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1652 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1651 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1621 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1608 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1592 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1568 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1565 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1564 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1562 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1561 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1317 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1316 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1315 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1314 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1313 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1312 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1306 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1299 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1294 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1293 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1281 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1280 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1277 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1275 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-1250 | Medium | 5.4 | 2018-07-03 | IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting… |
CVE-2017-2615 | Medium | 5.5 | 2018-07-03 | Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA dat… |
CVE-2017-17317 | Low | 3.7 | 2018-07-02 | Common Open Policy Service Protocol (COPS) module in Huawei USG6300 V100R001C10; V100R001C20; V100R001C30; V500R001C00; V500R001C20; V500R001C30; V500R001C50… |
CVE-2017-17316 | Medium | 5.3 | 2018-07-02 | Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006… |
CVE-2017-17175 | Medium | 6.5 | 2018-07-02 | Short Message Service (SMS) module of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.354(C00) has a Denial of Service (DoS) vulnerabil… |
CVE-2017-16859 | Medium | 6.5 | 2018-06-28 | The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote a… |
CVE-2017-16726 | Critical | 9.1 | 2018-06-27 | Beckhoff TwinCAT supports communication over ADS. ADS is a protocol for industrial automation in protected environments. ADS has not been designed to achieve s… |
CVE-2017-16718 | Medium | 5.9 | 2018-06-27 | Beckhoff TwinCAT 3 supports communication over ADS. ADS is a protocol for industrial automation in protected environments. This protocol uses user configured r… |
CVE-2017-7465 | Critical | 9.0 | 2018-06-27 | It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An attacker could use this flaw to cause r… |
CVE-2017-18342 | Critical | 9.8 | 2018-06-27 | In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and… |
CVE-2017-7658 | Critical | 9.8 | 2018-06-26 | In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two co… |
CVE-2017-7657 | Critical | 9.8 | 2018-06-26 | In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encodin… |
CVE-2017-7656 | High | 7.5 | 2018-06-26 | In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is hand… |
CVE-2017-9312 | High | 7.5 | 2018-06-25 | Improperly implemented option-field processing in the TCP/IP stack on Allen-Bradley L30ERMS safety devices v30 and earlier causes a denial of service. When a c… |
CVE-2017-7568 | Medium | 5.3 | 2018-06-22 | NetApp OnCommand Unified Manager for 7-Mode (core package) versions prior to 5.2.3 may disclose sensitive LDAP account information to authenticated users when… |
CVE-2017-7466 | High | 8.0 | 2018-06-22 | Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client syste… |
CVE-2017-2668 | Medium | 6.5 | 2018-06-22 | 389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled. A remote unauthent… |
CVE-2017-2672 | Medium | 6.5 | 2018-06-21 | A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able… |
CVE-2017-2669 | Low | 3.7 | 2018-06-21 | Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the I… |
CVE-2017-13072 | Medium | 6.1 | 2018-06-21 | Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS 4.3.4 build 20171223, and their earlier… |
CVE-2017-17062 | Medium | 6.5 | 2018-06-16 | The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev19 allows… |
CVE-2017-18169 | Medium | 5.5 | 2018-06-15 | User process can perform the kernel DOS in ashmem when doing cache maintenance operation in all Android releases(Android for MSM, Firefox OS for MSM, QRD Andro… |
CVE-2017-12070 | High | 8.8 | 2018-06-14 | Unsigned versions of the DLLs distributed by the OPC Foundation may be replaced with malicious code. |
CVE-2017-17309 | High | 7.5 | 2018-06-14 | Huawei HG255s-10 V100R001C163B025SP02 has a path traversal vulnerability due to insufficient validation of the received HTTP requests, a remote attacker may ac… |
CVE-2017-17173 | High | 7.8 | 2018-06-14 | Due to insufficient parameters verification GPU driver of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.356(C00) has an arbitrary mem… |
CVE-2017-17172 | High | 7.3 | 2018-06-14 | Huawei smart phones LYO-L21 with software LYO-L21C479B107, LYO-L21C479B107 have a privilege escalation vulnerability. An authenticated, local attacker can craf… |
CVE-2017-3936 | Medium | 6.2 | 2018-06-13 | OS Command Injection vulnerability in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary O… |
CVE-2017-3907 | Medium | 5.4 | 2018-06-13 | Code Injection vulnerability in the ePolicy Orchestrator (ePO) extension in McAfee Threat Intelligence Exchange (TIE) Server 2.1.0 and earlier allows remote at… |
CVE-2017-3968 | High | 7.5 | 2018-06-13 | Session fixation vulnerability in the web interface in McAfee Network Security Manager (NSM) before 8.2.7.42.2 and McAfee Network Data Loss Prevention (NDLP) b… |
CVE-2017-17443 | Medium | 6.5 | 2018-06-13 | OPC Foundation Local Discovery Server (LDS) 1.03.370 required a security update to resolve multiple vulnerabilities that allow attackers to trigger a crash by… |
CVE-2017-11672 | High | 7.8 | 2018-06-13 | The OPC Foundation Local Discovery Server (LDS) before 1.03.367 is installed as a Windows Service without adding double quotes around the opcualds.exe executab… |
CVE-2017-15695 | High | 8.8 | 2018-06-13 | When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invok… |
CVE-2017-16652 | Medium | 6.1 | 2018-06-13 | An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthenticationSuccessHandler… |
CVE-2017-18070 | High | 7.8 | 2018-06-12 | In wma_ndp_end_response_event_handler(), the variable len_end_rsp is a uint32 which can be overflowed if the value of variable "event->num_ndp_end_rsp_per_ndi_… |
CVE-2017-15857 | High | 7.8 | 2018-06-12 | In the camera driver, an out-of-bounds access can occur due to an error in copying region params from user space in all Android releases from CAF (Android for… |
CVE-2017-15854 | High | 7.8 | 2018-06-12 | The value of fix_param->num_chans is received from firmware and if it is too large, an integer overflow can occur in wma_radio_chan_stats_event_handler() for t… |
CVE-2017-15843 | High | 7.0 | 2018-06-12 | Due to a race condition in a bus driver, a double free in msm_bus_floor_vote_context() can potentially occur in all Android releases from CAF (Android for MSM… |
CVE-2017-15842 | High | 7.8 | 2018-06-12 | Buffer might get used after it gets freed due to unlocking the mutex before freeing the buffer in all Android releases from CAF (Android for MSM, Firefox OS fo… |
CVE-2017-18291 | Critical | 9.8 | 2018-06-12 | An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET user parameter. |
CVE-2017-18290 | Critical | 9.8 | 2018-06-12 | An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET sort_direction parameter. |
CVE-2017-18289 | Critical | 9.8 | 2018-06-12 | An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exist in ladder/stats.php via the GET type parameter. |
CVE-2017-18288 | Critical | 9.8 | 2018-06-12 | An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET game parameter. |
CVE-2017-18287 | Critical | 9.8 | 2018-06-12 | An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the POST user_search parameter. |
CVE-2017-3962 | Medium | 5.6 | 2018-06-12 | Password recovery exploitation vulnerability in the non-certificate-based authentication mechanism in McAfee Network Security Management (NSM) before 8.2.7.42… |