2017 CVEs (page 22)
Page 22 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-16036 | High | 7.5 | 2018-06-04 | `badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory traversal issue, giving an attacker ac… |
CVE-2017-16035 | High | 8.1 | 2018-06-04 | The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from api.hubapi.com. It ap… |
CVE-2017-16031 | High | 7.5 | 2018-06-04 | Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to cre… |
CVE-2017-16030 | High | 7.5 | 2018-06-04 | Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own headers, creating an arb… |
CVE-2017-16029 | High | 7.5 | 2018-06-04 | hostr is a simple web server that serves up the contents of the current directory. There is a directory traversal vulnerability in hostr 2.3.5 and earlier that… |
CVE-2017-16028 | Medium | 5.3 | 2018-06-04 | react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically s… |
CVE-2017-16026 | Medium | 5.9 | 2018-06-04 | Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non-zero memory is pas… |
CVE-2017-16025 | Medium | 5.9 | 2018-06-04 | Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an… |
CVE-2017-16024 | Medium | 6.5 | 2018-06-04 | The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. O… |
CVE-2017-16023 | High | 7.5 | 2018-06-04 | Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular expressions to evaluate a… |
CVE-2017-16022 | Medium | 6.1 | 2018-06-04 | Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If… |
CVE-2017-16021 | Medium | 6.5 | 2018-06-04 | uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-j… |
CVE-2017-16020 | Critical | 9.8 | 2018-06-04 | Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the co… |
CVE-2017-16019 | Medium | 6.1 | 2018-06-04 | GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS… |
CVE-2017-16018 | Medium | 6.1 | 2018-06-04 | Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can get script to run i… |
CVE-2017-16017 | Medium | 6.1 | 2018-06-04 | sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability. |
CVE-2017-16016 | Medium | 6.1 | 2018-06-04 | Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scen… |
CVE-2017-16015 | Medium | 6.1 | 2018-06-04 | Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize… |
CVE-2017-16014 | High | 7.5 | 2018-06-04 | Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that forces an error can crash the server, causin… |
CVE-2017-16013 | High | 7.5 | 2018-06-04 | hapi is a web and services application framework. When hapi >= 15.0.0 <= 16.1.0 encounters a malformed `accept-encoding` header an uncaught exception is thrown… |
CVE-2017-16009 | Medium | 6.1 | 2018-06-04 | ag-grid is an advanced data grid that is library agnostic. ag-grid is vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if AngularJS is used in… |
CVE-2017-16008 | Medium | 6.1 | 2018-06-04 | i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted… |
CVE-2017-16007 | Medium | 5.9 | 2018-06-04 | node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers. node-jose earlier… |
CVE-2017-16006 | Medium | 6.1 | 2018-06-04 | Remarkable is a markdown parser. In versions 1.6.2 and lower, remarkable allows the use of `data:` URIs in links and can therefore execute javascript. |
CVE-2017-16005 | High | 7.5 | 2018-06-04 | Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not th… |
CVE-2017-0931 | Medium | 6.1 | 2018-06-04 | html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values. |
CVE-2017-0930 | Medium | 6.5 | 2018-06-04 | augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file w… |
CVE-2017-0928 | Medium | 6.1 | 2018-06-04 | html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable causing sanitizati… |
CVE-2017-1748 | Medium | 6.8 | 2018-06-04 | IBM Connections 5.0, 5.5, and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a s… |
CVE-2017-18285 | High | 7.1 | 2018-06-04 | The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and wri… |
CVE-2017-18284 | High | 7.1 | 2018-06-04 | The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitr… |
CVE-2017-2860 | High | 7.5 | 2018-06-01 | An exploitable denial-of-service vulnerability exists in the lookup entry functionality of KeyTrees in Natus Xltek NeuroWorks 8. A specially crafted network pa… |
CVE-2017-2858 | High | 7.5 | 2018-06-01 | An exploitable denial-of-service vulnerability exists in the traversal of lists functionality of Natus Xltek NeuroWorks 8. A specially crafted network packet c… |
CVE-2017-2852 | High | 7.5 | 2018-06-01 | An exploitable denial-of-service vulnerability exists in the unserialization of lists functionality of Natus Xltek NeuroWorks 8. A specially crafted network pa… |
CVE-2017-6153 | Medium | 5.3 | 2018-06-01 | Features in F5 BIG-IP 13.0.0-13.1.0.3, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 system that utilizes inflate functionality directly, via an i… |
CVE-2017-17171 | Medium | 4.2 | 2018-06-01 | Some Huawei smart phones have the denial of service (DoS) vulnerability due to the improper processing of malicious parameters. An attacker may trick a target… |
CVE-2017-16153 | High | 7.5 | 2018-05-29 | gaoxuyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url. |
CVE-2017-16062 | High | 7.5 | 2018-05-29 | node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16061 | High | 7.5 | 2018-05-29 | tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16047 | High | 7.5 | 2018-05-29 | mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE-2017-16010 | Medium | 6.1 | 2018-05-29 | i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefine… |
CVE-2017-16003 | High | 8.1 | 2018-05-29 | windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, wh… |
CVE-2017-1768 | Medium | 4.3 | 2018-05-29 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 generates an error message that includes sensitive information about its environment, users, or associ… |
CVE-2017-14185 | Medium | 5.3 | 2018-05-25 | An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8 and 5.2 all versions allows SSL VPN web portal users to access inter… |
CVE-2017-9641 | High | 8.8 | 2018-05-25 | PI Coresight 2016 R2 contains a cross-site request forgery vulnerability that may allow access to the PI system. OSIsoft recommends that users upgrade to PI Vi… |
CVE-2017-1752 | Medium | 4.9 | 2018-05-25 | IBM UrbanCode Deploy 6.1 and 6.2 could allow an authenticated privileged user to obtain highly sensitive information. IBM X-Force ID: 135547. |
CVE-2017-3961 | Low | 3.5 | 2018-05-25 | Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to allow… |
CVE-2017-9664 | Critical | 9.8 | 2018-05-24 | In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker may access internal… |
CVE-2017-14187 | Medium | 6.2 | 2018-05-24 | A local privilege escalation and local code execution vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8, and 5.2 and below versions allows attac… |
CVE-2017-17315 | Medium | 5.3 | 2018-05-24 | Huawei DP300 V500R002C00; RP200 V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V10… |
CVE-2017-17158 | Medium | 4.6 | 2018-05-24 | Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the v… |
CVE-2017-9421 | Medium | 6.5 | 2018-05-24 | Authentication Bypass vulnerability in Accellion kiteworks before 2017.01.00 allows remote attackers to execute certain API calls on behalf of a web user using… |
CVE-2017-9317 | High | 8.8 | 2018-05-23 | Privilege escalation vulnerability found in some Dahua IP devices. Attacker in possession of low privilege account can gain access to credential information of… |
CVE-2017-2598 | Medium | 4.3 | 2018-05-23 | Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to… |
CVE-2017-2617 | High | 7.6 | 2018-05-22 | hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a crafted file which cou… |
CVE-2017-2609 | Medium | 4.3 | 2018-05-22 | jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autocomplete feature on… |
CVE-2017-2607 | Medium | 4.2 | 2018-05-21 | jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to… |
CVE-2017-11308 | Critical | 9.8 | 2018-05-19 | Adobe Acrobat and Reader versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, 11.0.22 and earlier have an exploitable h… |
CVE-2017-11307 | Critical | 9.8 | 2018-05-19 | Adobe Acrobat and Reader versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, 11.0.22 and earlier have an exploitable o… |
CVE-2017-11306 | Critical | 9.8 | 2018-05-19 | Adobe Acrobat and Reader versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, 11.0.22 and earlier have an exploitable o… |
CVE-2017-11253 | Critical | 9.8 | 2018-05-19 | Adobe Acrobat and Reader versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, 11.0.22 and earlier have an exploitable o… |
CVE-2017-11250 | Critical | 9.8 | 2018-05-19 | Adobe Acrobat and Reader versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, 11.0.22 and earlier have an exploitable o… |
CVE-2017-11240 | Critical | 9.8 | 2018-05-19 | Adobe Acrobat and Reader versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, 11.0.22 and earlier have an exploitable o… |
CVE-2017-18273 | Medium | 6.5 | 2018-05-18 | In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadTXTImage in coders/txt.c, which allows attackers to… |
CVE-2017-18272 | Medium | 6.5 | 2018-05-18 | In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-25, there is a use-after-free in ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of servic… |
CVE-2017-18271 | Medium | 6.5 | 2018-05-18 | In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers… |
CVE-2017-18270 | High | 7.1 | 2018-05-18 | In the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl commands, setting unwanted defaults or causing a denial of ser… |
CVE-2017-18269 | Critical | 9.8 | 2018-05-18 | An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S in the GNU C Library (aka glibc or libc6) 2.21 through… |
CVE-2017-9637 | Medium | 4.1 | 2018-05-18 | Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to us… |
CVE-2017-9635 | Low | 3.9 | 2018-05-18 | Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a wea… |
CVE-2017-15855 | High | 7.8 | 2018-05-17 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2017-18268 | Medium | 5.9 | 2018-05-17 | Symantec IntelligenceCenter 3.3 is vulnerable to the Return of the Bleichenbacher Oracle Threat (ROBOT) attack. A remote attacker, who has captured a pre-recor… |
CVE-2017-15533 | Medium | 5.9 | 2018-05-17 | Symantec SSL Visibility (SSLV) 3.8.4FC, 3.10 prior to 3.10.4.1, 3.11, and 3.12 prior to 3.12.2.1 are vulnerable to the Return of the Bleichenbacher Oracle Thre… |
CVE-2017-17689 | Medium | 5.9 | 2018-05-16 | The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. |
CVE-2017-17688 | Medium | 5.9 | 2018-05-16 | The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: t… |
CVE-2017-2613 | Medium | 5.4 | 2018-05-15 | jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most… |
CVE-2017-2610 | Medium | 5.4 | 2018-05-15 | jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than an… |
CVE-2017-2604 | Medium | 4.3 | 2018-05-15 | In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permiss… |
CVE-2017-2603 | Low | 2.6 | 2018-05-15 | Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API token… |
CVE-2017-2602 | Low | 3.1 | 2018-05-15 | jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This c… |
CVE-2017-2612 | Medium | 5.4 | 2018-05-15 | In Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392), resulting in future builds possibly… |
CVE-2017-2608 | High | 8.8 | 2018-05-15 | Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in… |
CVE-2017-2600 | Medium | 4.3 | 2018-05-15 | In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. These included system configuration and ru… |
CVE-2017-2815 | High | 8.1 | 2018-05-15 | An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0. A specially crafted web request can cause the retrieval o… |
CVE-2017-14439 | High | 7.5 | 2018-05-14 | Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cau… |
CVE-2017-14438 | High | 7.5 | 2018-05-14 | Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cau… |
CVE-2017-14437 | High | 7.5 | 2018-05-14 | An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cau… |
CVE-2017-14436 | High | 7.5 | 2018-05-14 | An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cau… |
CVE-2017-14435 | High | 7.5 | 2018-05-14 | An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cau… |
CVE-2017-14434 | High | 8.8 | 2018-05-14 | An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can ca… |
CVE-2017-14433 | High | 8.8 | 2018-05-14 | An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can ca… |
CVE-2017-14432 | High | 8.8 | 2018-05-14 | An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can ca… |
CVE-2017-12129 | High | 8.0 | 2018-05-14 | An exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. An attacker could inte… |
CVE-2017-12128 | High | 7.5 | 2018-05-14 | An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted TCP packe… |
CVE-2017-12127 | Medium | 4.4 | 2018-05-14 | A password storage vulnerability exists in the operating system functionality of Moxa EDR-810 V4.1 build 17030317. An attacker with shell access could extract… |
CVE-2017-12126 | High | 8.8 | 2018-05-14 | An exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP pa… |
CVE-2017-12125 | High | 8.8 | 2018-05-14 | An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can ca… |
CVE-2017-12124 | Medium | 6.5 | 2018-05-14 | An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cau… |
CVE-2017-12123 | High | 8.8 | 2018-05-14 | An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Moxa EDR-810 V4.1 build 17030317. An atta… |
CVE-2017-12121 | High | 8.8 | 2018-05-14 | An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can ca… |