2017 CVEs (page 23)
Page 23 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12120 | High | 8.8 | 2018-05-14 | An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can ca… |
CVE-2017-6021 | High | 7.5 | 2018-05-14 | In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, and 2015 R2 (build… |
CVE-2017-16860 | Medium | 6.1 | 2018-05-14 | The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from version 5.4.0 before vers… |
CVE-2017-6015 | High | 7.8 | 2018-05-11 | Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an a… |
CVE-2017-18267 | Medium | 5.5 | 2018-05-10 | The FoFiType1C::cvtGlyph function in fofi/FoFiType1C.cc in Poppler through 0.64.0 allows remote attackers to cause a denial of service (infinite recursion) via… |
CVE-2017-6293 | High | 7.8 | 2018-05-10 | In Android before the 2018-05-05 security patch level, NVIDIA Tegra X1 TZ contains a vulnerability in Widevine TA where the software writes data past the end… |
CVE-2017-6289 | High | 7.8 | 2018-05-10 | In Android before the 2018-05-05 security patch level, NVIDIA Trusted Execution Environment (TEE) contains a memory corruption (due to unusual root cause) vuln… |
CVE-2017-18266 | High | 8.8 | 2018-05-10 | The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment vari… |
CVE-2017-2601 | Medium | 5.4 | 2018-05-10 | Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permi… |
CVE-2017-14481 | Critical | 9.8 | 2018-05-09 | In the MMM::Agent::Helpers::Network::send_arp function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a specially crafted MMM… |
CVE-2017-14480 | Critical | 9.8 | 2018-05-09 | In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for FreeBSD), a specially crafted MMM… |
CVE-2017-14479 | Critical | 9.8 | 2018-05-09 | In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a specially crafted MMM… |
CVE-2017-14478 | Critical | 9.8 | 2018-05-09 | In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Linux), a specially crafted MMM pr… |
CVE-2017-14477 | Critical | 9.8 | 2018-05-09 | In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for FreeBSD), a specially crafted MMM pr… |
CVE-2017-14476 | Critical | 9.8 | 2018-05-09 | In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a specially crafted MMM pr… |
CVE-2017-14475 | Critical | 9.8 | 2018-05-09 | In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Linux), a specially crafted MMM prot… |
CVE-2017-14474 | Critical | 9.8 | 2018-05-09 | In the MMM::Agent::Helpers::_execute function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1, a specially crafted MMM protocol message can ca… |
CVE-2017-5175 | High | 7.8 | 2018-05-09 | Advantech WebAccess 8.1 and earlier contains a DLL hijacking vulnerability which may allow an attacker to run a malicious DLL file within the search path resul… |
CVE-2017-18265 | High | 7.5 | 2018-05-09 | Prosody before 0.10.0 allows remote attackers to cause a denial of service (application crash), related to an incompatibility with certain versions of the LuaS… |
CVE-2017-2606 | Medium | 4.3 | 2018-05-08 | Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that should not be visible (… |
CVE-2017-2611 | Medium | 4.3 | 2018-05-08 | Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /f… |
CVE-2017-2594 | Medium | 5.4 | 2018-05-08 | hawtio before versions 2.0-beta-1, 2.0-beta-2 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 is vulnerable to a path traversal that leads to a NullPointerException with a ful… |
CVE-2017-2592 | Medium | 5.9 | 2018-05-08 | python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sens… |
CVE-2017-17540 | Critical | 9.8 | 2018-05-08 | The presence of a hardcoded account in Fortinet FortiWLC 8.3.3 allows attackers to gain unauthorized read/write access via a remote shell. |
CVE-2017-17539 | Critical | 9.8 | 2018-05-08 | The presence of a hardcoded account in Fortinet FortiWLC 7.0.11 and earlier allows attackers to gain unauthorized read/write access via a remote shell. |
CVE-2017-15043 | High | 8.8 | 2018-05-04 | A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.5 and GX450, ES450, RV50, RV50X, MP70, and MP70E rou… |
CVE-2017-3775 | Medium | 6.4 | 2018-05-04 | Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before boo… |
CVE-2017-1743 | Medium | 4.3 | 2018-05-04 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administra… |
CVE-2017-4952 | High | 7.5 | 2018-05-02 | VMware Xenon 1.x, prior to 1.5.4-CR7_1, 1.5.7_7, 1.5.4-CR6_2, 1.3.7-CR1_2, 1.1.0-CR0-3, 1.1.0-CR3_1,1.4.2-CR4_1, and 1.5.4_8, contains an authentication bypass… |
CVE-2017-1601 | Critical | 9.8 | 2018-05-02 | IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, whic… |
CVE-2017-1255 | High | 7.5 | 2018-05-02 | IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly s… |
CVE-2017-5536 | Medium | 6.3 | 2018-05-01 | The GridServer Broker, and GridServer Director components of TIBCO Software Inc. TIBCO DataSynapse GridServer Manager contain vulnerabilities which may allow a… |
CVE-2017-5535 | Medium | 6.8 | 2018-05-01 | The GridServer Broker, GridServer Driver, and GridServer Engine components of TIBCO Software Inc. TIBCO DataSynapse GridServer Manager contain vulnerabilities… |
CVE-2017-14014 | Medium | 4.6 | 2018-05-01 | Boston Scientific ZOOM LATITUDE PRM Model 3120 uses a hard-coded cryptographic key to encrypt PHI prior to having it transferred to removable media. CVSS v3 ba… |
CVE-2017-14012 | Medium | 4.6 | 2018-05-01 | Boston Scientific ZOOM LATITUDE PRM Model 3120 does not encrypt PHI at rest. CVSS v3 base score: 4.6; CVSS vector string: AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. |
CVE-2017-18264 | Critical | 9.8 | 2018-05-01 | An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg['S… |
CVE-2017-17020 | High | 8.8 | 2018-05-01 | On D-Link DCS-5009 devices with firmware 1.08.11 and earlier, DCS-5010 devices with firmware 1.14.09 and earlier, and DCS-5020L devices with firmware before 1… |
CVE-2017-9658 | Medium | 6.5 | 2018-04-30 | Certain 802.11 network management messages have been determined to invoke wireless access point blacklisting security defenses when not required, which can nec… |
CVE-2017-9657 | Medium | 6.5 | 2018-04-30 | Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN monitor to the central monitoring statio… |
CVE-2017-17318 | Medium | 6.5 | 2018-04-30 | Huawei MBB (Mobile Broadband) products E5771h-937 with the versions before E5771h-937TCPU-V200R001B328D62SP00C1133 and the versions before E5771h-937TCPU-V200R… |
CVE-2017-17314 | Low | 3.7 | 2018-04-30 | Huawei DP300 V500R002C00, RP200 V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V10… |
CVE-2017-18262 | Medium | 6.1 | 2018-04-30 | Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any signed-in user through its endpoints for handling Shibboleth lo… |
CVE-2017-2591 | Low | 3.7 | 2018-04-30 | 389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness… |
CVE-2017-18263 | High | 7.5 | 2018-04-28 | Seagate Media Server in Seagate Personal Cloud before 4.3.18.4 has directory traversal in getPhotoPlaylistPhotos.psp via a parameter named url. |
CVE-2017-1116 | Medium | 4.3 | 2018-04-27 | IBM Campaign 8.6, 9.0, 9.1, 9.1.1, 9.1.2, and 10.0 contains excessive details on the client side which could provide information useful for an authenticated us… |
CVE-2017-17543 | High | 7.5 | 2018-04-26 | Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and be… |
CVE-2017-14010 | High | 7.8 | 2018-04-26 | In SpiderControl MicroBrowser Windows XP, Vista 7, 8 and 10, Versions 1.6.30.144 and prior, an uncontrolled search path element vulnerability has been identifi… |
CVE-2017-15691 | Medium | 6.5 | 2018-04-26 | In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC pri… |
CVE-2017-9284 | Medium | 4.8 | 2018-04-26 | IDM 4.6 Identity Applications prior to 4.6.2.1 may expose sensitive information. |
CVE-2017-9275 | Low | 2.8 | 2018-04-26 | NetIQ Identity Reporting, in versions prior to 5.5 Service Pack 1, is susceptible to an XSS attack. |
CVE-2017-1724 | Medium | 6.1 | 2018-04-26 | IBM Security QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2017-1723 | Medium | 6.5 | 2018-04-26 | IBM Security QRadar SIEM 7.2 and 7.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL reques… |
CVE-2017-1722 | Medium | 6.3 | 2018-04-26 | IBM Security QRadar SIEM 7.2 and 7.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attac… |
CVE-2017-1721 | Medium | 5.6 | 2018-04-26 | IBM Security QRadar SIEM 7.2 and 7.3 could allow an unauthenticated user to execute code remotely with lower level privileges under unusual circumstances. IBM… |
CVE-2017-14740 | Medium | 4.8 | 2018-04-26 | Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the Menu ID when adding… |
CVE-2017-6888 | Medium | 5.5 | 2018-04-25 | An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a sp… |
CVE-2017-7652 | High | 7.5 | 2018-04-25 | In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration t… |
CVE-2017-1750 | Medium | 5.4 | 2018-04-25 | IBM Jazz Reporting Service (JRS) 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr… |
CVE-2017-12716 | Medium | 6.5 | 2018-04-25 | Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communications to programme… |
CVE-2017-12714 | Medium | 6.5 | 2018-04-25 | Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017 do not restrict or limit the number of correctly formatted "RF wake-up" commands that can be… |
CVE-2017-12712 | High | 8.8 | 2018-04-25 | The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and time stamp, can be… |
CVE-2017-17557 | High | 8.8 | 2018-04-24 | In Foxit Reader before 9.1 and Foxit PhantomPDF before 9.1, a flaw exists within the parsing of the BITMAPINFOHEADER record in BMP files. The issue results fro… |
CVE-2017-2924 | High | 8.8 | 2018-04-24 | An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3. A specially crafted XLS file can cause a memor… |
CVE-2017-2923 | High | 8.8 | 2018-04-24 | An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record function' of FreeXL 1.0.3. A specially crafted XLS file can cause… |
CVE-2017-2918 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the Image loading functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file… |
CVE-2017-2908 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the thumbnail functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted .blend fi… |
CVE-2017-2907 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c. A specially created '… |
CVE-2017-2906 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the animation playing functionality of the Blender open-source 3d creation suite version 2.78c. A specially created '… |
CVE-2017-2905 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the bmp loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.bmp'… |
CVE-2017-2904 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the RADIANCE loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '… |
CVE-2017-2903 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the DPX loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.cin'… |
CVE-2017-2902 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the DPX loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.cin'… |
CVE-2017-2901 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the IRIS loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.iris… |
CVE-2017-2900 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the PNG loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.png'… |
CVE-2017-2899 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the TIFF loading functionality of the Blender open-source 3d creation suite version 2.78c. A specially crafted '.tif'… |
CVE-2017-2885 | Critical | 9.8 | 2018-04-24 | An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resultin… |
CVE-2017-2840 | High | 7.8 | 2018-04-24 | A buffer overflow vulnerability exists in the ISO parsing functionality of EZB Systems UltraISO 9.6.6.3300. A specially crafted .ISO file can cause a vulnerabi… |
CVE-2017-2839 | Medium | 5.9 | 2018-04-24 | An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge… |
CVE-2017-2838 | Medium | 5.9 | 2018-04-24 | An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge… |
CVE-2017-2837 | Medium | 5.9 | 2018-04-24 | An exploitable denial of service vulnerability exists within the handling of security data in FreeRDP 2.0.0-beta1+android11. A specially crafted challenge pack… |
CVE-2017-2836 | Medium | 5.9 | 2018-04-24 | An exploitable denial of service vulnerability exists within the reading of proprietary server certificates in FreeRDP 2.0.0-beta1+android11. A specially craft… |
CVE-2017-2835 | High | 8.1 | 2018-04-24 | An exploitable code execution vulnerability exists in the RDP receive functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can c… |
CVE-2017-2834 | High | 7.0 | 2018-04-24 | An exploitable code execution vulnerability exists in the authentication functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response ca… |
CVE-2017-2833 | High | 7.5 | 2018-04-24 | An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52… |
CVE-2017-2832 | High | 7.2 | 2018-04-24 | An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52… |
CVE-2017-2812 | High | 8.8 | 2018-04-24 | A code execution vulnerability exists in the kdu_buffered_expand function of the Kakadu SDK 7.9. A specially crafted JPEG 2000 file can be read by the program… |
CVE-2017-2811 | High | 8.8 | 2018-04-24 | A code execution vulnerability exists in the Kakadu SDK 7.9's parsing of compressed JPEG 2000 images. A specially crafted JPEG 2000 file can be read by the pro… |
CVE-2017-2804 | High | 8.8 | 2018-04-24 | A remote out of bound write vulnerability exists in the TIFF parsing functionality of Core PHOTO-PAINT X8 18.1.0.661. A specially crafted TIFF file can cause a… |
CVE-2017-2803 | High | 8.8 | 2018-04-24 | A remote out of bound write vulnerability exists in the TIFF parsing functionality of Core PHOTO-PAINT X8 version 18.1.0.661. A specially crafted TIFF file can… |
CVE-2017-2802 | High | 7.8 | 2018-04-24 | An exploitable dll hijacking vulnerability exists in the poaService.exe service component of the Dell Precision Optimizer software version 3.5.5.0. A specifica… |
CVE-2017-14450 | High | 7.1 | 2018-04-24 | A buffer overflow vulnerability exists in the GIF image parsing functionality of SDL2_image-2.0.2. A specially crafted GIF image can lead to a buffer overflow… |
CVE-2017-14449 | High | 7.5 | 2018-04-24 | A double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a Double-Free situatio… |
CVE-2017-14448 | High | 8.8 | 2018-04-24 | An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2.0.2. A specially crafted XCF image can cause a heap… |
CVE-2017-14442 | High | 8.8 | 2018-04-24 | An exploitable code execution vulnerability exists in the BMP image rendering functionality of SDL2_image-2.0.2. A specially crafted BMP image can cause a stac… |
CVE-2017-14441 | High | 8.8 | 2018-04-24 | An exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2.0.2. A specially crafted ICO image can cause an int… |
CVE-2017-14440 | High | 8.8 | 2018-04-24 | An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a st… |
CVE-2017-12122 | High | 8.8 | 2018-04-24 | An exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2.0.2. A specially crafted ILBM image can cause a he… |
CVE-2017-12109 | High | 8.8 | 2018-04-24 | An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULRK record. A specially crafted XLS… |
CVE-2017-12108 | High | 8.8 | 2018-04-24 | An exploitable integer overflow vulnerability exists in the xls_preparseWorkSheet function of libxls 1.4 when handling a MULBLANK record. A specially crafted X… |
CVE-2017-12107 | High | 8.8 | 2018-04-24 | An memory corruption vulnerability exists in the .PCX parsing functionality of Computerinsel Photoline 20.02. A specially crafted .PCX file can cause a vulnera… |