2017 CVEs (page 24)
Page 24 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12105 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c applies a particular object modifier to a Mesh. A speci… |
CVE-2017-12104 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c draws a Particle object. A specially crafted .blend fil… |
CVE-2017-12103 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts text rendered as a font into a curve. A specia… |
CVE-2017-12102 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the way that the Blender open-source 3d creation suite v2.78c converts curves to polygons. A specially crafted .blend… |
CVE-2017-12101 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the 'modifier_mdef_compact_influences' functionality of the Blender open-source 3d creation suite v2.78c. A specially… |
CVE-2017-12100 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the 'multires_load_old_dm' functionality of the Blender open-source 3d creation suite v2.78c. A specially crafted .bl… |
CVE-2017-12099 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the upgrade of the legacy Mesh attribute 'tface' of the Blender open-source 3d creation suite v2.78c. A specially cra… |
CVE-2017-12087 | Critical | 10.0 | 2018-04-24 | An exploitable heap overflow vulnerability exists in the tinysvcmdns library version 2016-07-18. A specially crafted packet can make the library overwrite an a… |
CVE-2017-12086 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the 'BKE_mesh_calc_normals_tessface' functionality of the Blender open-source 3d creation suite. A specially crafted… |
CVE-2017-12082 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the 'CustomData' Mesh loading functionality of the Blender open-source 3d creation suite. A .blend file with a specia… |
CVE-2017-12081 | High | 7.8 | 2018-04-24 | An exploitable integer overflow exists in the upgrade of a legacy Mesh attribute of the Blender open-source 3d creation suite v2.78c. A specially crafted .blen… |
CVE-2017-9656 | Critical | 9.1 | 2018-04-24 | The backend database of the Philips DoseWise Portal application versions 1.1.7.333 and 2.1.1.3069 uses hard-coded credentials for a database account with privi… |
CVE-2017-9654 | High | 8.8 | 2018-04-24 | The Philips DoseWise Portal web-based application versions 1.1.7.333 and 2.1.1.3069 stores login credentials in clear text within backend system files. CVSS v3… |
CVE-2017-17258 | High | 7.5 | 2018-04-24 | Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R00… |
CVE-2017-17257 | High | 7.5 | 2018-04-24 | Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R00… |
CVE-2017-17256 | High | 7.5 | 2018-04-24 | Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R00… |
CVE-2017-17255 | High | 7.5 | 2018-04-24 | Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R00… |
CVE-2017-17254 | High | 7.5 | 2018-04-24 | Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R00… |
CVE-2017-17253 | High | 7.5 | 2018-04-24 | Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R00… |
CVE-2017-17252 | Medium | 5.3 | 2018-04-24 | Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R00… |
CVE-2017-17251 | Medium | 5.3 | 2018-04-24 | Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R00… |
CVE-2017-7651 | High | 7.5 | 2018-04-24 | In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can b… |
CVE-2017-1734 | Medium | 4.3 | 2018-04-24 | IBM Jazz Team Server affecting the following IBM Rational Products: Collaborative Lifecycle Management (CLM), Rational DOORS Next Generation (RDNG), Rational E… |
CVE-2017-1725 | Medium | 4.3 | 2018-04-24 | IBM Jazz Team Server affecting the following IBM Rational Products: Collaborative Lifecycle Management (CLM), Rational DOORS Next Generation (RDNG), Rational E… |
CVE-2017-1700 | Medium | 6.5 | 2018-04-24 | IBM Jazz Team Server affecting the following IBM Rational Products: Collaborative Lifecycle Management (CLM), Rational DOORS Next Generation (RDNG), Rational E… |
CVE-2017-7893 | Critical | 9.8 | 2018-04-23 | In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master. |
CVE-2017-17833 | Critical | 9.8 | 2018-04-23 | OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote c… |
CVE-2017-14458 | High | 8.8 | 2018-04-23 | An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 8.3.2.25013. A specially crafted PDF d… |
CVE-2017-13073 | Medium | 6.1 | 2018-04-23 | Cross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5.4.3, and their earlier versions could allow remote attackers t… |
CVE-2017-1786 | Medium | 5.3 | 2018-04-23 | IBM WebSphere MQ 8.0 through 8.0.0.8 and 9.0 through 9.0.4 under special circumstances could allow an authenticated user to consume all resources due to a memo… |
CVE-2017-1764 | High | 7.0 | 2018-04-23 | IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2, under specialized circumstances, could expose plain text credentials to a local user. IBM… |
CVE-2017-1701 | High | 8.8 | 2018-04-23 | IBM Team Concert (RTC) 5.0, 5.0.1, 5.0.2, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, and 6.0.5 stores credentials for users using a weak encryption algorithm, which coul… |
CVE-2017-1486 | Medium | 6.1 | 2018-04-23 | IBM Cognos Business Intelligence 10.2, 10.2.1, 10.2.1.1, and 10.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J… |
CVE-2017-1473 | High | 7.5 | 2018-04-23 | IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6 and 9.0.0 through 9.0.3.1 uses weaker than expected cryptographic algorithms that could allow an at… |
CVE-2017-17902 | Critical | 9.8 | 2018-04-22 | SQL Injection exists in Kliqqi CMS 3.5.2 via the randkey parameter of a new story at the pligg/story.php?title= URI. |
CVE-2017-17889 | Medium | 5.4 | 2018-04-22 | Kliqqi CMS 3.5.2 has XSS via a crafted group name in pligg/groups.php, a crafted Homepage string in a profile, or a crafted string in Tags or Description withi… |
CVE-2017-15640 | Medium | 5.4 | 2018-04-21 | app/sections/user-menu.php in phpIPAM before 1.3.1 has XSS via the ip parameter. |
CVE-2017-2825 | High | 7.0 | 2018-04-20 | In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in database writes. An atta… |
CVE-2017-8315 | High | 7.5 | 2018-04-20 | Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier was found vulnerable to an XML External Entity attack. An attacker can exploit the vulnera… |
CVE-2017-3776 | High | 7.5 | 2018-04-19 | Lenovo Help Android mobile app versions earlier than 6.1.2.0327 allowed information to be transmitted over an HTTP channel, permitting others observing the cha… |
CVE-2017-3774 | Critical | 9.8 | 2018-04-19 | A stack overflow vulnerability was discovered within the web administration service in Integrated Management Module 2 (IMM2) earlier than version 4.70 used in… |
CVE-2017-17313 | Medium | 5.5 | 2018-04-19 | The inputhub driver of HUAWEI P9 Lite mobile phones with Versions earlier than VNS-L21C02B341, Versions earlier than VNS-L21C22B380, Versions earlier than VNS-… |
CVE-2017-17310 | High | 7.5 | 2018-04-19 | Electronic Numbers to URI Mapping (ENUM) module in some Huawei products DP300 V500R002C00, RP200 V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40… |
CVE-2017-18261 | Medium | 5.5 | 2018-04-19 | The arch_timer_reg_read_stable macro in arch/arm64/include/asm/arch_timer.h in the Linux kernel before 4.13 allows local users to cause a denial of service (in… |
CVE-2017-12196 | Medium | 4.8 | 2018-04-18 | undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value… |
CVE-2017-2871 | High | 8.8 | 2018-04-17 | Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is… |
CVE-2017-9638 | Critical | 9.8 | 2018-04-17 | Mitsubishi E-Designer, Version 7.52 Build 344 contains six code sections which may be exploited to overwrite the stack. This can result in arbitrary code execu… |
CVE-2017-9636 | Critical | 9.8 | 2018-04-17 | Mitsubishi E-Designer, Version 7.52 Build 344 contains five code sections which may be exploited to overwrite the heap. This can result in arbitrary code execu… |
CVE-2017-9634 | Critical | 9.8 | 2018-04-17 | Mitsubishi E-Designer, Version 7.52 Build 344 contains two code sections which may be exploited to allow an attacker to overwrite arbitrary memory locations. T… |
CVE-2017-6020 | Medium | 5.3 | 2018-04-17 | Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize external input to en… |
CVE-2017-12701 | Medium | 6.5 | 2018-04-17 | BMC Medical Luna CPAP Machines released prior to July 1, 2017, contain an improper input validation vulnerability which may allow an authenticated attacker to… |
CVE-2017-18102 | Medium | 5.4 | 2018-04-17 | The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or JavaScript via a c… |
CVE-2017-6323 | High | 8.0 | 2018-04-16 | The Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6, and ITMS 7.6_POST_HF7 has an issue whereby XML input containing a reference to an ext… |
CVE-2017-10140 | High | 7.8 | 2018-04-16 | Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented f… |
CVE-2017-0372 | Critical | 9.8 | 2018-04-13 | Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities. |
CVE-2017-0370 | Medium | 5.3 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter. |
CVE-2017-0369 | Medium | 6.5 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it. |
CVE-2017-0368 | Medium | 5.3 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages. |
CVE-2017-0367 | High | 8.8 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is ins… |
CVE-2017-0366 | Medium | 5.4 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration. |
CVE-2017-0365 | Medium | 4.7 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations. |
CVE-2017-0364 | Medium | 6.1 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link. |
CVE-2017-0363 | Medium | 6.1 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites. |
CVE-2017-0362 | High | 8.8 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token. |
CVE-2017-0361 | High | 7.8 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext. |
CVE-2017-0359 | Critical | 9.8 | 2018-04-13 | diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive. |
CVE-2017-0358 | High | 7.8 | 2018-04-13 | Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elev… |
CVE-2017-0357 | Critical | 9.8 | 2018-04-13 | A heap-overflow flaw exists in the -tr loader of iucode-tool starting with v1.4 and before v2.1.1, potentially leading to SIGSEGV, or heap corruption. |
CVE-2017-0356 | Critical | 9.8 | 2018-04-13 | A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass… |
CVE-2017-6158 | Medium | 6.5 | 2018-04-13 | In F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 there is a vulnerability in TMM related to handling of invalid IP addresses. |
CVE-2017-6156 | Medium | 6.4 | 2018-04-13 | When the F5 BIG-IP 12.1.0-12.1.1, 11.6.0-11.6.1, 11.5.1-11.5.5, or 11.2.1 system is configured with a wildcard IPSec tunnel endpoint, it may allow a remote att… |
CVE-2017-6155 | High | 7.5 | 2018-04-13 | On F5 BIG-IP 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.4.1-11.5.5, or 11.2.1, malformed SPDY or HTTP/2 requests may result in a disruption of service to TMM… |
CVE-2017-6148 | High | 7.5 | 2018-04-13 | Responses to SOCKS proxy requests made through F5 BIG-IP version 13.0.0, 12.0.0-12.1.3.1, 11.6.1-11.6.2, or 11.5.1-11.5.5 may cause a disruption of services pr… |
CVE-2017-6143 | Medium | 5.4 | 2018-04-13 | X509 certificate verification was not correctly implemented in the IP Intelligence Subscription and IP Intelligence feed-list features, and thus the remote ser… |
CVE-2017-6910 | High | 7.5 | 2018-04-12 | The HTTP and WebSocket engine components in the server in Kaazing Gateway before 4.5.3 hotfix-1, Gateway - JMS Edition before 4.0.5 hotfix-15, 4.0.6 before hot… |
CVE-2017-1790 | Medium | 5.4 | 2018-04-12 | IBM DOORS Next Generation (DNG/RRC) 5.0, 5.0.1, 5.0.2, and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar… |
CVE-2017-7534 | Medium | 5.4 | 2018-04-11 | OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user input, specifically t… |
CVE-2017-8154 | Medium | 5.3 | 2018-04-11 | The Themes App Honor 8 Lite Huawei mobile phones with software of versions before Prague-L31C576B172, versions before Prague-L31C530B160, versions before Pragu… |
CVE-2017-17308 | Medium | 5.3 | 2018-04-11 | SCCPX module in Huawei DP300 V500R002C00, RP200 V500R002C00, V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R… |
CVE-2017-15327 | Medium | 4.3 | 2018-04-11 | S12700 V200R005C00, V200R006C00, V200R006C01, V200R007C00, V200R007C01, V200R007C20, V200R008C00, V200R008C06, V200R009C00, V200R010C00, S7700 V200R001C00, V20… |
CVE-2017-2599 | Medium | 5.4 | 2018-04-11 | Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) t… |
CVE-2017-14459 | Critical | 10.0 | 2018-04-11 | An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wi… |
CVE-2017-8275 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 430, SD 450, SD 617, SD 625, SD 650/52, SD 800… |
CVE-2017-8274 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 425, S… |
CVE-2017-18146 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W… |
CVE-2017-18145 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 450, SD 615/16/SD 415, S… |
CVE-2017-18144 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 450, SD 615/16/SD 415, S… |
CVE-2017-18143 | High | 7.5 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, on a secure device, PD dumps are collected when debugging is no… |
CVE-2017-18142 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9650, MDM9655, SD 835, SD 845, SD 850, while processing the IMS SIP username… |
CVE-2017-18140 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W… |
CVE-2017-18139 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9… |
CVE-2017-18138 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9… |
CVE-2017-18137 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9640, MDM9645, MDM9650, MDM9655, SD 450, SD 625, SD 650/52, SD 810, SD 820… |
CVE-2017-18136 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9635M… |
CVE-2017-18135 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile MDM9650, MDM9655, SD 450, SD 625, SD 650/52, SD 835, SD 845, SD 850, in the Wir… |
CVE-2017-18134 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, a buffer overflow may potentially occur while processing a resp… |
CVE-2017-18133 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835, an… |
CVE-2017-18132 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9206, MDM9607, MDM8996, an out-of-bounds access ca… |
CVE-2017-18130 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/S… |
CVE-2017-18129 | Critical | 9.8 | 2018-04-11 | In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9206, MDM9607, SD 845, MSM8996, MSM8998, it is pos… |