2017 CVEs (page 27)
Page 27 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-1767 | Medium | 5.4 | 2018-03-30 | IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2017-1766 | Medium | 4.3 | 2018-03-30 | Due to incorrect authorization in IBM Business Process Manager 8.6 an attacker can claim and work on ad hoc tasks he is not assigned to. IBM X-Force ID: 136151. |
CVE-2017-1765 | Low | 3.1 | 2018-03-30 | IBM Business Process Manager 8.6 could allow an authenticated user with special privileges to reveal sensitive information about the application server. IBM X-… |
CVE-2017-1756 | Medium | 4.0 | 2018-03-30 | IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856. |
CVE-2017-1747 | Medium | 5.3 | 2018-03-30 | A specially crafted message could cause a denial of service in IBM WebSphere MQ 9.0, 9.0.0.1, 9.0.0.2, 9.0.1, 9.0.2, 9.0.3, and 9.0.4 applications consuming me… |
CVE-2017-1705 | Medium | 4.3 | 2018-03-30 | IBM Security Privileged Identity Manager 2.1.0 contains left-over, sensitive information in page comments. While this information is not visible at first it ca… |
CVE-2017-9681 | Medium | 6.5 | 2018-03-30 | In Android before 2017-08-05 on Qualcomm MSM, Firefox OS for MSM, QRD Android, and all Android releases from CAF using the Linux kernel, if kernel memory addre… |
CVE-2017-14915 | Critical | 9.8 | 2018-03-30 | In Android before 2018-01-05 on Qualcomm Snapdragon Mobile SD 625, SD 650/52, SD 835, accessing SPCOM functions with a compromised client structure can result… |
CVE-2017-14913 | Critical | 9.8 | 2018-03-30 | In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile MDM9206, SD 625, SD 650/52, SD 835, SD 845, DDR address input validation is being im… |
CVE-2017-14912 | Critical | 9.8 | 2018-03-30 | In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile [VERSION]: MDM9206, MDM9607, MDM9650, MSM8909W, SD 200, SD 210/SD 212/SD 205, SD 400… |
CVE-2017-14911 | Critical | 9.8 | 2018-03-30 | In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile, Snapdragon Automobile APQ8096AU, MDM9206, MDM9650, MSM8996AU, SD 210/SD 212/SD 205… |
CVE-2017-14906 | Critical | 9.8 | 2018-03-30 | In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, PKCS7 padding is not su… |
CVE-2017-11010 | Critical | 9.8 | 2018-03-30 | In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 625, SD 650/52, SD 835, access control le… |
CVE-2017-16873 | High | 7.8 | 2018-03-29 | It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to escalate to root privil… |
CVE-2017-16839 | High | 7.0 | 2018-03-29 | Hashicorp vagrant-vmware-fusion 5.0.4 allows local users to steal root privileges if VMware Fusion is not installed. |
CVE-2017-16512 | High | 7.8 | 2018-03-29 | The vagrant update process in Hashicorp vagrant-vmware-fusion 5.0.2 through 5.0.4 allows local users to steal root privileges via a crafted update request when… |
CVE-2017-5947 | Medium | 6.8 | 2018-03-29 | An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier. The attacker can reboot the device into the Qualcomm Emergenc… |
CVE-2017-0936 | Medium | 5.7 | 2018-03-28 | Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A missing ownership check allowed log… |
CVE-2017-11510 | Critical | 9.8 | 2018-03-28 | An information leak exists in Wanscam's HW0021 network camera that allows an unauthenticated remote attacker to recover the administrator username and password… |
CVE-2017-11509 | High | 8.8 | 2018-03-28 | An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement. |
CVE-2017-7632 | Medium | 6.1 | 2018-03-27 | Cross-site scripting (XSS) vulnerability in File Station of QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to inje… |
CVE-2017-7631 | Medium | 6.1 | 2018-03-27 | Cross-site scripting (XSS) vulnerability in the share link function of File Station of QNAP 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows r… |
CVE-2017-7630 | Medium | 5.3 | 2018-03-27 | QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to obtain potentially sensitive information (firmware version and r… |
CVE-2017-12319 | Medium | 5.9 | 2018-03-27 | A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated… |
CVE-2017-12310 | High | 7.5 | 2018-03-27 | A vulnerability in the auto discovery phase of Cisco Spark Hybrid Calendar Service could allow an unauthenticated, remote attacker to view sensitive informatio… |
CVE-2017-18254 | Medium | 6.5 | 2018-03-27 | An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function WriteGIFImage in coders/gif.c, which allow remote attackers… |
CVE-2017-18253 | Medium | 6.5 | 2018-03-27 | An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in the function LoadOpenCLDevices in MagickCore/opencl.c, whic… |
CVE-2017-18252 | Medium | 6.5 | 2018-03-27 | An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows attackers to cause a denial of service (assertion fa… |
CVE-2017-18251 | Medium | 6.5 | 2018-03-27 | An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function ReadPCDImage in coders/pcd.c, which allow remote attackers… |
CVE-2017-18250 | Medium | 6.5 | 2018-03-27 | An issue was discovered in ImageMagick 7.0.7. A NULL pointer dereference vulnerability was found in the function LogOpenCLBuildFailure in MagickCore/opencl.c… |
CVE-2017-12815 | Critical | 10.0 | 2018-03-26 | Analysis of the Bomgar Remote Support Portal JavaStart.jar Applet 52790 and earlier revealed that it is vulnerable to a path traversal vulnerability. The archi… |
CVE-2017-12410 | High | 7.4 | 2018-03-26 | It is possible to exploit a Time of Check & Time of Use (TOCTOU) vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0… |
CVE-2017-18249 | High | 7.0 | 2018-03-26 | The add_free_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does not properly track an allocated nid, which allows local users to cause a denia… |
CVE-2017-18248 | Medium | 5.3 | 2018-03-26 | The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an i… |
CVE-2017-6278 | High | 7.8 | 2018-03-26 | NVIDIA Tegra kernel contains a vulnerability in the CORE DVFS Thermal driver where there is the potential to read or write a buffer using an index or pointer t… |
CVE-2017-15534 | Medium | 6.7 | 2018-03-26 | The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. In this type of circumstance, the exploit can allow the u… |
CVE-2017-15715 | High | 8.1 | 2018-03-26 | In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching… |
CVE-2017-15710 | High | 7.5 | 2018-03-26 | In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language hea… |
CVE-2017-17751 | High | 8.8 | 2018-03-24 | Bose SoundTouch devices allows remote attackers to achieve remote control via a crafted web site that uses the WebSocket Protocol. |
CVE-2017-17750 | Medium | 5.4 | 2018-03-24 | Bose SoundTouch devices allow XSS via a crafted public playlist from Spotify. |
CVE-2017-17749 | Medium | 5.4 | 2018-03-24 | Bose SoundTouch devices allow XSS via crafted song data from a music service, as demonstrated by Pandora. |
CVE-2017-18247 | Medium | 6.5 | 2018-03-23 | The av_audio_fifo_size function in libavutil/audio_fifo.c in Libav 12.2 allows remote attackers to cause a denial of service (NULL pointer dereference) via a c… |
CVE-2017-18246 | Medium | 6.5 | 2018-03-23 | The pcm_encode_frame function in libavcodec/pcm.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafte… |
CVE-2017-18245 | Medium | 6.5 | 2018-03-23 | The mpc8_probe function in libavformat/mpc8.c in Libav 12.2 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted au… |
CVE-2017-1762 | Medium | 5.4 | 2018-03-23 | IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to emb… |
CVE-2017-1655 | Medium | 5.4 | 2018-03-23 | IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to emb… |
CVE-2017-1629 | Medium | 5.4 | 2018-03-23 | IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to emb… |
CVE-2017-1602 | Medium | 4.3 | 2018-03-23 | IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access settings that they should not be able to u… |
CVE-2017-1524 | Medium | 4.3 | 2018-03-23 | IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to obtain sensitive information from a spec… |
CVE-2017-15326 | Medium | 4.3 | 2018-03-23 | DBS3900 TDD LTE V100R003C00, V100R004C10 have a weak encryption algorithm security vulnerability. DBS3900 TDD LTE supports SSL/TLS protocol negotiation using i… |
CVE-2017-15325 | High | 7.8 | 2018-03-23 | The Bdat driver of Prague smart phones with software versions earlier than Prague-AL00AC00B211, versions earlier than Prague-AL00BC00B211, versions earlier tha… |
CVE-2017-17736 | Critical | 9.8 | 2018-03-23 | Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then na… |
CVE-2017-18244 | Medium | 6.5 | 2018-03-22 | The stereo_processing function in libavcodec/aacps.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted aac… |
CVE-2017-18243 | Medium | 6.5 | 2018-03-22 | The unpack_parse_unit function in libavcodec/dirac_parser.c in Libav 12.2 allows remote attackers to cause a denial of service (segmentation fault) via a craft… |
CVE-2017-18242 | Medium | 6.5 | 2018-03-22 | The apply_dependent_coupling function in libavcodec/aacdec.c in Libav 12.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a craf… |
CVE-2017-16242 | Medium | 6.8 | 2018-03-22 | An issue was discovered on MECO USB Memory Stick with Fingerprint MECOZiolsamDE601 devices. The fingerprint authentication requirement for data access can be b… |
CVE-2017-0920 | Medium | 4.3 | 2018-03-22 | GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::Crea… |
CVE-2017-16772 | High | 8.8 | 2018-03-22 | Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authentic… |
CVE-2017-16771 | Medium | 6.1 | 2018-03-22 | Cross-site scripting (XSS) vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote attackers to inject arbitr… |
CVE-2017-0935 | High | 8.8 | 2018-03-22 | Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system… |
CVE-2017-0934 | High | 8.8 | 2018-03-22 | Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system le… |
CVE-2017-0933 | High | 8.0 | 2018-03-22 | Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from a Cross-Site Request Forgery (CSRF) vulnerability. An attacker with access to an operator (read-on… |
CVE-2017-0932 | High | 8.8 | 2018-03-22 | Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of validation on the input of the… |
CVE-2017-18094 | Medium | 4.8 | 2018-03-22 | Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative pri… |
CVE-2017-1789 | Critical | 9.8 | 2018-03-22 | IBM Tivoli Monitoring V6 6.2.3 and 6.3.0 could allow an unauthenticated user to remotely execute code through unspecified methods. IBM X-Force ID: 137034. |
CVE-2017-1788 | Medium | 5.3 | 2018-03-22 | IBM WebSphere Application Server 9 installations using Form Login could allow a remote attacker to conduct spoofing attacks. IBM X-Force ID: 137031. |
CVE-2017-1677 | High | 7.4 | 2018-03-22 | IBM Data Server Driver for JDBC and SQLJ (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) deserializes the contents of /tmp/connlicj.bin which l… |
CVE-2017-1571 | Medium | 5.1 | 2018-03-22 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cryptographic algorithms that could allow… |
CVE-2017-17743 | Medium | 6.7 | 2018-03-22 | Improper input sanitization within the restricted administration shell on UCOPIA Wireless Appliance devices before 4.4.20, 5.0.x before 5.0.19, and 5.1.x befor… |
CVE-2017-0927 | Medium | 6.5 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unauthorized use of deploy… |
CVE-2017-0926 | High | 8.8 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login. |
CVE-2017-0925 | High | 7.2 | 2018-03-21 | Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resultin… |
CVE-2017-0924 | Medium | 6.1 | 2018-03-21 | Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the labels component resulting in persistent cross site scripting. |
CVE-2017-0923 | Medium | 6.1 | 2018-03-21 | Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting. |
CVE-2017-0922 | High | 7.5 | 2018-03-21 | Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an inform… |
CVE-2017-0918 | High | 8.8 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution. |
CVE-2017-0917 | Medium | 6.1 | 2018-03-21 | Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting. |
CVE-2017-0916 | Critical | 9.8 | 2018-03-21 | Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote… |
CVE-2017-0915 | Critical | 9.8 | 2018-03-21 | Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution. |
CVE-2017-0914 | High | 7.5 | 2018-03-21 | Gitlab Community and Enterprise Editions version 10.1, 10.2, and 10.2.4 are vulnerable to a SQL injection in the MilestoneFinder component resulting in disclos… |
CVE-2017-18241 | Medium | 5.5 | 2018-03-21 | fs/f2fs/segment.c in the Linux kernel before 4.13 allows local users to cause a denial of service (NULL pointer dereference and panic) by using a noflush_merge… |
CVE-2017-5736 | High | 8.8 | 2018-03-20 | An elevation of privilege in Intel Software Guard Extensions Platform Software Component before 1.9.105.42329 allows a local attacker to execute arbitrary code… |
CVE-2017-14008 | Critical | 9.8 | 2018-03-20 | GE Centricity PACS RA1000, diagnostic image analysis, all current versions are affected these devices use default or hard-coded credentials. Successful exploit… |
CVE-2017-14006 | Critical | 9.8 | 2018-03-20 | GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these devices use default or hard-coded credentials. Succe… |
CVE-2017-14004 | Critical | 9.8 | 2018-03-20 | GE GEMNet License server (EchoServer) all current versions are affected these devices use default or hard-coded credentials. Successful exploitation of this vu… |
CVE-2017-14002 | Critical | 9.8 | 2018-03-20 | GE Infinia/Infinia with Hawkeye 4 medical imaging systems all current versions are affected these devices use default or hard-coded credentials. Successful exp… |
CVE-2017-8187 | High | 7.2 | 2018-03-20 | Huawei FusionSphere OpenStack V100R006C00SPC102(NFV) has a privilege escalation vulnerability. Due to improper privilege restrictions, an attacker with high pr… |
CVE-2017-8176 | High | 7.5 | 2018-03-20 | Huawei IPTV STB with earlier than IPTV STB V100R003C01LMYTa6SPC001 versions has an authentication bypass vulnerability. An attacker could exploit this vulnerab… |
CVE-2017-17320 | High | 7.8 | 2018-03-20 | Huawei Mate 9 Pro smartphones with software of LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 have a memory double free vulnerability. The system does n… |
CVE-2017-17319 | Medium | 5.5 | 2018-03-20 | Huawei P9 smartphones with the versions before EVA-AL10C00B399SP02 have an information disclosure vulnerability. The software does not properly protect certain… |
CVE-2017-17307 | Medium | 5.5 | 2018-03-20 | Some Huawei Smartphones with software of VNS-L21AUTC555B141 have an out-of-bounds read vulnerability. Due to the lack string terminator of string, an attacker… |
CVE-2017-17306 | Medium | 5.5 | 2018-03-20 | Some Huawei Smartphones with software of VNS-L21AUTC555B141, VNS-L21C10B160, VNS-L21C66B160, VNS-L21C703B140 have an array out-of-bounds read vulnerability. Du… |
CVE-2017-17215 | High | 8.8 | 2018-03-20 | Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to l… |
CVE-2017-17668 | High | 7.5 | 2018-03-20 | Memory write mechanism in NCR S1 Dispenser controller before firmware version 0x0156 allows an unauthenticated user to upgrade or downgrade the firmware of the… |
CVE-2017-14191 | Medium | 5.9 | 2018-03-20 | An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attacker to bypass the s… |
CVE-2017-18240 | Medium | 5.5 | 2018-03-19 | The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow local users to kill a… |
CVE-2017-18239 | Critical | 9.8 | 2018-03-18 | A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (a… |
CVE-2017-18066 | High | 7.8 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper controls in MSM CORE leads to use memo… |
CVE-2017-18065 | High | 7.8 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation for vent->vdev_id in… |
CVE-2017-18062 | High | 7.8 | 2018-03-16 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, potential buffer overflow can happen when proce… |