2017 CVEs (page 29)
Page 29 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-17219 | Medium | 5.3 | 2018-03-09 | SCCPX module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R… |
CVE-2017-17218 | Medium | 5.3 | 2018-03-09 | SCCPX module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R… |
CVE-2017-17217 | Medium | 5.9 | 2018-03-09 | Media Gateway Control Protocol (MGCP) in Huawei DP300 V500R002C00; RP200 V500R002C00SPC200; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R… |
CVE-2017-17216 | Medium | 5.9 | 2018-03-09 | Media Gateway Control Protocol (MGCP) in Huawei DP300 V500R002C00; RP200 V500R002C00SPC200; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R… |
CVE-2017-17200 | Medium | 5.9 | 2018-03-09 | Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006… |
CVE-2017-17199 | Medium | 5.9 | 2018-03-09 | Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006… |
CVE-2017-17170 | Medium | 6.5 | 2018-03-09 | The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol… |
CVE-2017-17169 | Medium | 6.5 | 2018-03-09 | The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol… |
CVE-2017-17168 | Medium | 6.5 | 2018-03-09 | The CIDAM Protocol on some Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol… |
CVE-2017-17167 | Medium | 5.9 | 2018-03-09 | Huawei DP300 V500R002C00; TP3206 V100R002C00; ViewPoint 9030 V100R011C02; V100R011C03 have a use of a broken or risky cryptographic algorithm vulnerability. Th… |
CVE-2017-17150 | Medium | 5.5 | 2018-03-09 | Timergrp module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V5… |
CVE-2017-17149 | Low | 3.9 | 2018-03-09 | Huawei HiWallet App with the versions before 8.0.4 has an arbitrary lock pattern change vulnerability. It needs to verify the user's Huawei ID during lock patt… |
CVE-2017-17148 | Medium | 5.5 | 2018-03-09 | Huawei DP300 V500R002C00 have a DoS vulnerability due to the lack of validation when the malloc is called. An authenticated local attacker can craft specific X… |
CVE-2017-17147 | Medium | 5.5 | 2018-03-09 | Huawei DP300 V500R002C00 have an integer overflow vulnerability due to the lack of validation. An authenticated local attacker can craft specific XML files to… |
CVE-2017-17146 | High | 7.8 | 2018-03-09 | Huawei DP300 V500R002C00 have a buffer overflow vulnerability due to the lack of validation. An authenticated local attacker can craft specific XML files to th… |
CVE-2017-17145 | Medium | 4.6 | 2018-03-09 | Huawei Honor V9 Play smart phones with the versions before Jimmy-AL00AC00B135 have an authentication bypass vulnerability due to the improper design of a compo… |
CVE-2017-10854 | High | 8.8 | 2018-03-09 | Corega CG-WGR1200 firmware 2.20 and earlier allows an attacker to bypass authentication and change the login password via unspecified vectors. |
CVE-2017-10853 | High | 8.8 | 2018-03-09 | Buffer overflow in Corega CG-WGR1200 firmware 2.20 and earlier allows an attacker to execute arbitrary commands via unspecified vectors. |
CVE-2017-10852 | High | 8.8 | 2018-03-09 | Buffer overflow in Corega CG-WGR1200 firmware 2.20 and earlier allows an attacker to execute arbitrary code via unspecified vectors. |
CVE-2017-1625 | Medium | 5.3 | 2018-03-08 | IBM Pulse for QRadar 1.0.0 - 1.0.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. I… |
CVE-2017-7641 | High | 8.8 | 2018-03-08 | QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections. |
CVE-2017-7640 | Critical | 9.8 | 2018-03-08 | QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system w… |
CVE-2017-7638 | Medium | 6.5 | 2018-03-08 | QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly. Successful exploitation could le… |
CVE-2017-7634 | Medium | 6.1 | 2018-03-08 | Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to in… |
CVE-2017-6152 | Medium | 6.7 | 2018-03-08 | A local user on F5 BIG-IQ Centralized Management 5.1.0-5.2.0 with the Access Manager role has privileges to change the passwords of other users on the system… |
CVE-2017-18222 | High | 7.8 | 2018-03-08 | In the Linux kernel before 4.12, Hisilicon Network Subsystem (HNS) does not consider the ETH_SS_PRIV_FLAGS case when retrieving sset_count data, which allows l… |
CVE-2017-12174 | High | 7.5 | 2018-03-07 | It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an… |
CVE-2017-15367 | Critical | 9.8 | 2018-03-07 | Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on… |
CVE-2017-18221 | Medium | 5.5 | 2018-03-07 | The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause a denial of service (NR_MLOCK accounting corruption)… |
CVE-2017-11650 | Medium | 6.1 | 2018-03-07 | Cross-site scripting (XSS) vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0_RC3 build r6594 allows remote attackers to inject arbitrary web sc… |
CVE-2017-11649 | High | 8.8 | 2018-03-07 | Cross-site request forgery (CSRF) vulnerability in DrayTek Vigor AP910C devices with firmware 1.2.0_RC3 build r6594 allows remote attackers to hijack the authe… |
CVE-2017-15519 | High | 7.2 | 2018-03-06 | Versions of SnapCenter 2.0 through 3.0.1 allow unauthenticated remote attackers to view and modify backup related data via the Plug-in for NAS File Services. A… |
CVE-2017-9786 | Medium | 6.1 | 2018-03-06 | Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to injec… |
CVE-2017-9783 | Medium | 6.1 | 2018-03-06 | Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to injec… |
CVE-2017-6296 | High | 7.0 | 2018-03-06 | NVIDIA TrustZone Software contains a TOCTOU issue in the DRM application which may lead to the denial of service or possible escalation of privileges. This iss… |
CVE-2017-6295 | High | 8.4 | 2018-03-06 | NVIDIA TrustZone Software contains a vulnerability in the Keymaster implementation where the software reads data past the end, or before the beginning, of the… |
CVE-2017-6284 | Medium | 5.5 | 2018-03-06 | NVIDIA Security Engine contains a vulnerability in the Deterministic Random Bit Generator (DRBG) where the DRBG does not properly initialize and store or trans… |
CVE-2017-6283 | Medium | 5.5 | 2018-03-06 | NVIDIA Security Engine contains a vulnerability in the RSA function where the keyslot read/write lock permissions are cleared on a chip reset which may lead to… |
CVE-2017-6282 | High | 7.8 | 2018-03-06 | NVIDIA Tegra kernel driver contains a vulnerability in NVMAP where an attacker has the ability to write an arbitrary value to an arbitrary location which may l… |
CVE-2017-6280 | High | 7.5 | 2018-03-06 | NVIDIA driver contains a possible out-of-bounds read vulnerability due to a leak which may lead to information disclosure. This issue is rated as moderate. And… |
CVE-2017-18220 | High | 8.8 | 2018-03-05 | The ReadOneJNGImage and ReadJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 allow remote attackers to cause a denial of service (magick/blob.c Clos… |
CVE-2017-18219 | Medium | 6.5 | 2018-03-05 | An issue was discovered in GraphicsMagick 1.3.26. An allocation failure vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows a… |
CVE-2017-18218 | High | 7.8 | 2018-03-05 | In drivers/net/ethernet/hisilicon/hns/hns_enet.c in the Linux kernel before 4.13, local users can cause a denial of service (use-after-free and BUG) or possibl… |
CVE-2017-18217 | Medium | 6.1 | 2018-03-05 | An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web address parameters are vulnerable to Cross Site Scripting… |
CVE-2017-8165 | Medium | 5.5 | 2018-03-05 | Mate 9 Huawei smart phones with versions earlier than MHA-AL00BC00B233 have a sensitive information leak vulnerability. An attacker can trick a user to install… |
CVE-2017-8164 | Low | 3.3 | 2018-03-05 | Some Huawei smart phones with software EVA-L09C34B142; EVA-L09C40B196; EVA-L09C432B210; EVA-L09C440B138; EVA-L09C464B150; EVA-L09C530B127; EVA-L09C55B190; EVA-… |
CVE-2017-17144 | Medium | 5.3 | 2018-03-05 | Backup feature of SIP module in Huawei DP300 V500R002C00; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC400; V500R002C00SPC500; V500R0… |
CVE-2017-17143 | Medium | 5.3 | 2018-03-05 | SIP module in Huawei DP300 V500R002C00; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC400; V500R002C00SPC500; V500R002C00SPC600; V500R… |
CVE-2017-17142 | Medium | 5.3 | 2018-03-05 | SIP module in Huawei DP300 V500R002C00; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC400; V500R002C00SPC500; V500R002C00SPC600; V500R… |
CVE-2017-17141 | Low | 3.7 | 2018-03-05 | Huawei S12700 V200R005C00; V200R006C00; V200R007C00; V200R007C01; V200R007C20; V200R008C00; V200R009C00;S1700 V200R006C10; V200R009C00;S2700 V100R006C03; V200R… |
CVE-2017-17140 | Medium | 5.5 | 2018-03-05 | Huawei Enjoy 5s and Y6 Pro smartphones with software the versions before TAG-AL00C92B170; the versions before TIT-L01C576B121 have an information leak vulnerab… |
CVE-2017-17139 | Medium | 5.5 | 2018-03-05 | Huawei Mate 9 and Mate 9 pro smart phones with software the versions before MHA-AL00B 8.0.0.334(C00); the versions before LON-AL00B 8.0.0.334(C00) have a infor… |
CVE-2017-17138 | Medium | 5.5 | 2018-03-05 | PEM module of DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V500R001C… |
CVE-2017-17137 | Medium | 5.5 | 2018-03-05 | PEM module of Huawei DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V5… |
CVE-2017-17136 | Medium | 5.5 | 2018-03-05 | PEM module of Huawei DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V5… |
CVE-2017-17135 | Medium | 5.5 | 2018-03-05 | PEM module of Huawei DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V5… |
CVE-2017-17134 | Medium | 5.5 | 2018-03-05 | XML parser in Huawei DP300 V500R002C00; RP200 V500R002C00SPC200; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V… |
CVE-2017-17133 | Medium | 5.5 | 2018-03-05 | Huawei VP9660 V500R002C10 has a null pointer reference vulnerability in license module due to insufficient verification. An authenticated local attacker could… |
CVE-2017-17132 | Medium | 5.5 | 2018-03-05 | Huawei VP9660 V500R002C10 has a uncontrolled format string vulnerability when the license module output the log information. An authenticated local attacker co… |
CVE-2017-17131 | Medium | 5.7 | 2018-03-05 | Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V600R006C00; TE50 V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00; VP9660 V… |
CVE-2017-18216 | Medium | 5.5 | 2018-03-05 | In fs/ocfs2/cluster/nodemanager.c in the Linux kernel before 4.15, local users can cause a denial of service (NULL pointer dereference and BUG) because a requi… |
CVE-2017-18215 | Critical | 9.8 | 2018-03-05 | xvpng.c in xv 3.10a has memory corruption (out-of-bounds write) when decoding PNG comment fields, leading to crashes or potentially code execution, because it… |
CVE-2017-17428 | Medium | 5.9 | 2018-03-05 | Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenba… |
CVE-2017-16922 | Medium | 5.3 | 2018-03-05 | In com.wowza.wms.timedtext.http.HTTPProviderCaptionFile in Wowza Streaming Engine before 4.7.1, traversal of the directory structure and retrieval of a file ar… |
CVE-2017-7633 | High | 7.5 | 2018-03-05 | QNAP Qfinder Pro 6.1.0.0317 and earlier may expose sensitive information contained in NAS devices. If exploited, this may allow attackers to further compromise… |
CVE-2017-7437 | Medium | 4.6 | 2018-03-05 | NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via the "type" and "account" parameters of json requests. |
CVE-2017-7427 | Medium | 5.4 | 2018-03-05 | Multiple cross site scripting attacks were found in the Identity Manager Plug-in, hosted on iManager 2.7.7.7, before Identity Manager 4.6.1. In certain scenari… |
CVE-2017-18214 | High | 7.5 | 2018-03-04 | The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-20… |
CVE-2017-18213 | High | 7.2 | 2018-03-04 | In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges. |
CVE-2017-9285 | Medium | 5.4 | 2018-03-02 | NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted access to eDirectory services. |
CVE-2017-9280 | Medium | 4.3 | 2018-03-02 | Some NetIQ Identity Manager Applications before Identity Manager 4.5.6.1 included the session token in GET URLs, potentially allowing exposure of user sessions… |
CVE-2017-9279 | Low | 2.0 | 2018-03-02 | NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes handling of the User Application Admini… |
CVE-2017-9278 | Low | 3.3 | 2018-03-02 | The NetIQ Identity Manager Oracle EBS driver before 4.0.2.0 sent EBS logs containing the driver authentication password, potentially disclosing this to attacke… |
CVE-2017-9277 | Medium | 4.2 | 2018-03-02 | The LDAP backend in Novell eDirectory before 9.0 SP4 when switched to EBA (Enhanced Background Authentication) kept open connections without EBA. |
CVE-2017-9276 | Medium | 5.4 | 2018-03-02 | Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into the result page using… |
CVE-2017-9267 | Medium | 6.5 | 2018-03-02 | In Novell eDirectory before 9.0.3.1 the LDAP interface was not strictly enforcing cipher restrictions allowing weaker ciphers to be used during SSL BIND operat… |
CVE-2017-7438 | Medium | 4.6 | 2018-03-02 | NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via javascript DOM modification using the supplied cookie param… |
CVE-2017-7434 | Low | 3.3 | 2018-03-02 | In the JDBC driver of NetIQ Identity Manager before 4.6 sending out incorrect XML configurations could result in passwords being logged into exception logfiles. |
CVE-2017-7429 | High | 8.8 | 2018-03-02 | The certificate upload in NetIQ eDirectory PKI plugin before 8.8.8 Patch 10 Hotfix 1 could be abused to upload JSP code which could be used by authenticated at… |
CVE-2017-7419 | Medium | 4.6 | 2018-03-02 | A OAuth application in NetIQ Access Manager 4.3 before 4.3.2 and 4.2 before 4.2.4 allowed cross site scripting attacks due to unescaped "description" field tha… |
CVE-2017-5189 | Medium | 4.3 | 2018-03-02 | NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application (JAR file) for authentication to Sentinel, allowing attackers to extract and esta… |
CVE-2017-14802 | Medium | 5.4 | 2018-03-02 | Novell Access Manager Admin Console and IDP servers before 4.3.3 have a URL that could be used by remote attackers to trigger unvalidated redirects to third pa… |
CVE-2017-14801 | Medium | 4.6 | 2018-03-02 | Reflected XSS in the NetIQ Access Manager before 4.3.3 allowed attackers to reflect back xss into the called page using the url parameter. |
CVE-2017-1787 | Medium | 4.4 | 2018-03-02 | IBM Publishing Engine 2.1.2 and 6.0.5 contains an undisclosed vulnerability that could allow a local user with administrative privileges to obtain hard coded u… |
CVE-2017-1654 | Medium | 4.0 | 2018-03-02 | IBM Spectrum Scale 4.1.1 and 4.2.0 - 4.2.3 could allow a local unprivileged user access to information located in dump files. User data could be sent to IBM du… |
CVE-2017-15130 | Medium | 5.9 | 2018-03-02 | A denial of service flaw was found in dovecot before 2.2.34. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups… |
CVE-2017-14461 | Medium | 5.9 | 2018-03-02 | A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information di… |
CVE-2017-6932 | Medium | 4.7 | 2018-03-01 | Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in v… |
CVE-2017-6931 | Medium | 6.5 | 2018-03-01 | In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the… |
CVE-2017-6930 | High | 8.1 | 2018-03-01 | In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the… |
CVE-2017-6929 | Medium | 6.1 | 2018-03-01 | A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requ… |
CVE-2017-6928 | Medium | 5.3 | 2018-03-01 | Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the us… |
CVE-2017-6927 | Medium | 6.1 | 2018-03-01 | Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially danger… |
CVE-2017-6926 | High | 8.1 | 2018-03-01 | In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are… |
CVE-2017-18212 | Critical | 9.8 | 2018-03-01 | An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_code_unit_from_hex function in lit/lit-char-helpers.c via a… |
CVE-2017-15134 | High | 7.5 | 2018-03-01 | A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled certain LDAP search… |
CVE-2017-18211 | Critical | 9.8 | 2018-03-01 | In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function saveBinaryCLProgram in magick/opencl.c because a program-lookup result… |
CVE-2017-18210 | Critical | 9.8 | 2018-03-01 | In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function BenchmarkOpenCLDevices in MagickCore/opencl.c because a memory allocat… |
CVE-2017-18209 | High | 8.8 | 2018-03-01 | In the GetOpenCLCachedFilesDirectory function in magick/opencl.c in ImageMagick 7.0.7, a NULL pointer dereference vulnerability occurs because a memory allocat… |
CVE-2017-9286 | High | 7.8 | 2018-03-01 | The packaging of NextCloud in openSUSE used /srv/www/htdocs in an unsafe manner, which could have allowed scripts running as wwwrun user to escalate privileges… |