2017 CVEs (page 30)
Page 30 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-9274 | High | 7.8 | 2018-03-01 | A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specif… |
CVE-2017-9271 | Low | 3.3 | 2018-03-01 | The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used. |
CVE-2017-9270 | High | 8.7 | 2018-03-01 | In cryptctl before version 2.0 a malicious server could send RPC requests that could overwrite files outside of the cryptctl key database. |
CVE-2017-9269 | High | 7.7 | 2018-03-01 | In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to u… |
CVE-2017-9268 | Medium | 4.4 | 2018-03-01 | In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause… |
CVE-2017-7436 | High | 8.1 | 2018-03-01 | In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious serve… |
CVE-2017-7435 | High | 8.1 | 2018-03-01 | In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious serve… |
CVE-2017-7426 | Medium | 5.4 | 2018-03-01 | The NetIQ Identity Manager Plugins before 4.6.1 contained various XML External XML Entity (XXE) handling flaws that could be used by attackers to leak informat… |
CVE-2017-5188 | Medium | 5.0 | 2018-03-01 | The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during b… |
CVE-2017-14804 | Critical | 9.9 | 2018-03-01 | The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write outside of the target… |
CVE-2017-14800 | Medium | 5.4 | 2018-03-01 | A reflected cross site scripting attack in the NetIQ Access Manager before 4.3.3 using the "typecontainerid" parameter of the policy editor could allowed code… |
CVE-2017-14799 | Medium | 4.6 | 2018-03-01 | A cross site scripting attack in handling the ESP login parameter handling in NetIQ Access Manager before 4.3.3 could be used to inject javascript code into th… |
CVE-2017-14798 | High | 7.3 | 2018-03-01 | A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root. |
CVE-2017-6154 | High | 7.5 | 2018-03-01 | On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, the BIG-IP ASM bd daemon may core dump memory under some circumstances when process… |
CVE-2017-6150 | High | 7.5 | 2018-03-01 | Under certain conditions for F5 BIG-IP systems 13.0.0 or 12.1.0 - 12.1.3.1, using FastL4 profiles, when the Reassemble IP Fragments option is disabled (default… |
CVE-2017-12627 | Critical | 9.8 | 2018-03-01 | In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer dereference under certain conditions. |
CVE-2017-18208 | Medium | 5.5 | 2018-03-01 | The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to cause a denial of service (infinite loop) by triggering u… |
CVE-2017-18207 | Medium | 6.5 | 2018-03-01 | The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial… |
CVE-2017-9447 | High | 7.5 | 2018-02-28 | In the web interface of Parallels Remote Application Server (RAS) 15.5 Build 16140, a vulnerability exists due to improper validation of the file path when req… |
CVE-2017-12191 | High | 7.4 | 2018-02-28 | A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Rem… |
CVE-2017-18206 | Critical | 9.8 | 2018-02-27 | In utils.c in zsh before 5.4, symlink expansion had a buffer overflow. |
CVE-2017-18205 | High | 8.1 | 2018-02-27 | In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if… |
CVE-2017-15136 | Low | 2.7 | 2018-02-27 | When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the hostname of a previously registered syst… |
CVE-2017-7671 | High | 7.5 | 2018-02-27 | There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the s… |
CVE-2017-5660 | High | 8.6 | 2018-02-27 | There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when in… |
CVE-2017-18204 | Medium | 5.5 | 2018-02-27 | The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users to cause a denial of service (deadlock) via DIO requests. |
CVE-2017-18203 | Medium | 4.7 | 2018-02-27 | The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to cause a denial of service (BUG) by leveraging a race… |
CVE-2017-17478 | Medium | 4.8 | 2018-02-27 | An XSS issue was discovered in Designer Studio in Pegasystems Pega Platform 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2, 7.2.1, and 7.2.2. A user with developer credentia… |
CVE-2017-16770 | Medium | 6.5 | 2018-02-27 | File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station before 8.1.2-5469 all… |
CVE-2017-16767 | Medium | 5.4 | 2018-02-27 | Cross-site scripting (XSS) vulnerability in User Profile in Synology Surveillance Station before 8.1.2-5469 allows remote authenticated users to inject arbitra… |
CVE-2017-15693 | High | 7.5 | 2018-02-27 | In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objec… |
CVE-2017-15692 | Critical | 9.8 | 2018-02-27 | In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the… |
CVE-2017-18202 | High | 7.0 | 2018-02-27 | The __oom_reap_task_mm function in mm/oom_kill.c in the Linux kernel before 4.14.4 mishandles gather operations, which allows attackers to cause a denial of se… |
CVE-2017-16814 | Medium | 5.5 | 2018-02-26 | A Directory Traversal issue was discovered in the Foxit MobilePDF app before 6.1 for iOS. This occurs by abusing the URL + escape character during a Wi-Fi tran… |
CVE-2017-16813 | Medium | 5.5 | 2018-02-26 | A denial-of-service issue was discovered in the Foxit MobilePDF app before 6.1 for iOS. This occurs when a user uploads a file that includes a hexadecimal Unic… |
CVE-2017-16229 | Medium | 5.5 | 2018-02-26 | In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the read_from_str function in sax_buf.c when a crafted input is suppli… |
CVE-2017-11635 | High | 7.5 | 2018-02-26 | An issue was discovered on Wireless IP Camera 360 devices. Attackers can read recordings by navigating to /mnt/idea0 or /mnt/idea1 on the SD memory card. |
CVE-2017-11634 | Critical | 9.8 | 2018-02-26 | An issue was discovered on Wireless IP Camera 360 devices. Remote attackers can discover a weakly encoded admin password by connecting to TCP port 9527 and rea… |
CVE-2017-11633 | High | 7.5 | 2018-02-26 | An issue was discovered on Wireless IP Camera 360 devices. Remote attackers can discover RTSP credentials by connecting to TCP port 9527 and reading the Insert… |
CVE-2017-11632 | Critical | 9.8 | 2018-02-26 | An issue was discovered on Wireless IP Camera 360 devices. A root account with a known SHA-512 password hash exists, which makes it easier for remote attackers… |
CVE-2017-18195 | Medium | 5.3 | 2018-02-26 | An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enumerate comments from all blog posts by P… |
CVE-2017-18201 | Critical | 9.8 | 2018-02-26 | An issue was discovered in GNU libcdio before 2.0.0. There is a double free in get_cdtext_generic() in lib/driver/_cdio_generic.c. |
CVE-2017-1774 | Medium | 5.3 | 2018-02-26 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 discloses sensitive information to unauthorized users. The information can be used to mount further at… |
CVE-2017-9426 | Critical | 9.8 | 2018-02-26 | ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag or facetag.listTags action. |
CVE-2017-9425 | Medium | 6.1 | 2018-02-26 | The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag action. |
CVE-2017-18200 | Medium | 5.5 | 2018-02-26 | The f2fs implementation in the Linux kernel before 4.14 mishandles reference counts associated with f2fs_wait_discard_bios calls, which allows local users to c… |
CVE-2017-15696 | High | 7.5 | 2018-02-26 | When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. Thi… |
CVE-2017-18199 | Medium | 6.5 | 2018-02-24 | realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file. |
CVE-2017-18198 | High | 8.8 | 2018-02-24 | print_iso9660_recurse in iso-info.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (heap-based buffer over-read) or possibly… |
CVE-2017-18197 | Critical | 9.8 | 2018-02-24 | In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attack… |
CVE-2017-17767 | High | 7.8 | 2018-02-23 | In all Qualcomm products with Android releases from CAF using the Linux kernel, the IL client may free a buffer OMX Video Encoder Component and then subsequent… |
CVE-2017-17765 | High | 7.8 | 2018-02-23 | In all Qualcomm products with Android releases from CAF using the Linux kernel, multiple values received from firmware are not properly validated in wma_get_ll… |
CVE-2017-17764 | High | 7.8 | 2018-02-23 | In all Qualcomm products with Android releases from CAF using the Linux kernel, the num_failure_info value from firmware is not properly validated in wma_rx_ag… |
CVE-2017-15862 | High | 7.8 | 2018-02-23 | In all Qualcomm products with Android releases from CAF using the Linux kernel, in wma_unified_link_radio_stats_event_handler(), the number of radio channels c… |
CVE-2017-15861 | High | 7.8 | 2018-02-23 | In all Qualcomm products with Android releases from CAF using the Linux kernel, in the function wma_roam_synch_event_handler, vdev_id is received from firmware… |
CVE-2017-15860 | High | 7.8 | 2018-02-23 | In all Qualcomm products with Android releases from CAF using the Linux kernel, while processing an encrypted authentication management frame, a stack buffer o… |
CVE-2017-15829 | High | 7.0 | 2018-02-23 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition exists in a GPU Driver which can potentially lead to a Use Aft… |
CVE-2017-15820 | High | 7.8 | 2018-02-23 | In all Qualcomm products with Android releases from CAF using the Linux kernel, in a KGSL IOCTL handler, a Use After Free Condition can potentially occur. |
CVE-2017-15817 | High | 7.8 | 2018-02-23 | In all Qualcomm products with Android releases from CAF using the Linux kernel, when an access point sends a challenge text greater than 128 bytes, the host dr… |
CVE-2017-15518 | High | 7.8 | 2018-02-23 | All versions of OnCommand API Services prior to 2.1 and NetApp Service Level Manager prior to 1.0RC4 log a privileged database user account password. All users… |
CVE-2017-14910 | Critical | 9.8 | 2018-02-23 | In Snapdragon Automobile, Snapdragon IoT and Snapdragon Mobile MDM9206 MDM9607, MDM9650, S820A, S820Am, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 615… |
CVE-2017-14884 | High | 7.8 | 2018-02-23 | In all Qualcomm products with Android releases from CAF using the Linux kernel, due to lack of bounds checking on the variable "data_len" from the function WLA… |
CVE-2017-16769 | Medium | 5.3 | 2018-02-23 | Exposure of private information vulnerability in Photo Viewer in Synology Photo Station 6.8.1-3458 allows remote attackers to obtain metadata from password-pro… |
CVE-2017-18196 | Low | 3.3 | 2018-02-23 | Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow loca… |
CVE-2017-5251 | High | 8.1 | 2018-02-22 | In version 1012 and prior of Insteon's Insteon Hub, the radio transmissions used for communication between the hub and connected devices are not encrypted. |
CVE-2017-5250 | Critical | 9.8 | 2018-02-22 | In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and… |
CVE-2017-5249 | Critical | 9.8 | 2018-02-22 | In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encryp… |
CVE-2017-18194 | Critical | 9.8 | 2018-02-22 | SQL injection vulnerability in users/signup.php in the "signup" component in HamayeshNegar CMS allows a remote attacker to execute arbitrary SQL commands via t… |
CVE-2017-18193 | Medium | 5.5 | 2018-02-22 | fs/f2fs/extent_cache.c in the Linux kernel before 4.13 mishandles extent trees, which allows local users to cause a denial of service (BUG) via an application… |
CVE-2017-1758 | High | 7.1 | 2018-02-21 | IBM Financial Transaction Manager for ACH Services for Multi-Platform (IBM Control Center 6.0 and 6.1, IBM Financial Transaction Manager 3.0.2, 3.0.3, 3.0.4, a… |
CVE-2017-1604 | Medium | 5.4 | 2018-02-21 | IBM Maximo Anywhere 7.5 and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al… |
CVE-2017-1462 | Medium | 5.4 | 2018-02-21 | IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2017-12161 | High | 8.8 | 2018-02-21 | It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker cou… |
CVE-2017-14993 | High | 7.5 | 2018-02-20 | OXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before 4.10.6 (maintenance), and 4.9.x before 4.9.11 (legacy), Enterprise Edition before 6… |
CVE-2017-12415 | High | 7.5 | 2018-02-20 | OXID eShop Community Edition before 6.0.0 RC2 (development), 4.10.x before 4.10.5 (maintenance), and 4.9.x before 4.9.10 (legacy), Enterprise Edition before 6… |
CVE-2017-17455 | Medium | 5.9 | 2018-02-20 | Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before 17.10.2 are vulnerable to being forced, via a man-in-the-middle attack, to interact with Ma… |
CVE-2017-17454 | Medium | 5.4 | 2018-02-20 | Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user enters invalid UTF-8… |
CVE-2017-10963 | Medium | 5.9 | 2018-02-20 | In Knox SDS IAM (Identity Access Management) and EMM (Enterprise Mobility Management) 16.11 on Samsung mobile devices, a man-in-the-middle attacker can install… |
CVE-2017-6193 | Medium | 5.5 | 2018-02-20 | Buffer overflow in APNGDis 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted image contain… |
CVE-2017-6192 | Medium | 5.5 | 2018-02-20 | Buffer overflow in APNGDis 2.8 and earlier allows a remote attackers to cause denial of service and possibly execute arbitrary code via a crafted image contain… |
CVE-2017-16356 | Medium | 6.1 | 2018-02-20 | Reflected XSS in Kubik-Rubik SIGE (aka Simple Image Gallery Extended) before 3.3.0 allows attackers to execute JavaScript in a victim's browser by having them… |
CVE-2017-18192 | High | 7.5 | 2018-02-20 | smart/calculator/gallerylock/CalculatorActivity.java in the "Photo,Video Locker-Calculator" application through 18 for Android allows attackers to access files… |
CVE-2017-16835 | High | 7.5 | 2018-02-20 | The "Photo,Video Locker-Calculator" application 12.0 for Android has android:allowBackup="true" in AndroidManifest.xml, which allows attackers to obtain sensit… |
CVE-2017-7376 | Critical | 9.8 | 2018-02-19 | Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects. |
CVE-2017-7375 | Critical | 9.8 | 2018-02-19 | A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, exte… |
CVE-2017-17101 | Critical | 9.8 | 2018-02-19 | An issue was discovered in Apexis APM-H803-MPC software, as used with many different models of IP Camera. An unprotected CGI method inside the web application… |
CVE-2017-16670 | High | 7.8 | 2018-02-19 | The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file. |
CVE-2017-18191 | High | 7.5 | 2018-02-19 | An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access… |
CVE-2017-18095 | Medium | 5.3 | 2018-02-19 | The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attackers to comment on sni… |
CVE-2017-18093 | Medium | 4.8 | 2018-02-19 | Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permiss… |
CVE-2017-18092 | Medium | 5.4 | 2018-02-19 | The print snippet resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers to inject arbitrar… |
CVE-2017-16756 | High | 8.8 | 2018-02-19 | An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.ch… |
CVE-2017-16755 | Medium | 6.1 | 2018-02-19 | An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the "return" parameter of the "index.php?p… |
CVE-2017-15712 | Medium | 6.5 | 2018-02-19 | Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user c… |
CVE-2017-16924 | Critical | 9.8 | 2018-02-19 | Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files cont… |
CVE-2017-18091 | Medium | 4.8 | 2018-02-16 | The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers w… |
CVE-2017-18090 | Medium | 6.1 | 2018-02-16 | Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary H… |
CVE-2017-18089 | Medium | 5.4 | 2018-02-16 | The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allows remote attackers to inject arbitrary… |
CVE-2017-18190 | High | 7.5 | 2018-02-16 | A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by… |
CVE-2017-14537 | Medium | 6.5 | 2018-02-16 | trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php. |