2017 CVEs (page 33)
Page 33 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-17162 | Medium | 5.5 | 2018-02-15 | Huawei Secospace USG6600 V500R001C30SPC100, Secospace USG6600 V500R001C30SPC200, Secospace USG6600 V500R001C30SPC300, USG9500 V500R001C30SPC100, USG9500 V500R0… |
CVE-2017-17161 | Medium | 6.8 | 2018-02-15 | The 'Find Phone' function in some Huawei smart phones with software earlier than Duke-L09C10B186 versions, earlier than Duke-L09C432B187 versions, earlier than… |
CVE-2017-17160 | Medium | 5.9 | 2018-02-15 | Huawei AR120-S V200R006C10, V200R007C00, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C02, AR1200-S V200R006C10, V200R007C00, V200R008C20, AR150 V200R… |
CVE-2017-17159 | Medium | 6.5 | 2018-02-15 | Some Huawei smart phones with software of NXT-AL10C00B386, NXT-CL00C92B386, NXT-DL00C17B386, NXT-TL00C01B386SP01, NTS-AL00C00B535 have a DoS vulnerability due… |
CVE-2017-17157 | High | 7.5 | 2018-02-15 | IKEv2 in Huawei IPS Module V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20… |
CVE-2017-17156 | High | 7.5 | 2018-02-15 | IKEv2 in Huawei IPS Module V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20… |
CVE-2017-17155 | High | 7.5 | 2018-02-15 | IKEv2 in Huawei IPS Module V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20… |
CVE-2017-17154 | High | 7.5 | 2018-02-15 | IKEv2 in Huawei IPS Module V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20… |
CVE-2017-17153 | High | 7.5 | 2018-02-15 | IKEv2 in Huawei IPS Module V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20… |
CVE-2017-17152 | Medium | 5.9 | 2018-02-15 | IKEv2 in Huawei IPS Module V500R001C00, V500R001C00SPC200, V500R001C00SPC300, V500R001C00SPC500, V500R001C00SPH303, V500R001C00SPH508, V500R001C20, V500R001C20… |
CVE-2017-17151 | Medium | 5.9 | 2018-02-15 | Huawei AR100, AR100-S, AR110-S, AR120, AR120-S, AR1200, AR1200-S, AR150, AR150-S, AR160, AR200, AR200-S, AR2200, AR2200-S, AR3200, AR510, DP300, NetEngine16EX… |
CVE-2017-15356 | Medium | 5.3 | 2018-02-15 | Huawei DP300, V500R002C00, RP200, V600R006C00, TE30, V100R001C10, V500R002C00,V600R006C00, TE40, V500R002C00, V600R006C00, TE50, V500R002C00,V600R006C00, TE60… |
CVE-2017-15355 | Medium | 5.3 | 2018-02-15 | Huawei DP300, V500R002C00, RP200, V600R006C00, TE30, V100R001C10, V500R002C00,V600R006C00, TE40, V500R002C00, V600R006C00, TE50, V500R002C00,V600R006C00, TE60… |
CVE-2017-15354 | Medium | 5.3 | 2018-02-15 | Huawei DP300, V500R002C00, RP200, V600R006C00, TE30, V100R001C10, V500R002C00,V600R006C00, TE40, V500R002C00, V600R006C00, TE50, V500R002C00,V600R006C00, TE60… |
CVE-2017-15353 | Low | 3.7 | 2018-02-15 | Huawei DP300, V500R002C00, RP200, V500R002C00, V600R006C00, RSE6500, V500R002C00, TE30, V100R001C02, V100R001C10, V500R002C00, V600R006C00, TE40, V500R002C00… |
CVE-2017-15352 | Low | 3.1 | 2018-02-15 | Huawei OceanStor 2800 V3, V300R003C00, V300R003C20, OceanStor 5300 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor 5500 V3, V300R003C00, V300R003C10, V300… |
CVE-2017-15351 | Medium | 6.8 | 2018-02-15 | The 'Find Phone' function in Huawei Honor V9 play smart phones with versions earlier than Jimmy-AL00AC00B135 has an authentication bypass vulnerability. Due to… |
CVE-2017-15350 | Medium | 5.3 | 2018-02-15 | The Common Open Policy Service Protocol (COPS) module in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20… |
CVE-2017-15349 | High | 7.5 | 2018-02-15 | Huawei CloudEngine 12800 V100R003C00, V100R005C00, V100R005C10, V100R006C00,CloudEngine 5800 V100R003C00, V100R005C00, V100R005C10, V100R006C00,CloudEngine 680… |
CVE-2017-15348 | High | 7.5 | 2018-02-15 | Huawei IPS Module V500R001C00, NGFW Module V500R001C00, NIP6300 V500R001C00, NIP6600 V500R001C00, Secospace USG6300 V500R001C00, Secospace USG6500 V500R001C00… |
CVE-2017-15347 | Medium | 5.5 | 2018-02-15 | Huawei Mate 9 Pro mobile phones with software of versions earlier than LON-AL00BC00B235 have a use after free (UAF) vulnerability. An attacker tricks a user in… |
CVE-2017-15346 | Medium | 4.7 | 2018-02-15 | XML parser in Huawei S12700 V200R005C00,S1700 V200R009C00, V200R010C00,S3700 V100R006C03, V100R006C05,S5700 V200R001C00, V200R002C00, V200R003C00, V200R003C02… |
CVE-2017-15345 | Medium | 5.3 | 2018-02-15 | Huawei Smartphones with software LON-L29DC721B186 have a denial of service vulnerability. An attacker could make an loop exit condition that cannot be reached… |
CVE-2017-15344 | High | 7.5 | 2018-02-15 | Huawei AR3200 with software V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30 has an integer… |
CVE-2017-15343 | High | 7.5 | 2018-02-15 | Huawei AR3200 with software V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30 has an integer… |
CVE-2017-15342 | High | 7.5 | 2018-02-15 | Huawei DP300 V500R002C00, TE60 V600R006C00, TP3106 V100R002C00, eSpace U1981 V200R003C30SPC100 have a denial of service vulnerability. The software does not co… |
CVE-2017-15341 | High | 7.5 | 2018-02-15 | Huawei AR3200 V200R008C20, V200R008C30, TE40 V600R006C00, TE50 V600R006C00, TE60 V600R006C00 have a denial of service vulnerability. The software decodes X.509… |
CVE-2017-15340 | Medium | 5.5 | 2018-02-15 | Huawei smartphones with software of TAG-AL00C92B168 have an information disclosure vulnerability. An attacker tricks the user to install a crafted application… |
CVE-2017-15339 | Low | 3.7 | 2018-02-15 | The SIP module in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW Module V… |
CVE-2017-15338 | Low | 3.7 | 2018-02-15 | The SIP module in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW Module V… |
CVE-2017-15337 | Low | 3.7 | 2018-02-15 | The SIP module in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW Module V… |
CVE-2017-15336 | Medium | 5.3 | 2018-02-15 | The SIP backup feature in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW… |
CVE-2017-15335 | Medium | 5.3 | 2018-02-15 | The SIP backup feature in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW… |
CVE-2017-15334 | Medium | 5.3 | 2018-02-15 | The SIP backup feature in Huawei DP300 V500R002C00, IPS Module V100R001C10, V100R001C20, V100R001C30, V500R001C00, V500R001C20, V500R001C30, V500R001C50, NGFW… |
CVE-2017-15333 | Medium | 4.7 | 2018-02-15 | XML parser in Huawei S12700 V200R005C00,S1700 V200R009C00, V200R010C00,S3700 V100R006C03, V100R006C05,S5700 V200R001C00, V200R002C00, V200R003C00, V200R003C02… |
CVE-2017-15332 | Medium | 5.3 | 2018-02-15 | Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R00… |
CVE-2017-15331 | Medium | 5.3 | 2018-02-15 | Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R00… |
CVE-2017-15330 | Medium | 5.5 | 2018-02-15 | The Flp Driver in some Huawei smartphones of the software Vicky-AL00AC00B124D, Vicky-AL00AC00B157D, Vicky-AL00AC00B167 has a double free vulnerability. An atta… |
CVE-2017-15329 | High | 8.8 | 2018-02-15 | Huawei UMA V200R001C00 has a SQL injection vulnerability in the operation and maintenance module. An attacker logs in to the system as a common user and sends… |
CVE-2017-18088 | Medium | 4.3 | 2018-02-15 | Various plugin servlet resources in Atlassian Bitbucket Server before version 5.3.7 (the fixed version for 5.3.x), from version 5.4.0 before 5.4.6 (the fixed v… |
CVE-2017-18087 | High | 7.5 | 2018-02-15 | The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0… |
CVE-2017-18189 | High | 7.5 | 2018-02-15 | In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifying zero channels triggers an infinite loop with a resultant… |
CVE-2017-12726 | High | 7.3 | 2018-02-15 | A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. Telnet on the pum… |
CVE-2017-12725 | Medium | 5.6 | 2018-02-15 | A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump with… |
CVE-2017-12724 | High | 8.1 | 2018-02-15 | A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server… |
CVE-2017-12723 | Low | 3.7 | 2018-02-15 | A Password in Configuration File issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump stor… |
CVE-2017-12722 | Medium | 5.3 | 2018-02-15 | An Out-of-bounds Read issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A third-party component… |
CVE-2017-12721 | Medium | 5.9 | 2018-02-15 | An Improper Certificate Validation issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump do… |
CVE-2017-12720 | High | 8.1 | 2018-02-15 | An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on t… |
CVE-2017-12718 | High | 8.1 | 2018-02-15 | A Classic Buffer Overflow issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A third-party compon… |
CVE-2017-13273 | High | 7.0 | 2018-02-15 | In xt_qtaguid.c, there is a race condition due to insufficient locking. This could lead to local elevation of privileges with no additional execution privilege… |
CVE-2017-18188 | Medium | 5.5 | 2018-02-14 | OpenRC opentmpfiles through 0.1.3, when the fs.protected_hardlinks sysctl is turned off, allows local users to obtain ownership of arbitrary files by creating… |
CVE-2017-6230 | High | 8.8 | 2018-02-14 | Ruckus Networks Solo APs firmware releases R110.x or before and Ruckus Networks SZ managed APs firmware releases R5.x or before contain authenticated Root Comm… |
CVE-2017-6229 | High | 8.8 | 2018-02-14 | Ruckus Networks Unleashed AP firmware releases before 200.6.10.1.x and Ruckus Networks Zone Director firmware releases 10.1.0.0.x, 9.10.2.0.x, 9.12.3.0.x, 9.13… |
CVE-2017-18187 | Critical | 9.8 | 2018-02-14 | In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an integer overflow in PSK identity parsing in the ssl_parse_client_psk_identity() functio… |
CVE-2017-1682 | Medium | 5.4 | 2018-02-14 | IBM Connections 4.0, 4.5, 5.0, 5.5, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2017-1499 | High | 8.8 | 2018-02-14 | IBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to include arbitrary files, which could allow the attacker to execute arbitrary code on t… |
CVE-2017-15699 | Medium | 6.5 | 2018-02-13 | A Denial of Service vulnerability was found in Apache Qpid Dispatch Router versions 0.7.0 and 0.8.0. To exploit this vulnerability, a remote user must be able… |
CVE-2017-1720 | Medium | 5.3 | 2018-02-13 | IBM Notes 8.5 and 9.0 could allow a local attacker to execute arbitrary commands by carefully crafting a command line sent via the shared memory IPC. IBM X-For… |
CVE-2017-1714 | High | 7.8 | 2018-02-13 | IBM Notes and Domino NSD 8.5 and 9.0 could allow an authenticated local user without administrative privileges to gain System privilege. IBM X-Force ID: 134633. |
CVE-2017-1711 | High | 7.8 | 2018-02-13 | IBM iNotes 8.5 and 9.0 SUService can be misguided into running malicious code from a DLL masquerading as a windows DLL in the temp directory. IBM X-Force ID: 1… |
CVE-2017-15709 | Low | 3.7 | 2018-02-13 | When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed… |
CVE-2017-18186 | Medium | 5.5 | 2018-02-13 | An issue was discovered in QPDF before 7.0.0. There is an infinite loop due to looping xref tables in QPDF.cc. |
CVE-2017-18185 | Medium | 5.5 | 2018-02-13 | An issue was discovered in QPDF before 7.0.0. There is a large heap-based out-of-bounds read in the Pl_Buffer::write function in Pl_Buffer.cc. It is caused by… |
CVE-2017-18184 | Medium | 5.5 | 2018-02-13 | An issue was discovered in QPDF before 7.0.0. There is a stack-based out-of-bounds read in the function iterate_rc4 in QPDF_encryption.cc. |
CVE-2017-18183 | Medium | 5.5 | 2018-02-13 | An issue was discovered in QPDF before 7.0.0. There is an infinite loop in the QPDFWriter::enqueueObject() function in libqpdf/QPDFWriter.cc. |
CVE-2017-9970 | High | 7.2 | 2018-02-12 | A remote code execution vulnerability exists in Schneider Electric's StruxureOn Gateway versions 1.1.3 and prior. Uploading a zip which contains carefully craf… |
CVE-2017-9969 | Medium | 6.7 | 2018-02-12 | An information disclosure vulnerability exists in Schneider Electric's IGSS Mobile application version 3.01 and prior. Passwords are stored in clear text in th… |
CVE-2017-9968 | Medium | 5.9 | 2018-02-12 | A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of certificate pinning… |
CVE-2017-9967 | High | 7.8 | 2018-02-12 | A security misconfiguration vulnerability exists in Schneider Electric's IGSS SCADA Software versions 12 and prior. Security configuration settings such as Add… |
CVE-2017-9963 | High | 8.1 | 2018-02-12 | A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCAD… |
CVE-2017-17725 | Medium | 6.5 | 2018-02-12 | In Exiv2 0.26, there is an integer overflow leading to a heap-based buffer over-read in the Exiv2::getULong function in types.cpp. Remote attackers can exploit… |
CVE-2017-17724 | Medium | 6.5 | 2018-02-12 | In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::IptcData::printStructure function in iptc.cpp, related to the "!= 0x1c" case. Remote attack… |
CVE-2017-17723 | High | 8.1 | 2018-02-12 | In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp. Remote attackers can exploit this vulnerability to… |
CVE-2017-17722 | Medium | 6.5 | 2018-02-12 | In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remote denial of service attack via a crafte… |
CVE-2017-13247 | High | 7.8 | 2018-02-12 | In the Pixel 2 bootloader, there is a missing permission check which bypasses carrier bootloader lock. This could lead to local elevation of privileges with us… |
CVE-2017-13246 | High | 7.5 | 2018-02-12 | A information disclosure vulnerability in the Upstream kernel network driver. Product: Android. Versions: Android kernel. ID: A-36279469. |
CVE-2017-13245 | High | 7.8 | 2018-02-12 | A elevation of privilege vulnerability in the Upstream kernel audio driver. Product: Android. Versions: Android kernel. ID: A-64315347. |
CVE-2017-13244 | High | 7.8 | 2018-02-12 | A elevation of privilege vulnerability in the Upstream kernel easel. Product: Android. Versions: Android kernel. ID: A-62678986. |
CVE-2017-13243 | High | 7.5 | 2018-02-12 | A information disclosure vulnerability in the Android system (ui). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. ID: A-38258991. |
CVE-2017-13242 | High | 7.5 | 2018-02-12 | A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-62672248. |
CVE-2017-13241 | High | 7.5 | 2018-02-12 | A information disclosure vulnerability in the Android media framework (libstagefright_soft_avcenc). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1… |
CVE-2017-13240 | High | 7.5 | 2018-02-12 | A information disclosure vulnerability in the Android framework (crypto framework). Product: Android. Versions: 8.0, 8.1. ID: A-68694819. |
CVE-2017-13239 | High | 7.5 | 2018-02-12 | A information disclosure vulnerability in the Android framework (ui framework). Product: Android. Versions: 8.0. ID: A-66244132. |
CVE-2017-13238 | Medium | 4.2 | 2018-02-12 | In XBLRamDump mode, there is a debug feature that can be used to dump memory contents, if an attacker has physical access to the device. This could lead to loc… |
CVE-2017-13236 | High | 7.8 | 2018-02-12 | In the KeyStore service, there is a permissions bypass that allows access to protected resources. This could lead to local escalation of privilege with system… |
CVE-2017-13235 | Medium | 6.5 | 2018-02-12 | A other vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-68342866. |
CVE-2017-13234 | Medium | 6.5 | 2018-02-12 | In DLSParser of the sonivox library, there is possible resource exhaustion due to a memory leak. This could lead to remote temporary denial of service with no… |
CVE-2017-13233 | Medium | 6.5 | 2018-02-12 | In ihevcd_ctb_boundary_strength_pbslice of libhevc, there is possible resource exhaustion. This could lead to a remote temporary denial of service with no addi… |
CVE-2017-13232 | High | 7.5 | 2018-02-12 | In audioserver, there is an out-of-bounds write due to a log statement using %s with an array that may not be NULL terminated. This could lead to local informa… |
CVE-2017-13231 | High | 7.8 | 2018-02-12 | In libmediadrm, there is an out-of-bounds write due to improper input validation. This could lead to local elevation of privileges with no additional execution… |
CVE-2017-13230 | High | 8.8 | 2018-02-12 | In hevc codec, there is an out-of-bounds write due to an incorrect bounds check with the i2_pic_width_in_luma_samples value. This could lead to remote escalati… |
CVE-2017-13229 | Critical | 9.8 | 2018-02-12 | A remote code execution vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-68160703. |
CVE-2017-13228 | High | 8.8 | 2018-02-12 | In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an unsigned character. This could lead to rem… |
CVE-2017-18179 | High | 8.8 | 2018-02-12 | Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a password change or a session termination. Also… |
CVE-2017-18178 | Medium | 6.1 | 2018-02-12 | Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the redirection target, if the target is spe… |
CVE-2017-18177 | Medium | 5.4 | 2018-02-12 | Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1. |
CVE-2017-18176 | Medium | 5.4 | 2018-02-12 | Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code. This is fixed in 10… |
CVE-2017-18175 | Medium | 5.4 | 2018-02-12 | Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demonstrated by the src attribute of an IMG e… |
CVE-2017-18174 | Critical | 9.8 | 2018-02-11 | In the Linux kernel before 4.7, the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading to a double free. |