2017 CVEs (page 34)
Page 34 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-1000510 | Medium | 5.4 | 2018-02-09 | Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript code. |
CVE-2017-1000509 | Medium | 5.4 | 2018-02-09 | Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code. |
CVE-2017-1000508 | Medium | 6.1 | 2018-02-09 | Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that can result in execution of javascript code… |
CVE-2017-1000507 | Medium | 5.4 | 2018-02-09 | Canvs Canvas version 3.4.2 contains a Cross Site Scripting (XSS) vulnerability in User's details that can result in denial of service and execution of javascri… |
CVE-2017-1000506 | Medium | 6.1 | 2018-02-09 | Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of j… |
CVE-2017-0911 | Medium | 5.4 | 2018-02-09 | Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the "Login with Twitter" component allowing an attacker to provide a… |
CVE-2017-10690 | Medium | 6.5 | 2018-02-09 | In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was… |
CVE-2017-10689 | Medium | 5.5 | 2018-02-09 | In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this… |
CVE-2017-1761 | Medium | 6.1 | 2018-02-09 | IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2017-15914 | High | 8.8 | 2018-02-08 | Incorrect implementation of access controls allows remote users to override repository restrictions in Borg servers 1.1.x before 1.1.3. |
CVE-2017-6227 | Medium | 6.5 | 2018-02-08 | A vulnerability in the IPv6 stack on Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions before 7.4.2b, 8.1.2 and 8.2.0 could allow an… |
CVE-2017-6225 | Medium | 6.1 | 2018-02-08 | Cross-site scripting (XSS) vulnerability in the web-based management interface of Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) versions b… |
CVE-2017-17659 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17658 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17657 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17656 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17655 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17654 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17653 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17652 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17425 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17424 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17423 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17422 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17421 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17420 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17419 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17418 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17417 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17416 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17415 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17414 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17413 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-17412 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.3.0.12. Authentication is not requ… |
CVE-2017-7351 | High | 8.8 | 2018-02-08 | A SQL injection issue exists in a file upload handler in REDCap 7.x before 7.0.11 via a trailing substring to SendITController:upload. |
CVE-2017-5133 | High | 8.8 | 2018-02-07 | Off-by-one read/write on the heap in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to corrupt memory and possibly leak information and… |
CVE-2017-5132 | High | 8.8 | 2018-02-07 | Inappropriate implementation in V8 in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2017-5131 | High | 8.8 | 2018-02-07 | An integer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, ak… |
CVE-2017-5130 | High | 8.8 | 2018-02-07 | An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to pot… |
CVE-2017-5129 | High | 8.8 | 2018-02-07 | A use after free in WebAudio in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HT… |
CVE-2017-5128 | High | 8.8 | 2018-02-07 | Heap buffer overflow in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2017-5127 | High | 8.8 | 2018-02-07 | Use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2017-5126 | High | 8.8 | 2018-02-07 | A use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2017-5125 | High | 8.8 | 2018-02-07 | Heap buffer overflow in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2017-5124 | Medium | 6.1 | 2018-02-07 | Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a… |
CVE-2017-15400 | High | 7.8 | 2018-02-07 | Insufficient restriction of IPP filters in CUPS in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker to execute a command with the same privileg… |
CVE-2017-15397 | High | 7.4 | 2018-02-07 | Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network position to observe or ta… |
CVE-2017-15395 | Medium | 6.5 | 2018-02-07 | A use after free in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka… |
CVE-2017-15394 | Medium | 6.5 | 2018-02-07 | Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing in permission dialogs… |
CVE-2017-15393 | High | 8.8 | 2018-02-07 | Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugg… |
CVE-2017-15392 | Medium | 4.3 | 2018-02-07 | Insufficient data validation in V8 in Google Chrome prior to 62.0.3202.62 allowed an attacker who can write to the Windows Registry to potentially exploit heap… |
CVE-2017-15391 | Medium | 6.5 | 2018-02-07 | Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to access Extension pages without authorisation… |
CVE-2017-15390 | Medium | 6.5 | 2018-02-07 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing via IDN homographs in a… |
CVE-2017-15389 | Medium | 6.5 | 2018-02-07 | An insufficient watchdog timer in navigation in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) vi… |
CVE-2017-15388 | High | 8.8 | 2018-02-07 | Iteration through non-finite points in Skia in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds memory read via a craf… |
CVE-2017-15387 | High | 8.8 | 2018-02-07 | Insufficient enforcement of Content Security Policy in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to open javascript: URL windows w… |
CVE-2017-15386 | Medium | 6.5 | 2018-02-07 | Incorrect implementation in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted… |
CVE-2017-1785 | Medium | 4.3 | 2018-02-07 | IBM API Connect 5.0.7 and 5.0.8 could allow an authenticated remote user to modify query parameters to obtain sensitive information. IBM X-Force ID: 136859. |
CVE-2017-17552 | High | 8.8 | 2018-02-07 | /LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a byp… |
CVE-2017-1692 | High | 7.8 | 2018-02-07 | IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. IBM X-Force… |
CVE-2017-12473 | High | 7.5 | 2018-02-07 | ccnl_ccntlv_bytes2pkt in CCN-lite allows context-dependent attackers to cause a denial of service (application crash) via vectors involving packets with "wrong… |
CVE-2017-12472 | Critical | 9.8 | 2018-02-07 | ccnl-ext-mgmt.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging missing NULL pointer checks after ccnl_mall… |
CVE-2017-12471 | Critical | 9.8 | 2018-02-07 | The cnb_parse_lev function in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging failure to check for out-of-boun… |
CVE-2017-12470 | Critical | 9.8 | 2018-02-07 | Integer overflow in the ndn_parse_sequence function in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact via vectors involving… |
CVE-2017-12469 | Critical | 9.8 | 2018-02-07 | Buffer overflow in util/ccnl-common.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact by leveraging incorrect memory allo… |
CVE-2017-12468 | Critical | 9.8 | 2018-02-07 | Buffer overflow in ccn-lite-ccnb2xml.c in CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact via vectors involving the vallen a… |
CVE-2017-12467 | High | 7.5 | 2018-02-07 | Memory leak in CCN-lite before 2.00 allows context-dependent attackers to cause a denial of service (memory consumption) by leveraging failure to allocate memo… |
CVE-2017-12466 | Critical | 9.8 | 2018-02-07 | CCN-lite before 2.00 allows context-dependent attackers to have unspecified impact via vectors related to ssl_halen when running ccn-lite-sim, which trigger an… |
CVE-2017-12465 | Critical | 9.8 | 2018-02-07 | Multiple integer overflows in CCN-lite before 2.00 allow context-dependent attackers to have unspecified impact via vectors involving the (1) vallen variable i… |
CVE-2017-12464 | High | 7.5 | 2018-02-07 | ccn-lite-valid.c in CCN-lite before 2.00 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via vectors involving the k… |
CVE-2017-12463 | High | 7.5 | 2018-02-07 | Memory leak in the ccnl_app_RX function in ccnl-uapi.c in CCN-lite before 2.00 allows context-dependent attackers to cause a denial of service (memory consumpt… |
CVE-2017-12412 | High | 7.8 | 2018-02-07 | ccn-lite-ccnb2xml in CCN-lite before 2.0.0 allows context-dependent attackers to have unspecified impact via a crafted file, which triggers infinite recursion… |
CVE-2017-17482 | High | 7.8 | 2018-02-07 | An issue was discovered in OpenVMS through V8.4-2L2 on Alpha and through V8.4-2L1 on IA64, and VAX/VMS 4.0 and later. A malformed DCL command table may result… |
CVE-2017-17663 | Critical | 9.8 | 2018-02-06 | The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited remotely to perform co… |
CVE-2017-6201 | High | 8.1 | 2018-02-06 | A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203. A remote attacker may exploit this issue by prov… |
CVE-2017-6200 | Medium | 6.5 | 2018-02-06 | Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the… |
CVE-2017-6199 | Critical | 9.8 | 2018-02-06 | A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field. |
CVE-2017-6198 | Medium | 6.5 | 2018-02-06 | The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to cause a denial of service by launching a… |
CVE-2017-17996 | High | 8.8 | 2018-02-06 | A buffer overflow vulnerability in "Add command" functionality exists in Flexense SyncBreeze Enterprise <= 10.3.14. The vulnerability can be triggered by an au… |
CVE-2017-7525 | Critical | 9.8 | 2018-02-06 | A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform… |
CVE-2017-15095 | Critical | 9.8 | 2018-02-06 | A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code ex… |
CVE-2017-6279 | High | 7.8 | 2018-02-06 | NVIDIA libnvmmlite_audio.so contains an elevation of privilege vulnerability when running in media server which may cause an out of bounds write and could lead… |
CVE-2017-6258 | High | 7.8 | 2018-02-06 | NVIDIA libnvmmlite_audio.so contains an elevation of privilege vulnerability when running in media server which may cause an out of bounds write and could lead… |
CVE-2017-6169 | Medium | 6.8 | 2018-02-06 | In versions 13.0.0, 12.0.0-12.1.3, or 11.6.0-11.6.2, an F5 BIG-IP virtual server using the URL categorization feature may cause the Traffic Management Microker… |
CVE-2017-9414 | High | 8.8 | 2018-02-05 | Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the authentication of u… |
CVE-2017-15536 | High | 8.8 | 2018-02-05 | An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.x before 1.2.0. Several web application vulnerabilities allow malicious authenticated users… |
CVE-2017-8783 | Medium | 5.4 | 2018-02-04 | Synacor Zimbra Collaboration Suite (ZCS) before 8.7.10 has Persistent XSS. |
CVE-2017-17703 | Medium | 6.1 | 2018-02-04 | Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Persistent XSS. |
CVE-2017-18123 | High | 8.6 | 2018-02-03 | The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerabi… |
CVE-2017-17108 | Critical | 9.8 | 2018-02-03 | Path traversal vulnerability in the administrative panel in KonaKart eCommerce Platform version 8.7 and earlier could allow an attacker to download system file… |
CVE-2017-5727 | High | 7.8 | 2018-02-02 | Pointer dereference in subsystem in Intel Graphics Driver 15.40.x.x, 15.45.x.x, 15.46.x.x allows unprivileged user to elevate privileges via local access. |
CVE-2017-18122 | High | 8.1 | 2018-02-02 | A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any u… |
CVE-2017-18121 | Medium | 6.1 | 2018-02-02 | The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute… |
CVE-2017-18086 | Medium | 6.1 | 2018-02-02 | Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting… |
CVE-2017-18085 | Medium | 6.1 | 2018-02-02 | The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cros… |
CVE-2017-18084 | Medium | 4.8 | 2018-02-02 | The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scr… |
CVE-2017-18083 | Medium | 5.4 | 2018-02-02 | The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scr… |
CVE-2017-18082 | Medium | 5.4 | 2018-02-02 | The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site s… |
CVE-2017-18081 | Medium | 6.1 | 2018-02-02 | The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS… |
CVE-2017-18080 | High | 8.8 | 2018-02-02 | The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross-site request forger… |