2017 CVEs (page 35)
Page 35 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-18042 | High | 8.8 | 2018-02-02 | The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-si… |
CVE-2017-18041 | Medium | 5.4 | 2018-02-02 | The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via… |
CVE-2017-18040 | Medium | 5.4 | 2018-02-02 | The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross s… |
CVE-2017-18039 | Medium | 6.1 | 2018-02-02 | The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML or JavaScript via a… |
CVE-2017-18038 | Medium | 5.3 | 2018-02-02 | The repository settings resource in Atlassian Bitbucket Server before version 5.6.0 allows remote attackers to read the first line of arbitrary files via a pat… |
CVE-2017-18037 | Medium | 6.5 | 2018-02-02 | The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from version 5.0.0 before… |
CVE-2017-18036 | Medium | 4.3 | 2018-02-02 | The Github repository importer in Atlassian Bitbucket Server before version 5.3.0 allows remote attackers to determine if a service they could not otherwise re… |
CVE-2017-18035 | Medium | 4.3 | 2018-02-02 | The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permis… |
CVE-2017-18034 | Medium | 5.4 | 2018-02-02 | The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed… |
CVE-2017-14180 | High | 7.8 | 2018-02-02 | Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an atta… |
CVE-2017-14179 | High | 7.8 | 2018-02-02 | Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker cou… |
CVE-2017-14178 | High | 7.5 | 2018-02-02 | In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileged, unauthenticated… |
CVE-2017-14177 | High | 7.8 | 2018-02-02 | Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could lev… |
CVE-2017-18120 | High | 7.8 | 2018-02-02 | A double-free bug in the read_gif function in gifread.c in gifsicle 1.90 allows a remote attacker to cause a denial-of-service attack or unspecified other impa… |
CVE-2017-2297 | High | 7.5 | 2018-02-01 | Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. This issue has been… |
CVE-2017-2296 | Medium | 6.5 | 2018-02-01 | In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role di… |
CVE-2017-2293 | Medium | 4.9 | 2018-02-01 | Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove arbi… |
CVE-2017-3160 | High | 7.4 | 2018-02-01 | After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the firs… |
CVE-2017-16861 | Critical | 9.8 | 2018-02-01 | It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the… |
CVE-2017-1000409 | High | 7.0 | 2018-02-01 | A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many ve… |
CVE-2017-1000408 | High | 7.8 | 2018-02-01 | A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many vers… |
CVE-2017-16914 | Medium | 5.9 | 2018-01-31 | The "stub_send_ret_submit()" function (drivers/usb/usbip/stub_tx.c) in the Linux Kernel before version 4.14.8, 4.9.71, 4.1.49, and 4.4.107 allows attackers to… |
CVE-2017-16913 | Medium | 5.9 | 2018-01-31 | The "stub_recv_cmd_submit()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 when handling CMD_SUBMIT pac… |
CVE-2017-16912 | Medium | 5.9 | 2018-01-31 | The "get_pipe()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 allows attackers to cause a denial of se… |
CVE-2017-16911 | Medium | 4.7 | 2018-01-31 | The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to disclose kernel memory addresses. Successful exploit… |
CVE-2017-18043 | Medium | 5.5 | 2018-01-31 | Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of service (Qemu process crash). |
CVE-2017-16945 | High | 7.8 | 2018-01-31 | The standardrestorer binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privileges via a crafted… |
CVE-2017-16928 | High | 7.8 | 2018-01-31 | The arq_updater binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently gain root privileges via a crafted updat… |
CVE-2017-15656 | High | 8.8 | 2018-01-31 | Password are stored in plaintext in nvram in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt. |
CVE-2017-15655 | Critical | 9.6 | 2018-01-31 | Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version <=3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but thi… |
CVE-2017-15654 | High | 8.3 | 2018-01-31 | Highly predictable session tokens in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt allow gaining administrative router access. |
CVE-2017-15653 | High | 8.8 | 2018-01-31 | Improper administrator IP validation after his login in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt allows an unauthorized u… |
CVE-2017-8916 | High | 7.8 | 2018-01-31 | In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a… |
CVE-2017-1773 | Medium | 4.0 | 2018-01-31 | IBM DataPower Gateways 7.1, 7,2, 7.5, and 7.6 could allow an attacker using man-in-the-middle techniques to spoof DNS responses to perform DNS cache poisoning… |
CVE-2017-1233 | Medium | 6.7 | 2018-01-31 | IBM Remote Control v9 could allow a local user to use the component to replace files to which he does not have write access and which he can cause to be execut… |
CVE-2017-16858 | Medium | 6.8 | 2018-01-31 | The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker t… |
CVE-2017-15706 | Medium | 5.3 | 2018-01-31 | As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an u… |
CVE-2017-15698 | Medium | 5.9 | 2018-01-31 | When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fiel… |
CVE-2017-1000411 | High | 7.5 | 2018-01-31 | OpenFlow Plugin and OpenDayLight Controller versions Nitrogen, Carbon, Boron, Robert Varga, Anil Vishnoi contain a flaw when multiple 'expired' flows take up t… |
CVE-2017-1000141 | Medium | 6.5 | 2018-01-30 | An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user's ability to maintain their own account (changing u… |
CVE-2017-1731 | High | 8.8 | 2018-01-30 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security when using the Administrative Console. An authenticated rem… |
CVE-2017-17969 | High | 7.8 | 2018-01-30 | Heap-based buffer overflow in the NCompress::NShrink::CDecoder::CodeReal method in 7-Zip before 18.00 and p7zip allows remote attackers to cause a denial of se… |
CVE-2017-9513 | Medium | 5.4 | 2018-01-29 | Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & re… |
CVE-2017-15133 | High | 7.5 | 2018-01-29 | A denial of service flaw was found in miekg-dns before 1.0.4. A remote attacker could use carefully timed TCP packets to block the DNS server from accepting ne… |
CVE-2017-12626 | High | 7.5 | 2018-01-29 | Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI… |
CVE-2017-1000356 | High | 8.8 | 2018-01-29 | Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication realm: create an acc… |
CVE-2017-1000355 | Medium | 6.5 | 2018-01-29 | Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void. |
CVE-2017-1000354 | High | 8.8 | 2018-01-29 | Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkins user. The `login`… |
CVE-2017-1000353 | Critical | 9.8 | 2018-01-29 | Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code… |
CVE-2017-4951 | High | 8.8 | 2018-01-29 | VMware AirWatch Console (9.2.x before 9.2.2 and 9.1.x before 9.1.5) contains a Cross Site Request Forgery vulnerability when accessing the App Catalog. An atta… |
CVE-2017-4947 | Critical | 9.8 | 2018-01-29 | VMware vRealize Automation (7.3 and 7.2) and vSphere Integrated Containers (1.x before 1.3) contain a deserialization vulnerability via Xenon. Successful explo… |
CVE-2017-1784 | Medium | 5.5 | 2018-01-29 | IBM Cognos Analytics 11.0 could produce results in temporary files that contain highly sensitive information that can be read by a local user. IBM X-Force ID… |
CVE-2017-1783 | Medium | 4.0 | 2018-01-29 | IBM Cognos Analytics 11.0 could allow a local user to change parameters set from the Cognos Analytics menus without proper authentication. IBM X-Force ID: 1368… |
CVE-2017-1779 | High | 7.8 | 2018-01-29 | IBM Cognos Analytics 11.0 could store cached credentials locally that could be obtained by a local user. IBM X-Force ID: 136824. |
CVE-2017-14699 | Medium | 6.5 | 2018-01-29 | Multiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_… |
CVE-2017-14698 | Critical | 9.8 | 2018-01-29 | ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N… |
CVE-2017-14190 | Medium | 6.1 | 2018-01-29 | A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTM… |
CVE-2017-18079 | High | 7.8 | 2018-01-29 | drivers/input/serio/i8042.c in the Linux kernel before 4.12.4 allows attackers to cause a denial of service (NULL pointer dereference and system crash) or poss… |
CVE-2017-18078 | High | 7.8 | 2018-01-29 | systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned… |
CVE-2017-18077 | High | 7.5 | 2018-01-27 | index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containin… |
CVE-2017-1653 | Medium | 5.4 | 2018-01-26 | IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 6.0.x) is vulnerable to cross-site scripting. This vulnerability allows users to embed arb… |
CVE-2017-1567 | Medium | 5.4 | 2018-01-26 | IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2017-1563 | Medium | 5.4 | 2018-01-26 | IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2017-1545 | Medium | 6.8 | 2018-01-26 | IBM Doors Web Access 9.5 and 9.6 could allow an attacker with physical access to the system to log into the application using previously stored credentials. IB… |
CVE-2017-1540 | Medium | 5.4 | 2018-01-26 | IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2017-1532 | Medium | 5.4 | 2018-01-26 | IBM DOORS 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the… |
CVE-2017-1516 | Medium | 5.4 | 2018-01-26 | IBM Doors Web Access 9.5 and 9.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web sit… |
CVE-2017-1515 | Medium | 4.3 | 2018-01-26 | IBM Doors Web Access 9.5 and 9.6 could allow an authenticated user to obtain sensitive information from HTTP internal server error responses. IBM X-Force ID: 1… |
CVE-2017-1506 | Medium | 6.1 | 2018-01-26 | IBM Cognos TM1 10.2 and 10.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt… |
CVE-2017-1279 | Medium | 6.5 | 2018-01-26 | IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-cra… |
CVE-2017-1204 | Critical | 9.8 | 2018-01-26 | IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 contains hard-coded credentials. A remote attacker could exploit this vulnerability to gain access to the s… |
CVE-2017-17976 | Critical | 9.8 | 2018-01-26 | In Utilities.php in Perfex CRM 1.9.7, Unrestricted file upload can lead to remote code execution. |
CVE-2017-14523 | High | 7.5 | 2018-01-26 | WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitatio… |
CVE-2017-14522 | Medium | 6.1 | 2018-01-26 | In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this i… |
CVE-2017-14521 | High | 8.8 | 2018-01-26 | In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload. |
CVE-2017-12380 | High | 7.5 | 2018-01-26 | ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (… |
CVE-2017-12379 | Critical | 9.8 | 2018-01-26 | ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (… |
CVE-2017-12378 | Medium | 5.5 | 2018-01-26 | ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (… |
CVE-2017-12377 | Critical | 9.8 | 2018-01-26 | ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (… |
CVE-2017-12376 | High | 7.8 | 2018-01-26 | ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (… |
CVE-2017-12375 | High | 7.5 | 2018-01-26 | The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of servi… |
CVE-2017-12374 | High | 7.5 | 2018-01-26 | The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of servi… |
CVE-2017-3768 | High | 7.5 | 2018-01-26 | An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for Lenovo System x and ea… |
CVE-2017-18076 | High | 7.5 | 2018-01-26 | In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the se… |
CVE-2017-2166 | Medium | 6.1 | 2018-01-26 | Open redirect vulnerability in GroupSession version 4.7.0 and earlier allows an attacker to redirect users to arbitrary web sites and conduct phishing attacks… |
CVE-2017-14593 | High | 8.8 | 2018-01-26 | Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a rep… |
CVE-2017-14592 | High | 8.8 | 2018-01-26 | Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repos… |
CVE-2017-1000404 | Medium | 6.1 | 2018-01-26 | The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScript, resulting in a… |
CVE-2017-1000403 | High | 8.8 | 2018-01-26 | Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVM, effectively eleva… |
CVE-2017-1000402 | Medium | 5.9 | 2018-01-26 | Jenkins Swarm Plugin Client 3.4 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified… |
CVE-2017-1000401 | Low | 2.2 | 2018-01-26 | The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API ke… |
CVE-2017-1000400 | Medium | 4.3 | 2018-01-26 | The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream projects. This included… |
CVE-2017-1000399 | Medium | 4.3 | 2018-01-26 | The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /queue/item/(ID)/api showed information about tasks in the queue (typically builds waiting to st… |
CVE-2017-1000398 | Medium | 4.3 | 2018-01-26 | The remote API in Jenkins 2.73.1 and earlier, 2.83 and earlier at /computer/(agent-name)/api showed information about tasks (typically builds) currently runnin… |
CVE-2017-1000397 | Medium | 5.9 | 2018-01-26 | Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL ce… |
CVE-2017-1000396 | Medium | 5.9 | 2018-01-26 | Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified… |
CVE-2017-1000395 | Medium | 4.3 | 2018-01-26 | Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with Overall/Read permissi… |
CVE-2017-1000394 | High | 7.5 | 2018-01-26 | Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-fileupload library with the denial-of-service vulnerability known as CVE-2016-309… |
CVE-2017-1000393 | High | 8.8 | 2018-01-26 | Jenkins 2.73.1 and earlier, 2.83 and earlier users with permission to create or configure agents in Jenkins could configure a launch method called 'Launch agen… |
CVE-2017-1000392 | Medium | 4.8 | 2018-01-26 | Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnera… |