2017 CVEs (page 36)
Page 36 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-1000391 | High | 7.3 | 2018-01-26 | Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearin… |
CVE-2017-1000390 | Medium | 4.3 | 2018-01-26 | Jenkins Multijob plugin version 1.25 and earlier did not check permissions in the Resume Build action, allowing anyone with Job/Read permission to resume the b… |
CVE-2017-1000389 | Medium | 6.1 | 2018-01-26 | Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. These responses had… |
CVE-2017-1000388 | Medium | 4.3 | 2018-01-26 | Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing any… |
CVE-2017-1000387 | High | 7.8 | 2018-01-26 | Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publisher.BuildPublisher… |
CVE-2017-1000386 | Medium | 5.4 | 2018-01-26 | Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on the 'Build With Pa… |
CVE-2017-3762 | High | 7.8 | 2018-01-26 | Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon credentials and fingerprint data, is encry… |
CVE-2017-15703 | Medium | 5.0 | 2018-01-25 | Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of ser… |
CVE-2017-15132 | High | 7.5 | 2018-01-25 | A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login process… |
CVE-2017-1000505 | Medium | 6.5 | 2018-01-25 | In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion featur… |
CVE-2017-15365 | High | 8.8 | 2018-01-25 | sql/event_data_objects.cc in MariaDB before 10.1.30 and 10.2.x before 10.2.10 and Percona XtraDB Cluster before 5.6.37-26.21-3 and 5.7.x before 5.7.19-29.22-3… |
CVE-2017-1000414 | High | 7.5 | 2018-01-25 | ImpulseAdventure JPEGsnoop version 1.7.5 is vulnerable to a division by zero in the JFIF decode handling resulting denial of service. |
CVE-2017-15546 | Medium | 4.3 | 2018-01-25 | The Security Console in EMC RSA Authentication Manager 8.2 SP1 P6 and earlier is affected by a blind SQL injection vulnerability. Authenticated malicious users… |
CVE-2017-1000504 | High | 8.1 | 2018-01-24 | A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. Th… |
CVE-2017-1000503 | High | 8.1 | 2018-01-24 | A race condition during Jenkins 2.81 through 2.94 (inclusive); 2.89.1 startup could result in the wrong order of execution of commands during initialization. T… |
CVE-2017-1000502 | High | 8.8 | 2018-01-24 | Users with permission to create or configure agents in Jenkins 1.37 and earlier could configure an EC2 agent to run arbitrary shell commands on the master node… |
CVE-2017-1000474 | Critical | 9.8 | 2018-01-24 | Soyket Chowdhury Vehicle Sales Management System version 2017-07-30 is vulnerable to multiple SQL Injecting in login/vehicle.php, login/profile.php, login/Acti… |
CVE-2017-15135 | High | 8.1 | 2018-01-24 | It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly during the authenti… |
CVE-2017-13696 | Critical | 9.8 | 2018-01-24 | A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, a… |
CVE-2017-12187 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbi… |
CVE-2017-12186 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute… |
CVE-2017-12185 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly ex… |
CVE-2017-12184 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or possibly execute ar… |
CVE-2017-12183 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbi… |
CVE-2017-12182 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash or possibly execute… |
CVE-2017-12181 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash or possibly execute… |
CVE-2017-12180 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to crash or possibly exec… |
CVE-2017-12179 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing malicious X client to cause X server to c… |
CVE-2017-12178 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server to crash or possibly… |
CVE-2017-12177 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X server to crash or pos… |
CVE-2017-12176 | Critical | 9.8 | 2018-01-24 | xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause X server to crash or… |
CVE-2017-1769 | High | 8.8 | 2018-01-24 | IBM Business Process Manager 8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transm… |
CVE-2017-15718 | Critical | 9.8 | 2018-01-24 | The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications. |
CVE-2017-1000475 | High | 7.8 | 2018-01-24 | FreeSSHd 1.3.1 version is vulnerable to an Unquoted Path Service allowing local users to launch processes with elevated privileges. |
CVE-2017-18075 | High | 7.8 | 2018-01-24 | crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user able to access the AF_ALG-based AEAD interface (CONFIG_C… |
CVE-2017-15697 | Critical | 9.8 | 2018-01-23 | A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to prope… |
CVE-2017-12632 | High | 7.5 | 2018-01-23 | A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to… |
CVE-2017-15531 | Critical | 9.8 | 2018-01-23 | Symantec Reporter 9.5 prior to 9.5.4.1 and 10.1 prior to 10.1.5.5 does not restrict excessive authentication attempts for management interface users. A remote… |
CVE-2017-18030 | Medium | 4.4 | 2018-01-23 | The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds arr… |
CVE-2017-17999 | Critical | 9.8 | 2018-01-23 | SQL injection vulnerability in RISE Ultimate Project Manager 1.9 allows remote attackers to execute arbitrary SQL commands via the search parameter to index.ph… |
CVE-2017-2750 | Critical | 9.8 | 2018-01-23 | Insufficient Solution DLL Signature Validation allows potential execution of arbitrary code in HP LaserJet Enterprise printers, HP PageWide Enterprise printers… |
CVE-2017-2747 | High | 7.8 | 2018-01-23 | HP has identified a potential security vulnerability before IG_11_00_00.10 for DesignJet T790, T795, T1300, T2300, before MRY_04_05_00.5 for DesignJet T920, T9… |
CVE-2017-2746 | Medium | 6.1 | 2018-01-23 | Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1. The vulnerabilities could potentially be exploited… |
CVE-2017-2745 | Medium | 6.1 | 2018-01-23 | Potential security vulnerabilities have been identified with HP JetAdvantage Security Manager before 3.0.1. The vulnerabilities could potentially be exploited… |
CVE-2017-2744 | Medium | 5.5 | 2018-01-23 | The vulnerability allows attacker to extract binaries into protected file system locations in HP Support Assistant before 12.7.26.1. |
CVE-2017-2743 | Medium | 6.1 | 2018-01-23 | HP has identified a potential security vulnerability with HP Enterprise LaserJet Printers and MFPs, HP OfficeJet Enterprise Color Printers and MFP, HP PageWide… |
CVE-2017-2742 | High | 7.5 | 2018-01-23 | A potential security vulnerability has been identified with HP Web Jetadmin before 10.4 SR2. This vulnerability could potentially be exploited to create a deni… |
CVE-2017-2741 | Critical | 9.8 | 2018-01-23 | A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmware before 1708D. This vulnerability cou… |
CVE-2017-2740 | High | 7.8 | 2018-01-23 | A potential security vulnerability has been identified with the command line shell of the HP ThinPro operating system 6.1, 5.2.1, 5.2, 5.1, 5.0, and 4.4. The v… |
CVE-2017-15107 | High | 7.5 | 2018-01-23 | A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interprete… |
CVE-2017-15105 | Medium | 5.3 | 2018-01-23 | A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record could be used to pro… |
CVE-2017-15094 | Medium | 5.9 | 2018-01-23 | An issue has been found in the DNSSEC parsing code of PowerDNS Recursor from 4.0.0 up to and including 4.0.6 leading to a memory leak when parsing specially cr… |
CVE-2017-15093 | Medium | 5.3 | 2018-01-23 | When api-config-dir is set to a non-empty value, which is not the case by default, the API in PowerDNS Recursor 4.x up to and including 4.0.6 and 3.x up to and… |
CVE-2017-15092 | Medium | 6.1 | 2018-01-23 | A cross-site scripting issue has been found in the web interface of PowerDNS Recursor from 4.0.0 up to and including 4.0.6, where the qname of DNS queries was… |
CVE-2017-15091 | High | 7.1 | 2018-01-23 | An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and including 3.4.11, where some operations… |
CVE-2017-15090 | Medium | 5.9 | 2018-01-23 | An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been… |
CVE-2017-18049 | Medium | 5.5 | 2018-01-23 | In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain macros and scripts, w… |
CVE-2017-18048 | High | 8.8 | 2018-01-23 | Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocke… |
CVE-2017-17407 | Critical | 9.8 | 2018-01-23 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager v7.2.699 build 1001. Aut… |
CVE-2017-17406 | Critical | 9.8 | 2018-01-23 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required… |
CVE-2017-16610 | Critical | 9.8 | 2018-01-23 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required… |
CVE-2017-16609 | High | 7.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Enterprise Manager. Authentication is not r… |
CVE-2017-16608 | Critical | 9.8 | 2018-01-23 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required… |
CVE-2017-16607 | High | 7.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Enterprise Manager. Authentication is not r… |
CVE-2017-16606 | High | 8.8 | 2018-01-23 | This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.73… |
CVE-2017-16605 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. A… |
CVE-2017-16604 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. A… |
CVE-2017-16603 | High | 8.8 | 2018-01-23 | This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.73… |
CVE-2017-16602 | High | 8.8 | 2018-01-23 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Alth… |
CVE-2017-16601 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to overwrite arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. A… |
CVE-2017-16600 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to overwrite files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although au… |
CVE-2017-16599 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Alth… |
CVE-2017-16598 | High | 8.8 | 2018-01-23 | This vulnerability allows remote attackers to execute code by overwriting arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2… |
CVE-2017-16597 | Critical | 9.8 | 2018-01-23 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Auth… |
CVE-2017-16596 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 10… |
CVE-2017-16595 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 10… |
CVE-2017-16594 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Alth… |
CVE-2017-16593 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Alth… |
CVE-2017-16592 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 10… |
CVE-2017-16591 | Medium | 6.5 | 2018-01-23 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 10… |
CVE-2017-16590 | High | 8.8 | 2018-01-23 | This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 1001. User… |
CVE-2017-1000417 | Medium | 5.3 | 2018-01-22 | MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs (e.g. in ExtKeyUsage extension) on X.509 certifica… |
CVE-2017-1000416 | Medium | 5.3 | 2018-01-22 | axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year (19)50 of UTCTime being misinterpreted as 2050. |
CVE-2017-17858 | High | 7.8 | 2018-01-22 | Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote attacker to potentially execute arbitrar… |
CVE-2017-18047 | Critical | 9.8 | 2018-01-22 | Buffer Overflow in the FTP client in LabF nfsAxe 3.7 allows remote FTP servers to execute arbitrary code via a long reply. |
CVE-2017-18046 | Critical | 9.8 | 2018-01-21 | Buffer overflow on Dasan GPON ONT WiFi Router H640X 12.02-01121 2.77p1-1124 and 3.03p2-1146 devices allows remote attackers to execute arbitrary code via a lon… |
CVE-2017-18045 | Critical | 9.8 | 2018-01-21 | JBMC DirectAdmin before 1.52, when the email_ftp_password_change setting is nonzero, allows remote attackers to obtain access or cause a denial of service (seg… |
CVE-2017-15112 | High | 7.8 | 2018-01-20 | keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info… |
CVE-2017-15111 | Medium | 5.5 | 2018-01-20 | keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link. |
CVE-2017-15108 | High | 7.8 | 2018-01-20 | spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session th… |
CVE-2017-14803 | Critical | 9.8 | 2018-01-20 | In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE1… |
CVE-2017-12130 | High | 7.5 | 2018-01-20 | An exploitable NULL pointer dereference vulnerability exists in the tinysvcmdns library version 2017-11-05. A specially crafted packet can make the library der… |
CVE-2017-14460 | High | 7.5 | 2018-01-19 | An exploitable overly permissive cross-domain (CORS) whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8. An automatically sent… |
CVE-2017-14457 | High | 8.2 | 2018-01-19 | An exploitable information leak/denial of service vulnerability exists in the libevm (Ethereum Virtual Machine) `create2` opcode handler of CPP-Ethereum. A spe… |
CVE-2017-12119 | High | 7.5 | 2018-01-19 | An exploitable unhandled exception vulnerability exists in multiple APIs of CPP-Ethereum JSON-RPC. Specially crafted JSON requests can cause an unhandled excep… |
CVE-2017-12118 | High | 8.1 | 2018-01-19 | An exploitable improper authorization vulnerability exists in miner_stop API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). An a… |
CVE-2017-12116 | High | 8.1 | 2018-01-19 | An exploitable improper authorization vulnerability exists in miner_setGasPrice API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768… |
CVE-2017-12113 | High | 8.1 | 2018-01-19 | An exploitable improper authorization vulnerability exists in admin_nodeInfo API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768)… |
CVE-2017-12117 | High | 8.1 | 2018-01-19 | An exploitable improper authorization vulnerability exists in miner_start API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A J… |
CVE-2017-12115 | High | 8.1 | 2018-01-19 | An exploitable improper authorization vulnerability exists in miner_setEtherbase API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c07376… |