2017 CVEs (page 38)
Page 38 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-13176 | High | 8.8 | 2018-01-12 | In the parseURL function of URLStreamHandler, there is improper input validation of the host field. This could lead to a remote elevation of privilege that cou… |
CVE-2017-0855 | High | 7.5 | 2018-01-12 | In MPEG4Extractor.cpp, there are several places where functions return early without cleaning up internal buffers which could lead to memory leaks. This could… |
CVE-2017-0846 | High | 7.5 | 2018-01-12 | An information disclosure vulnerability in the Android framework (clipboardservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. And… |
CVE-2017-18029 | Medium | 6.5 | 2018-01-12 | In ImageMagick 7.0.6-10 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allow remote attackers to cause a denial… |
CVE-2017-18028 | Medium | 6.5 | 2018-01-12 | In ImageMagick 7.0.7-1 Q16, a memory exhaustion vulnerability was found in the function ReadTIFFImage in coders/tiff.c, which allow remote attackers to cause a… |
CVE-2017-18027 | Medium | 6.5 | 2018-01-12 | In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allow remote attackers to cause a denial… |
CVE-2017-16743 | Critical | 9.8 | 2018-01-12 | An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remot… |
CVE-2017-16741 | Medium | 5.3 | 2018-01-12 | An Information Exposure issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote… |
CVE-2017-16739 | High | 7.8 | 2018-01-12 | An issue was discovered in WECON Technology LEVI Studio HMI Editor v1.8.29 and prior. Specially-crafted malicious files may be able to cause stack-based buffer… |
CVE-2017-16737 | High | 7.8 | 2018-01-12 | An issue was discovered in WECON Technology LEVI Studio HMI Editor v1.8.29 and prior. A specially-crafted malicious file may be able to cause a heap-based buff… |
CVE-2017-14030 | High | 7.8 | 2018-01-12 | An issue was discovered in Moxa MXview v2.8 and prior. The unquoted service path escalation vulnerability could allow an authorized user with file access to es… |
CVE-2017-18014 | Medium | 6.1 | 2018-01-12 | An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent X… |
CVE-2017-17970 | Critical | 9.8 | 2018-01-12 | Multiple SQL injection vulnerabilities in Muviko 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to login.php; the (2)… |
CVE-2017-16887 | Critical | 9.8 | 2018-01-12 | The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. Unauthorized Access t… |
CVE-2017-16886 | High | 8.8 | 2018-01-12 | The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to interact with the portal. Unauthorized Access t… |
CVE-2017-16885 | Critical | 9.8 | 2018-01-12 | Improper Permissions Handling in the Portal on FiberHome LM53Q1 VH519R05C01S38 devices (intended for obtaining information about Internet Usage, Changing Passw… |
CVE-2017-0869 | High | 7.8 | 2018-01-12 | NVIDIA driver contains an integer overflow vulnerability which could cause a use after free and possibly lead to an elevation of privilege enabling code execut… |
CVE-2017-2158 | Low | 3.3 | 2018-01-12 | Improper verification when expanding ZIP64 archives in Lhaplus versions 1.73 and earlier may lead to unintended contents to be extracted from a specially craft… |
CVE-2017-16864 | Medium | 6.1 | 2018-01-12 | The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS… |
CVE-2017-16862 | Medium | 4.3 | 2018-01-12 | The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-sit… |
CVE-2017-14594 | Medium | 6.1 | 2018-01-12 | The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attackers to inject arbitr… |
CVE-2017-16736 | High | 7.5 | 2018-01-12 | An Unrestricted Upload Of File With Dangerous Type issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows a remote attacker to upl… |
CVE-2017-16732 | Medium | 6.5 | 2018-01-12 | A use-after-free issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows an unauthenticated attacker to specify an arbitrary addres… |
CVE-2017-1740 | Medium | 5.4 | 2018-01-11 | IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit… |
CVE-2017-1739 | Medium | 5.4 | 2018-01-11 | IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja… |
CVE-2017-1681 | Low | 3.3 | 2018-01-11 | IBM WebSphere Application Server (IBM Liberty for Java for Bluemix 3.15) could allow a local attacker to obtain sensitive information, caused by improper handl… |
CVE-2017-1478 | Low | 3.3 | 2018-01-11 | IBM Security Access Manager Appliance 9.0.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 128613. |
CVE-2017-18016 | Medium | 5.3 | 2018-01-11 | Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via th… |
CVE-2017-15637 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable… |
CVE-2017-15636 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-time variable in the w… |
CVE-2017-15635 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the max_conn variable in the s… |
CVE-2017-15634 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the name variable in the wport… |
CVE-2017-15633 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-ipgroup variable in th… |
CVE-2017-15632 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variabl… |
CVE-2017-15631 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-workmode variable in t… |
CVE-2017-15630 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-remotesubnet variable… |
CVE-2017-15629 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-tunnelname variable in… |
CVE-2017-15628 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the lcpechointerval variable i… |
CVE-2017-15627 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-pns variable in the pp… |
CVE-2017-15626 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-bindif variable in the… |
CVE-2017-15625 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-olmode variable in the… |
CVE-2017-15624 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-authtype variable in t… |
CVE-2017-15623 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-enable variable in the… |
CVE-2017-15622 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variabl… |
CVE-2017-15621 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the olmode variable in the int… |
CVE-2017-15620 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-zone variable in the i… |
CVE-2017-15619 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable… |
CVE-2017-15618 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-enable variable in the… |
CVE-2017-15617 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the iface variable in the inte… |
CVE-2017-15616 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in… |
CVE-2017-15615 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the lcpechointerval variable i… |
CVE-2017-15614 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-outif variable in the… |
CVE-2017-15613 | High | 7.2 | 2018-01-11 | TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in… |
CVE-2017-4950 | High | 7.0 | 2018-01-11 | VMware Workstation and Fusion contain an integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may lead to an out-of-bound… |
CVE-2017-4949 | High | 7.0 | 2018-01-11 | VMware Workstation and Fusion contain a use-after-free vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may allow a guest to execute c… |
CVE-2017-9712 | High | 7.5 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, if userspace provides a too-large IE length in… |
CVE-2017-9705 | High | 7.8 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, concurrent rx notifications and read() operatio… |
CVE-2017-9689 | High | 7.8 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a specially-crafted HDMI CEC message can be use… |
CVE-2017-15850 | High | 7.5 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, userspace can read values from audio codec regi… |
CVE-2017-15848 | High | 7.8 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the fastrpc kernel driver, a buffer overflow… |
CVE-2017-15847 | High | 7.0 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the SPCom kernel driver, a race condition ex… |
CVE-2017-15845 | High | 7.8 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an invalid input of firmware size (negative val… |
CVE-2017-14879 | High | 8.8 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, by calling an IPA ioctl and searching for routi… |
CVE-2017-14873 | High | 7.8 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the pp_pgc_get_config() graphics driver func… |
CVE-2017-14870 | High | 7.5 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while updating the recovery message for eMMC de… |
CVE-2017-14869 | High | 7.5 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while performing update of FOTA partition, unin… |
CVE-2017-11081 | High | 7.8 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a potential buffer overflow vulnerabil… |
CVE-2017-11080 | High | 7.8 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a user supplied sparse image… |
CVE-2017-11079 | Critical | 9.8 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing sparse image, uninitialized he… |
CVE-2017-11066 | High | 7.5 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing ubi image an uninitialized memor… |
CVE-2017-11003 | High | 7.8 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while updating a firmware image, data is read f… |
CVE-2017-17946 | Critical | 9.8 | 2018-01-10 | A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data that is mishandled… |
CVE-2017-15849 | High | 7.8 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a LayerStack can be destroyed in between Valida… |
CVE-2017-12189 | High | 7.8 | 2018-01-10 | It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handling which could resul… |
CVE-2017-11069 | High | 7.8 | 2018-01-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, manipulation of SafeSwitch Image data can resul… |
CVE-2017-3765 | High | 7.0 | 2018-01-10 | In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "HP Backdoor" was dis… |
CVE-2017-18024 | Medium | 6.1 | 2018-01-10 | AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT element and whose value… |
CVE-2017-18023 | Medium | 6.1 | 2018-01-10 | Office Tracker 11.2.5 has XSS via the logincount parameter to the /otweb/OTPClientLogin URI. |
CVE-2017-17841 | Medium | 5.9 | 2018-01-10 | Palo Alto Networks PAN-OS 6.1, 7.1, and 8.0.x before 8.0.7, when an interface implements SSL decryption with RSA enabled or hosts a GlobalProtect portal or gat… |
CVE-2017-17662 | High | 7.5 | 2018-01-10 | Directory traversal in the HTTP server on Yawcam 0.2.6 through 0.6.0 devices allows attackers to read arbitrary files through a sequence of the form '.x./' or… |
CVE-2017-17485 | Critical | 9.8 | 2018-01-10 | FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-75… |
CVE-2017-16878 | Medium | 6.1 | 2018-01-10 | Cross-site scripting (XSS) vulnerability in the Captive Portal function in Palo Alto Networks PAN-OS before 8.0.7 allows remote attackers to inject arbitrary w… |
CVE-2017-15941 | Medium | 6.1 | 2018-01-10 | Cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.7, when the… |
CVE-2017-15665 | High | 7.5 | 2018-01-10 | In Flexense DiskBoss Enterprise 8.5.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO pac… |
CVE-2017-15664 | High | 7.5 | 2018-01-10 | In Flexense Sync Breeze Enterprise v10.1.16, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INF… |
CVE-2017-15663 | High | 7.5 | 2018-01-10 | In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO… |
CVE-2017-15662 | High | 7.5 | 2018-01-10 | In Flexense VX Search Enterprise v10.1.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO… |
CVE-2017-16514 | Medium | 6.1 | 2018-01-10 | Multiple persistent stored Cross-Site-Scripting (XSS) vulnerabilities in the files /wb/admin/admintools/tool.php (Droplet Description) and /install/index.php (… |
CVE-2017-1623 | Medium | 6.1 | 2018-01-10 | IBM QRadar 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering th… |
CVE-2017-1534 | Medium | 6.1 | 2018-01-10 | IBM Security Access Manager Appliance 8.0.0 and 9.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a… |
CVE-2017-1533 | Medium | 6.1 | 2018-01-10 | IBM Security Access Manager Appliance 9.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2017-1459 | Medium | 4.2 | 2018-01-10 | IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or m… |
CVE-2017-7559 | Medium | 6.1 | 2018-01-10 | In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and i… |
CVE-2017-7536 | High | 7.0 | 2018-01-10 | In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to acc… |
CVE-2017-12169 | High | 7.5 | 2018-01-10 | It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated att… |
CVE-2017-15717 | Medium | 6.1 | 2018-01-10 | A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref… |
CVE-2017-18026 | High | 8.8 | 2018-01-10 | Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows rem… |
CVE-2017-9796 | Medium | 5.3 | 2018-01-10 | When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL quer… |
CVE-2017-9795 | High | 7.5 | 2018-01-10 | When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL quer… |
CVE-2017-12622 | High | 7.1 | 2018-01-10 | When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the… |