2017 CVEs (page 39)
Page 39 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-1000428 | Medium | 6.1 | 2018-01-10 | flatCore-CMS 1.4.6 is vulnerable to reflected XSS in user_management.php due to the use of $_SERVER['PHP_SELF'] to build links and a stored XSS in the admin lo… |
CVE-2017-1000465 | Medium | 5.4 | 2018-01-09 | Sulu-standard version 1.6.6 is vulnerable to stored cross-site scripting vulnerability, within the page creation page, which can result in disruption of servic… |
CVE-2017-9663 | High | 7.5 | 2018-01-09 | An Cleartext Storage of Sensitive Information issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation… |
CVE-2017-16740 | Critical | 10.0 | 2018-01-09 | A Buffer Overflow issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers, Series B and C Versions 21.002 and earlier. The stack-… |
CVE-2017-15131 | High | 7.8 | 2018-01-09 | It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask pol… |
CVE-2017-15124 | High | 7.5 | 2018-01-09 | VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle… |
CVE-2017-12697 | Medium | 5.9 | 2018-01-09 | A Man-in-the-Middle issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation of this vulnerability may… |
CVE-2017-12695 | High | 8.8 | 2018-01-09 | An Improper Authentication issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation of this vulnerabil… |
CVE-2017-1000429 | Medium | 6.1 | 2018-01-09 | rui Li finecms 5.0.10 is vulnerable to a reflected XSS in the file Weixin.php. |
CVE-2017-1671 | High | 7.5 | 2018-01-09 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-craf… |
CVE-2017-1670 | Critical | 9.8 | 2018-01-09 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could a… |
CVE-2017-1668 | Medium | 6.1 | 2018-01-09 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a vi… |
CVE-2017-1666 | High | 8.1 | 2018-01-09 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker co… |
CVE-2017-1612 | High | 7.8 | 2018-01-09 | IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: 132953. |
CVE-2017-1493 | Medium | 5.4 | 2018-01-09 | IBM UrbanCode Deploy (UCD) 6.1 and 6.2 could allow an authenticated user to edit objects that they should not have access to due to improper access controls. I… |
CVE-2017-1000415 | Medium | 5.9 | 2018-01-09 | MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certificates have their ex… |
CVE-2017-15129 | Medium | 4.7 | 2018-01-09 | A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_… |
CVE-2017-18025 | Critical | 9.8 | 2018-01-09 | cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the username field… |
CVE-2017-7998 | Medium | 6.1 | 2018-01-08 | Multiple cross-site scripting (XSS) vulnerabilities in Gespage before 7.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) printer n… |
CVE-2017-7997 | Critical | 9.8 | 2018-01-08 | Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter to webap… |
CVE-2017-15883 | Critical | 9.8 | 2018-01-08 | Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial of service on load… |
CVE-2017-5971 | Critical | 9.8 | 2018-01-08 | SQL injection vulnerability in NewsBee CMS allow remote attackers to execute arbitrary SQL commands. |
CVE-2017-15913 | High | 7.8 | 2018-01-08 | The Installer in Whale allows DLL hijacking. |
CVE-2017-18022 | Medium | 6.5 | 2018-01-05 | In ImageMagick 7.0.7-12 Q16, there are memory leaks in MontageImageCommand in MagickWand/montage.c. |
CVE-2017-18021 | Critical | 9.8 | 2018-01-05 | It was discovered that QtPass before 1.2.1, when using the built-in password generator, generates possibly predictable and enumerable passwords. This only appl… |
CVE-2017-15550 | High | 8.8 | 2018-01-05 | An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Dat… |
CVE-2017-15549 | High | 8.8 | 2018-01-05 | An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Dat… |
CVE-2017-15548 | Critical | 9.8 | 2018-01-05 | An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Dat… |
CVE-2017-16666 | High | 8.8 | 2018-01-05 | Xplico before 1.2.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the name of an uploaded PCAP file. NOTE: this… |
CVE-2017-4948 | High | 7.1 | 2018-01-05 | VMware Workstation (14.x before 14.1.0 and 12.x) and Horizon View Client (4.x before 4.7.0) contain an out-of-bounds read vulnerability in TPView.dll. On Works… |
CVE-2017-4946 | High | 7.8 | 2018-01-05 | The VMware V4H and V4PA desktop agents (6.x before 6.5.1) contain a privilege escalation vulnerability. Successful exploitation of this issue could result in a… |
CVE-2017-4945 | Medium | 5.5 | 2018-01-05 | VMware Workstation (14.x and 12.x) and Fusion (10.x and 8.x) contain a guest access control vulnerability. This issue may allow program execution via Unity on… |
CVE-2017-16905 | High | 8.1 | 2018-01-05 | The DuoLingo TinyCards application before 1.0 for Android has one use of unencrypted HTTP, which allows remote attackers to spoof content, and consequently ach… |
CVE-2017-16753 | High | 7.5 | 2018-01-05 | An Improper Input Validation issue was discovered in Advantech WebAccess versions prior to 8.3. WebAccess allows some inputs that may cause the program to cras… |
CVE-2017-16728 | High | 7.5 | 2018-01-05 | An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple vulnerabilities that may allow an attack… |
CVE-2017-16724 | Critical | 9.8 | 2018-01-05 | A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple instances of a vulnerability that allows to… |
CVE-2017-16720 | Critical | 9.8 | 2018-01-05 | A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within the directory structure of the target dev… |
CVE-2017-16716 | Critical | 9.8 | 2018-01-05 | A SQL Injection issue was discovered in WebAccess versions prior to 8.3. WebAccess does not properly sanitize its inputs for SQL commands. |
CVE-2017-17867 | High | 8.8 | 2018-01-04 | Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd conf… |
CVE-2017-1727 | Medium | 4.3 | 2018-01-04 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 discloses sensitive information in error messages that could aid an attacker in further attacks against the… |
CVE-2017-1699 | Low | 3.3 | 2018-01-04 | IBM MQ Managed File Transfer Agent 8.0 and 9.0 sets insecure permissions on certain files it creates. A local attacker could exploit this vulnerability to modi… |
CVE-2017-1673 | Medium | 6.1 | 2018-01-04 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2017-1672 | High | 8.8 | 2018-01-04 | IBM Tivoli Key Lifecycle Manager 2.6 and 2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2017-1669 | Low | 3.7 | 2018-01-04 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized part… |
CVE-2017-1665 | Medium | 5.9 | 2018-01-04 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive… |
CVE-2017-1664 | Medium | 5.9 | 2018-01-04 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive… |
CVE-2017-14960 | High | 7.5 | 2018-01-04 | xDashboard in OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 has SQL Injection. |
CVE-2017-17837 | Medium | 6.1 | 2018-01-04 | The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters (b… |
CVE-2017-15714 | Critical | 9.8 | 2018-01-04 | The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through th… |
CVE-2017-5754 | Medium | 5.6 | 2018-01-04 | Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker wit… |
CVE-2017-5753 | Medium | 5.6 | 2018-01-04 | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local u… |
CVE-2017-5715 | Medium | 5.6 | 2018-01-04 | Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker wit… |
CVE-2017-8046 | Critical | 9.8 | 2018-01-04 | Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot v… |
CVE-2017-18020 | High | 8.4 | 2018-01-04 | On Samsung mobile devices with L(5.x), M(6.x), and N(7.x) software and Exynos chipsets, attackers can execute arbitrary code in the bootloader because S Boot o… |
CVE-2017-14383 | Medium | 6.1 | 2018-01-04 | In Dell EMC VNX2 versions prior to Operating Environment for File 8.1.9.217 and VNX1 versions prior to Operating Environment for File 7.1.80.8, a web server er… |
CVE-2017-18019 | High | 7.1 | 2018-01-04 | In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficiently sanitized: the user-controlled input can be used to co… |
CVE-2017-18018 | High | 7.1 | 2018-01-04 | In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" opti… |
CVE-2017-1000487 | Critical | 9.8 | 2018-01-03 | Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings. |
CVE-2017-1000486 | Critical | 9.8 | 2018-01-03 | Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution |
CVE-2017-1000485 | High | 7.8 | 2018-01-03 | Nylas Mail Lives 2.2.2 uses 0755 permissions for $HOME/.nylas-mail, which allows local users to obtain sensitive authentication information via standard filesy… |
CVE-2017-1000484 | Medium | 6.1 | 2018-01-03 | By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker c… |
CVE-2017-1000473 | High | 7.8 | 2018-01-03 | Linux Dash up to version v2 is vulnerable to multiple command injection vulnerabilities in the way module names are parsed and then executed resulting in code… |
CVE-2017-1000472 | Medium | 6.5 | 2018-01-03 | The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header… |
CVE-2017-1000471 | Critical | 9.8 | 2018-01-03 | EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in the CGI handler resulting in memory corruption or denial of service. |
CVE-2017-1000470 | High | 7.5 | 2018-01-03 | EmbedThis GoAhead Webserver versions 4.0.0 and earlier is vulnerable to an integer overflow in the HTTP listener resulting in denial of service. |
CVE-2017-1000469 | Critical | 9.8 | 2018-01-03 | Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user. |
CVE-2017-1000462 | Medium | 5.4 | 2018-01-03 | BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution o… |
CVE-2017-1000461 | Medium | 4.7 | 2018-01-03 | Brave Software's Brave Browser, version 0.19.73 (and earlier) is vulnerable to an incorrect access control issue in the "JS fingerprinting blocking" component… |
CVE-2017-1000460 | Medium | 6.5 | 2018-01-03 | In line libavcodec/h264dec.c:500 in libav(v13_dev0), ffmpeg(n3.4), chromium(56 prior Feb 13, 2017), the return value of init_get_bits is ignored and get_ue_gol… |
CVE-2017-1000483 | Medium | 6.5 | 2018-01-03 | Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method… |
CVE-2017-1000482 | Medium | 5.4 | 2018-01-03 | A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page… |
CVE-2017-1000481 | Medium | 6.1 | 2018-01-03 | When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you log… |
CVE-2017-1000480 | Critical | 9.8 | 2018-01-03 | Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template na… |
CVE-2017-1000479 | High | 8.8 | 2018-01-03 | pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the… |
CVE-2017-1000478 | Medium | 5.4 | 2018-01-03 | ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial… |
CVE-2017-1000477 | High | 7.5 | 2018-01-03 | XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result in denial of service attacks. |
CVE-2017-1000476 | Medium | 6.5 | 2018-01-03 | ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allows attackers to cause a denial of ser… |
CVE-2017-1000490 | Medium | 6.5 | 2018-01-03 | Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download an… |
CVE-2017-1000489 | High | 8.1 | 2018-01-03 | Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address |
CVE-2017-1000488 | Medium | 6.1 | 2018-01-03 | Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate th… |
CVE-2017-1000501 | Critical | 9.8 | 2018-01-03 | Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated re… |
CVE-2017-1000467 | Medium | 5.4 | 2018-01-03 | LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and… |
CVE-2017-1000499 | High | 8.8 | 2018-01-03 | phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform… |
CVE-2017-1000498 | High | 7.8 | 2018-01-03 | AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution |
CVE-2017-1000497 | Critical | 9.8 | 2018-01-03 | Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting in denial of service and possibly remote code execution |
CVE-2017-1000496 | High | 8.8 | 2018-01-03 | Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality resulting in denial of service and possibly remote execution of cod… |
CVE-2017-1000495 | Medium | 5.4 | 2018-01-03 | QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and performing unauthoris… |
CVE-2017-1000494 | High | 7.8 | 2018-01-03 | Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd < 2.0 allows an attacker to cause Denial of Service (Segmen… |
CVE-2017-18017 | Critical | 9.8 | 2018-01-03 | The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a den… |
CVE-2017-1000493 | Critical | 9.8 | 2018-01-03 | Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeover |
CVE-2017-1000492 | Medium | 6.1 | 2018-01-03 | Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration |
CVE-2017-1000491 | Medium | 6.1 | 2018-01-03 | Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration. |
CVE-2017-1000466 | Medium | 5.4 | 2018-01-03 | Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of ser… |
CVE-2017-1000463 | Medium | 5.4 | 2018-01-03 | Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within the edit blog post page, which can result in disruption of servi… |
CVE-2017-1000459 | Medium | 6.1 | 2018-01-03 | Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes |
CVE-2017-1000438 | High | 8.3 | 2018-01-02 | In OMERO 5.3.3 or earlier a user could create an OriginalFile and adjust its path such that it now points to another user's file on the underlying filesystem… |
CVE-2017-1000437 | Critical | 9.8 | 2018-01-02 | Creolabs Gravity 1.0 contains a stack based buffer overflow in the operator_string_add function, resulting in remote code execution. |
CVE-2017-1000434 | Medium | 6.1 | 2018-01-02 | Wordpress plugin Furikake version 0.1.0 is vulnerable to an Open Redirect The furikake-redirect parameter on a page allows for a redirect to an attacker contro… |
CVE-2017-1000433 | High | 8.1 | 2018-01-02 | pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing the… |
CVE-2017-1000432 | High | 8.0 | 2018-01-02 | Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access |