2017 CVEs (page 42)
Page 42 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-17832 | Medium | 5.4 | 2017-12-27 | ServersCheck Monitoring Software before 14.2.3 is prone to a cross-site scripting vulnerability as user supplied-data is not validated/sanitized when passed in… |
CVE-2017-17010 | High | 7.8 | 2017-12-27 | Untrusted search path vulnerability in Content Manager Assistant for PlayStation version 3.55.7671.0901 and earlier allows an attacker to gain privileges via a… |
CVE-2017-16996 | High | 7.8 | 2017-12-27 | kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other… |
CVE-2017-16995 | High | 7.8 | 2017-12-27 | The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possi… |
CVE-2017-1698 | Medium | 5.3 | 2017-12-27 | IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 could reveal sensitive information from an error message that could lead to further attacks against the system. IBM… |
CVE-2017-16897 | High | 8.1 | 2017-12-27 | A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate… |
CVE-2017-1365 | Medium | 5.4 | 2017-12-27 | IBM Team Concert (RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0) is vulnerable to cross-site scripting. This vulnerability a… |
CVE-2017-1191 | Medium | 4.3 | 2017-12-27 | An undisclosed vulnerability in CLM applications (including IBM Rational Collaborative Lifecycle Management 4.0, 5.0, and 6.0) with potential for failure to re… |
CVE-2017-12741 | High | 7.5 | 2017-12-26 | Specially crafted packets sent to port 161/udp could cause a denial of service condition. The affected devices must be restarted manually. |
CVE-2017-12740 | Medium | 5.9 | 2017-12-26 | Siemens LOGO! Soft Comfort (All versions before V8.2) lacks integrity verification of software packages downloaded via an unprotected communication channel. Th… |
CVE-2017-12736 | High | 8.8 | 2017-12-26 | After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain conditions. This could allow an atta… |
CVE-2017-13903 | High | 7.5 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2.1 is affected. tvOS before 11.2.1 is affected. The issue involves the "HomeKit" component. I… |
CVE-2017-13883 | High | 7.8 | 2017-12-25 | An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Intel Graphics Driver" component. It allows attack… |
CVE-2017-13879 | High | 7.8 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. The issue involves the "IOMobileFrameBuffer" component. It allows attackers to… |
CVE-2017-13878 | High | 7.1 | 2017-12-25 | An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Intel Graphics Driver" component. It allows local… |
CVE-2017-13876 | High | 7.8 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before… |
CVE-2017-13875 | High | 7.8 | 2017-12-25 | An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Intel Graphics Driver" component. It allows attack… |
CVE-2017-13874 | High | 7.5 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. The issue involves the "Mail" component. It might allow remote attackers to byp… |
CVE-2017-13871 | High | 7.5 | 2017-12-25 | An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Mail" component. It allows remote attackers to rea… |
CVE-2017-13870 | High | 8.8 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTu… |
CVE-2017-13869 | Medium | 5.5 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before… |
CVE-2017-13868 | Medium | 5.5 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before… |
CVE-2017-13867 | High | 7.8 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before… |
CVE-2017-13866 | High | 8.8 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTu… |
CVE-2017-13865 | Medium | 5.5 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before… |
CVE-2017-13864 | Medium | 5.9 | 2017-12-25 | An issue was discovered in certain Apple products. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. The issue involves th… |
CVE-2017-13862 | High | 7.8 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before… |
CVE-2017-13861 | High | 7.8 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involve… |
CVE-2017-13860 | Medium | 5.9 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. The issue involves the "Mail Drafts" componen… |
CVE-2017-13858 | High | 7.8 | 2017-12-25 | An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "IOKit" component. It allows attackers to execute a… |
CVE-2017-13856 | High | 8.8 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTu… |
CVE-2017-13855 | Medium | 5.5 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before… |
CVE-2017-13848 | High | 7.8 | 2017-12-25 | An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "IOKit" component. It allows attackers to execute a… |
CVE-2017-13847 | High | 7.8 | 2017-12-25 | An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. The issue involves the "IOKit" component. It… |
CVE-2017-14022 | High | 7.5 | 2017-12-23 | An Improper Input Validation issue was discovered in Rockwell Automation FactoryTalk Alarms and Events, Version 2.90 and earlier. An unauthenticated attacker w… |
CVE-2017-15328 | High | 7.5 | 2017-12-22 | Huawei HG8245H version earlier than V300R018C00SPC110 has an authentication bypass vulnerability. An attacker can access a specific URL of the affect product… |
CVE-2017-15324 | High | 7.5 | 2017-12-22 | Huawei S5700 and S6700 with software of V200R005C00 have a DoS vulnerability due to insufficient validation of the Network Quality Analysis (NQA) packets. A re… |
CVE-2017-15322 | Medium | 6.5 | 2017-12-22 | Some Huawei smartphones with software of BGO-L03C158B003CUSTC158D001 and BGO-L03C331B009CUSTC331D001 have a DoS vulnerability due to insufficient input validat… |
CVE-2017-15321 | Low | 3.7 | 2017-12-22 | Huawei FusionSphere OpenStack V100R006C000SPC102 (NFV) has an information leak vulnerability due to the use of a low version transmission protocol by default… |
CVE-2017-15320 | High | 7.5 | 2017-12-22 | RP200 V500R002C00, V600R006C00; TE30 V100R001C10, V500R002C00, V600R006C00; TE40 V500R002C00, V600R006C00; TE50 V500R002C00, V600R006C00; TE60 V100R001C10, V50… |
CVE-2017-15319 | High | 7.5 | 2017-12-22 | RP200 V500R002C00, V600R006C00; TE30 V100R001C10, V500R002C00, V600R006C00; TE40 V500R002C00, V600R006C00; TE50 V500R002C00, V600R006C00; TE60 V100R001C10, V50… |
CVE-2017-15318 | High | 7.5 | 2017-12-22 | RP200 V500R002C00, V600R006C00; TE30 V100R001C10, V500R002C00, V600R006C00; TE40 V500R002C00, V600R006C00; TE50 V500R002C00, V600R006C00; TE60 V100R001C10, V50… |
CVE-2017-15317 | High | 7.5 | 2017-12-22 | AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30; AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30; A… |
CVE-2017-15316 | High | 7.8 | 2017-12-22 | The GPU driver of Mate 9 Huawei smart phones with software before MHA-AL00B 8.0.0.334(C00) and Mate 9 Pro Huawei smart phones with software before LON-AL00B 8… |
CVE-2017-15313 | High | 8.8 | 2017-12-22 | Huawei SmartCare V200R003C10 has a CSV injection vulnerability. An remote authenticated attacker could inject malicious CSV expression to the affected device. |
CVE-2017-15312 | Medium | 5.4 | 2017-12-22 | Huawei SmartCare V200R003C10 has a stored XSS (cross-site scripting) vulnerability in the dashboard module. A remote authenticated attacker could exploit this… |
CVE-2017-15311 | High | 8.8 | 2017-12-22 | The baseband modules of Mate 10, Mate 10 Pro, Mate 9, Mate 9 Pro Huawei smart phones with software before ALP-AL00 8.0.0.120(SP2C00), before BLA-AL00 8.0.0.120… |
CVE-2017-15310 | Medium | 6.5 | 2017-12-22 | Huawei iReader app before 8.0.2.301 has an arbitrary file deletion vulnerability due to the lack of input validation. An attacker can exploit this vulnerabilit… |
CVE-2017-15309 | High | 7.1 | 2017-12-22 | Huawei iReader app before 8.0.2.301 has a path traversal vulnerability due to insufficient validation on file storage paths. An attacker can exploit this vulne… |
CVE-2017-15308 | High | 8.8 | 2017-12-22 | Huawei iReader app before 8.0.2.301 has an input validation vulnerability due to insufficient validation on the URL used for loading network data. An attacker… |
CVE-2017-15307 | Low | 2.3 | 2017-12-22 | Huawei Honor 8 smartphone with software versions earlier than FRD-L04C567B389 and earlier than FRD-L14C567B389 have a permission control vulnerability due to i… |
CVE-2017-16766 | Medium | 6.5 | 2017-12-22 | An improper access control vulnerability in synodsmnotify in Synology DiskStation Manager (DSM) before 6.1.4-15217 and before 6.0.3-8754-6 allows local users t… |
CVE-2017-10909 | High | 7.8 | 2017-12-22 | Untrusted search path vulnerability in Music Center for PC version 1.0.01 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspec… |
CVE-2017-10908 | High | 7.5 | 2017-12-22 | H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header. |
CVE-2017-10907 | Medium | 4.3 | 2017-12-22 | Directory traversal vulnerability in OneThird CMS Show Off v1.85 and earlier. Show Off v1.85 en and earlier allows an attacker to read arbitrary files via unsp… |
CVE-2017-10872 | Medium | 6.5 | 2017-12-22 | H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via unspecified vectors. |
CVE-2017-10869 | High | 7.5 | 2017-12-22 | Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors. |
CVE-2017-10868 | High | 7.5 | 2017-12-22 | H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header. |
CVE-2017-16727 | Critical | 9.1 | 2017-12-22 | A Credentials Management issue was discovered in Moxa NPort W2150A versions prior to 1.11, and NPort W2250A versions prior to 1.11. The default password is emp… |
CVE-2017-14363 | Medium | 5.9 | 2017-12-21 | Cross-Site Scripting (XSS) vulnerability has been identified in Micro Focus Operations Manager i, versions 10.60, 10.61, 10.62. The vulnerability could be remo… |
CVE-2017-17692 | High | 7.5 | 2017-12-21 | Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that re… |
CVE-2017-6167 | High | 7.5 | 2017-12-21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, race conditions in iControl… |
CVE-2017-6164 | High | 8.1 | 2017-12-21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, 12.0.0 - 12… |
CVE-2017-6151 | High | 7.5 | 2017-12-21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, undisclosed… |
CVE-2017-6140 | High | 7.5 | 2017-12-21 | On the BIG-IP 2000s, 2200s, 4000s, 4200v, i5600, i5800, i7600, i7800, i10600,i10800, and VIPRION 4450 blades, running version 11.5.0, 11.5.1, 11.5.2, 11.5.3, 1… |
CVE-2017-6139 | Medium | 5.9 | 2017-12-21 | In F5 BIG-IP APM software version 13.0.0 and 12.1.2, under rare conditions, the BIG-IP APM system appends log details when responding to client requests. Detai… |
CVE-2017-6138 | High | 7.5 | 2017-12-21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, malicious requests mad… |
CVE-2017-6136 | Medium | 5.9 | 2017-12-21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, undisclosed traffic pa… |
CVE-2017-6135 | High | 7.5 | 2017-12-21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, a slow memory leak as a result of undisclo… |
CVE-2017-6134 | Medium | 6.5 | 2017-12-21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, 12.1.0 - 12.1.2 and 11.5.1 - 11.6.1, an un… |
CVE-2017-6133 | High | 7.5 | 2017-12-21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, undisclosed HTTP requests m… |
CVE-2017-6132 | High | 7.5 | 2017-12-21 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 and 11… |
CVE-2017-6129 | High | 7.5 | 2017-12-21 | In F5 BIG-IP APM software version 13.0.0 and 12.1.2, in some circumstances, APM tunneled VPN flows can cause a VPN/PPP connflow to be prematurely freed or caus… |
CVE-2017-0304 | Medium | 5.4 | 2017-12-21 | A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12.0.0, 12.1.0, 12.1.1, 12.1.2 and 13.0.0 that may allow a copy of the firewal… |
CVE-2017-0301 | High | 7.6 | 2017-12-21 | In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM portal access requests… |
CVE-2017-17033 | Critical | 9.8 | 2017-12-21 | A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 an… |
CVE-2017-17032 | Critical | 9.8 | 2017-12-21 | A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 an… |
CVE-2017-17031 | Critical | 9.8 | 2017-12-21 | A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 an… |
CVE-2017-17030 | Critical | 9.8 | 2017-12-21 | A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and e… |
CVE-2017-17029 | Critical | 9.8 | 2017-12-21 | A buffer overflow vulnerability in login function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and e… |
CVE-2017-17028 | Critical | 9.8 | 2017-12-21 | A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 2017… |
CVE-2017-17027 | Critical | 9.8 | 2017-12-21 | A buffer overflow vulnerability in FTP service in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earl… |
CVE-2017-17411 | Critical | 9.8 | 2017-12-21 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit th… |
CVE-2017-17410 | High | 8.8 | 2017-12-21 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is req… |
CVE-2017-17409 | High | 8.8 | 2017-12-21 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is req… |
CVE-2017-17408 | High | 8.8 | 2017-12-21 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018. User interaction is req… |
CVE-2017-17831 | High | 8.8 | 2017-12-21 | GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "… |
CVE-2017-17830 | Medium | 6.8 | 2017-12-21 | Bus Booking Script has CSRF via admin/new_master.php. |
CVE-2017-17829 | High | 7.2 | 2017-12-21 | Bus Booking Script has SQL Injection via the admin/view_seatseller.php sp_id parameter or the admin/view_member.php memid parameter. |
CVE-2017-17828 | Medium | 4.8 | 2017-12-21 | Bus Booking Script has XSS via the results.php datepicker parameter or the admin/new_master.php spemail parameter. |
CVE-2017-17827 | High | 8.8 | 2017-12-21 | Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration§ion=main or /admin.php?page=batch_manager&mode=unit. An attacker… |
CVE-2017-17826 | Medium | 6.1 | 2017-12-21 | The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallery_title parameter in an admin.php?page=configuration… |
CVE-2017-17825 | Medium | 4.8 | 2017-12-21 | The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags-* array parameters in an admin.php?page=batch_manager&mod… |
CVE-2017-17824 | Medium | 4.9 | 2017-12-21 | The Batch Manager component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/batch_manager_unit.php element_ids parameter in unit mode. An attacker… |
CVE-2017-17823 | Medium | 4.9 | 2017-12-21 | The Configuration component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/configuration.php order_by array parameter. An attacker can exploit th… |
CVE-2017-17822 | Medium | 4.9 | 2017-12-21 | The List Users API of Piwigo 2.9.2 is vulnerable to SQL Injection via the /admin/user_list_backend.php sSortDir_0 parameter. An attacker can exploit this to ga… |
CVE-2017-17821 | Critical | 9.8 | 2017-12-21 | WTF/wtf/FastBitVector.h in WebKit, as distributed in Safari Technology Preview Release 46, allows remote attackers to cause a denial of service (buffer overflo… |
CVE-2017-17820 | Medium | 5.5 | 2017-12-21 | In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_list_one_macro in asm/preproc.c that will lead to a remote denial of service attack, relat… |
CVE-2017-17819 | Medium | 5.5 | 2017-12-21 | In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function find_cc() in asm/preproc.c that will cause a remote denial of service a… |
CVE-2017-17818 | High | 7.5 | 2017-12-21 | In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read that will cause a remote denial of service attack, related to a while loop in paste… |