2017 CVEs (page 43)
Page 43 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-17817 | Medium | 5.5 | 2017-12-21 | In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_verror in asm/preproc.c that will cause a remote denial of service attack. |
CVE-2017-17816 | Medium | 5.5 | 2017-12-21 | In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_getline in asm/preproc.c that will cause a remote denial of service attack. |
CVE-2017-17815 | Medium | 5.5 | 2017-12-21 | In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in is_mmacro() in asm/preproc.c that will cause a remote denial of service attack, beca… |
CVE-2017-17814 | Medium | 5.5 | 2017-12-21 | In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in do_directive in asm/preproc.c that will cause a remote denial of service attack. |
CVE-2017-17813 | Medium | 5.5 | 2017-12-21 | In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in the pp_list_one_macro function in asm/preproc.c that will cause a remote denial of service at… |
CVE-2017-17812 | Medium | 5.5 | 2017-12-21 | In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read in the function detoken() in asm/preproc.c that will cause a remote denial of servi… |
CVE-2017-17811 | Medium | 5.5 | 2017-12-21 | In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer overflow that will cause a remote denial of service attack, related to a strcpy in paste_toke… |
CVE-2017-17810 | Medium | 5.5 | 2017-12-21 | In Netwide Assembler (NASM) 2.14rc0, there is a "SEGV on unknown address" that will cause a remote denial of service attack, because asm/preproc.c mishandles m… |
CVE-2017-17809 | High | 7.8 | 2017-12-20 | In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underl… |
CVE-2017-17807 | Low | 3.3 | 2017-12-20 | The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default request-key keyring" via… |
CVE-2017-17806 | High | 7.8 | 2017-12-20 | The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowi… |
CVE-2017-17805 | High | 7.8 | 2017-12-20 | The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_A… |
CVE-2017-14387 | Medium | 6.5 | 2017-12-20 | The NFS service in EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, and 8.0.0.0 - 8.0.0.4 maintains default NFS export settings (including the NFS export security… |
CVE-2017-14385 | High | 7.5 | 2017-12-20 | An issue was discovered in EMC Data Domain DD OS 5.7 family, versions prior to 5.7.5.6; EMC Data Domain DD OS 6.0 family, versions prior to 6.0.2.9; EMC Data D… |
CVE-2017-5263 | High | 8.0 | 2017-12-20 | Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which are most typically imp… |
CVE-2017-5262 | High | 8.0 | 2017-12-20 | In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive information by OID refere… |
CVE-2017-5261 | High | 8.8 | 2017-12-20 | In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path… |
CVE-2017-5260 | High | 8.8 | 2017-12-20 | In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web ad… |
CVE-2017-5259 | High | 8.8 | 2017-12-20 | In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path… |
CVE-2017-5258 | Medium | 5.4 | 2017-12-20 | In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows or can guess the RW community string can provide a URL for a configuration fi… |
CVE-2017-5257 | Medium | 5.4 | 2017-12-20 | In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows (or guesses) the SNMP read/write (RW) community string can insert XSS strings… |
CVE-2017-5256 | Medium | 5.4 | 2017-12-20 | In version 3.5 and prior of Cambium Networks ePMP firmware, all authenticated users have the ability to update the Device Name and System Description fields in… |
CVE-2017-5255 | High | 8.8 | 2017-12-20 | In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenti… |
CVE-2017-5254 | High | 8.8 | 2017-12-20 | In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for o… |
CVE-2017-6094 | Critical | 9.8 | 2017-12-20 | CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. A CPE identifies itself by the MAC… |
CVE-2017-17747 | Medium | 6.5 | 2017-12-20 | Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a d… |
CVE-2017-17746 | Medium | 6.8 | 2017-12-20 | Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access the device without ent… |
CVE-2017-17745 | Medium | 5.4 | 2017-12-20 | Cross-site scripting (XSS) vulnerability in system_name_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java scrip… |
CVE-2017-16735 | Medium | 5.3 | 2017-12-20 | A SQL Injection issue was discovered in Ecava IntegraXor v 6.1.1030.1 and prior. The SQL Injection vulnerability has been identified, which generates an error… |
CVE-2017-16733 | Medium | 5.3 | 2017-12-20 | A SQL Injection issue was discovered in Ecava IntegraXor v 6.1.1030.1 and prior. The SQL Injection vulnerability has been identified, which an attacker can lev… |
CVE-2017-16731 | High | 8.8 | 2017-12-20 | An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 (including Ellipse Select)… |
CVE-2017-16725 | Critical | 9.8 | 2017-12-20 | A Stack-based Buffer Overflow issue was discovered in Xiongmai Technology IP Cameras and DVRs using the NetSurveillance Web interface. The stack-based buffer o… |
CVE-2017-16717 | High | 8.6 | 2017-12-20 | A Heap-based Buffer Overflow issue was discovered in WECON LeviStudio HMI. The heap-based buffer overflow vulnerability has been identified, which may allow re… |
CVE-2017-1757 | High | 8.8 | 2017-12-20 | IBM Security Guardium 10.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to vie… |
CVE-2017-1751 | Medium | 5.4 | 2017-12-20 | IBM Robotic Process Automation with Automation Anywhere 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaSc… |
CVE-2017-1746 | High | 8.8 | 2017-12-20 | IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious an… |
CVE-2017-1696 | High | 8.8 | 2017-12-20 | IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an atta… |
CVE-2017-1694 | High | 8.1 | 2017-12-20 | IBM Integration Bus 9.0 and 10.0 transmits user credentials in plain in clear text which can be read by an attacker using man in the middle techniques. IBM X-F… |
CVE-2017-1631 | High | 8.8 | 2017-12-20 | IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious an… |
CVE-2017-1600 | Medium | 5.4 | 2017-12-20 | IBM Security Guardium 10.0 Database Activity Monitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2017-1598 | High | 7.5 | 2017-12-20 | IBM Security Guardium 10.0 Database Activity Monitor uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiv… |
CVE-2017-1596 | Medium | 5.5 | 2017-12-20 | IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vectors. IBM X-Force I… |
CVE-2017-1595 | Medium | 5.5 | 2017-12-20 | IBM Security Guardium 10.0 Database Activity Monitor could allow a local attacker to obtain highly sensitive information via unspecified vectors. IBM X-Force I… |
CVE-2017-15532 | Medium | 5.7 | 2017-12-20 | Prior to 10.6.4, Symantec Messaging Gateway may be susceptible to a path traversal attack (also known as directory traversal). These types of attacks aim to ac… |
CVE-2017-14969 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000… |
CVE-2017-14968 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000… |
CVE-2017-14967 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000… |
CVE-2017-14966 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000… |
CVE-2017-14965 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000… |
CVE-2017-14964 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000… |
CVE-2017-14963 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x83000… |
CVE-2017-14962 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Out of Bounds Write vulnerability because of not validating input values from IOCtl 0x8… |
CVE-2017-1494 | Medium | 5.4 | 2017-12-20 | IBM Business Process Manager 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2017-1423 | Medium | 5.3 | 2017-12-20 | IBM WebSphere Portal 8.5 and 9.0 exposes backend server URLs that are configured for usage by the Web Application Bridge component. IBM X-Force ID: 127476. |
CVE-2017-1270 | Low | 3.3 | 2017-12-20 | IBM Security Guardium 10.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. Th… |
CVE-2017-1266 | Medium | 5.4 | 2017-12-20 | IBM Security Guardium 10.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actor… |
CVE-2017-1262 | Medium | 6.1 | 2017-12-20 | IBM Security Guardium 10.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to… |
CVE-2017-1261 | Low | 3.3 | 2017-12-20 | IBM Security Guardium 10.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 124736. |
CVE-2017-1257 | Medium | 4.3 | 2017-12-20 | IBM Security Guardium 10.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-For… |
CVE-2017-12072 | Medium | 5.4 | 2017-12-20 | Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated users to inject arbi… |
CVE-2017-17476 | High | 8.8 | 2017-12-20 | Open Ticket Request System (OTRS) 4.0.x before 4.0.28, 5.0.x before 5.0.26, and 6.0.x before 6.0.3, when cookie support is disabled, might allow remote attacke… |
CVE-2017-16818 | Medium | 6.5 | 2017-12-20 | RADOS Gateway in Ceph 12.1.0 through 12.2.1 allows remote authenticated users to cause a denial of service (assertion failure and application exit) by leveragi… |
CVE-2017-17752 | Medium | 6.1 | 2017-12-20 | Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail screen (aka the /_re… |
CVE-2017-4943 | High | 7.8 | 2017-12-20 | VMware vCenter Server Appliance (vCSA) (6.5 before 6.5 U1d) contains a local privilege escalation vulnerability via the 'showlog' plugin. Successful exploitati… |
CVE-2017-4941 | High | 8.8 | 2017-12-20 | VMware ESXi (6.0 before ESXi600-201711101-SG, 5.5 ESXi550-201709101-SG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) contain a vulnerabilit… |
CVE-2017-4940 | Medium | 6.1 | 2017-12-20 | The ESXi Host Client in VMware ESXi (6.5 before ESXi650-201712103-SG, 5.5 before ESXi600-201711103-SG and 5.5 before ESXi550-201709102-SG) contains a vulnerabi… |
CVE-2017-4933 | High | 8.8 | 2017-12-20 | VMware ESXi (6.5 before ESXi650-201710401-BG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) contain a vulnerability that could allow an auth… |
CVE-2017-16589 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-16588 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-16587 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to e… |
CVE-2017-16586 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to e… |
CVE-2017-16585 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to e… |
CVE-2017-16584 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is requi… |
CVE-2017-16583 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to e… |
CVE-2017-16582 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to e… |
CVE-2017-16581 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to e… |
CVE-2017-16580 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is requi… |
CVE-2017-16579 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is requi… |
CVE-2017-16578 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.2.25013. User interaction is required to e… |
CVE-2017-16577 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-16576 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-16575 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-16574 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-16573 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-16572 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-16571 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-14837 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-14836 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1. User interaction is required to exploit… |
CVE-2017-14835 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-14834 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-14833 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-14832 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-14831 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-14830 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-14829 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-14828 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-14827 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-14826 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-14825 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-14824 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |