2017 CVEs (page 44)
Page 44 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-14823 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-14822 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-14821 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-14820 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-14819 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-14818 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to explo… |
CVE-2017-10959 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-10958 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-10957 | High | 8.8 | 2017-12-20 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is required to e… |
CVE-2017-10956 | Medium | 6.5 | 2017-12-20 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.1.21155. User interaction is requi… |
CVE-2017-17804 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact be… |
CVE-2017-17803 | High | 7.8 | 2017-12-20 | In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified othe… |
CVE-2017-17802 | High | 7.8 | 2017-12-20 | In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified othe… |
CVE-2017-17801 | High | 7.8 | 2017-12-20 | In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified othe… |
CVE-2017-17800 | High | 7.8 | 2017-12-20 | In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified othe… |
CVE-2017-17799 | High | 7.8 | 2017-12-20 | In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified othe… |
CVE-2017-17798 | High | 7.8 | 2017-12-20 | In TG Soft Vir.IT eXplorer Lite 8.5.42, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified othe… |
CVE-2017-17797 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact be… |
CVE-2017-17796 | High | 7.8 | 2017-12-20 | In TG Soft Vir.IT eXplorer Lite 8.5.65, the driver file (VIRAGTLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified othe… |
CVE-2017-17795 | High | 7.8 | 2017-12-20 | In IKARUS anti.virus 2.16.20, the driver file (ntguard.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact be… |
CVE-2017-17794 | Critical | 9.8 | 2017-12-20 | validate_form_preferences in admin/preferences.php in BlogoText through 3.7.6 allows attackers to bypass intended access restrictions via vectors related to an… |
CVE-2017-17793 | High | 7.5 | 2017-12-20 | Information Disclosure vulnerability in creer_fichier_zip in admin/maintenance.php in BlogoText through 3.7.6 allows remote attackers to defeat a filename-rand… |
CVE-2017-17792 | Medium | 6.1 | 2017-12-20 | Cross site scripting (XSS) vulnerability in the markup_clean_href function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitra… |
CVE-2017-17790 | Critical | 9.8 | 2017-12-20 | The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv… |
CVE-2017-17789 | High | 7.8 | 2017-12-20 | In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c. |
CVE-2017-17788 | Medium | 5.5 | 2017-12-20 | In GIMP 2.8.22, there is a stack-based buffer over-read in xcf_load_stream in app/xcf/xcf.c when there is no '\0' character after the version string. |
CVE-2017-17787 | High | 7.8 | 2017-12-20 | In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c. |
CVE-2017-17786 | High | 7.8 | 2017-12-20 | In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related to bgr2rgb.part.1) via an unexpected bits-per-pixel… |
CVE-2017-17785 | High | 7.8 | 2017-12-20 | In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c. |
CVE-2017-17784 | High | 7.8 | 2017-12-20 | In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c in the gbr import parser, related to mishandling of UTF-8 da… |
CVE-2017-17783 | High | 7.5 | 2017-12-20 | In GraphicsMagick 1.3.27a, there is a buffer over-read in ReadPALMImage in coders/palm.c when QuantumDepth is 8. |
CVE-2017-17782 | High | 8.8 | 2017-12-20 | In GraphicsMagick 1.3.27a, there is a heap-based buffer over-read in ReadOneJNGImage in coders/png.c, related to oFFs chunk allocation. |
CVE-2017-17780 | Medium | 6.1 | 2017-12-20 | The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This com… |
CVE-2017-17779 | Critical | 9.8 | 2017-12-20 | Paid To Read Script 2.0.5 has SQL injection via the referrals.php id parameter. |
CVE-2017-17778 | Medium | 4.8 | 2017-12-20 | Paid To Read Script 2.0.5 has XSS via the referrals.php tier parameter or the admin/userview.php uid parameter. |
CVE-2017-17777 | Critical | 9.8 | 2017-12-20 | Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated by the admin/viewvisitcamp.php fn parameter and th… |
CVE-2017-17776 | Medium | 5.3 | 2017-12-20 | Paid To Read Script 2.0.5 has full path disclosure via an invalid admin/userview.php uid parameter. |
CVE-2017-17775 | Medium | 6.1 | 2017-12-20 | Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request. |
CVE-2017-17774 | High | 8.8 | 2017-12-20 | admin/configuration.php in Piwigo 2.9.2 has CSRF. |
CVE-2017-17763 | High | 7.5 | 2017-12-19 | SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which mak… |
CVE-2017-17761 | Critical | 9.8 | 2017-12-19 | An issue was discovered on Ichano AtHome IP Camera devices. The device runs the "noodles" binary - a service on port 1300 that allows a remote (LAN) unauthenti… |
CVE-2017-17753 | Medium | 6.1 | 2017-12-19 | Multiple cross-site scripting (XSS) vulnerabilities in the esb-csv-import-export plugin through 1.1 for WordPress allow remote attackers to inject arbitrary we… |
CVE-2017-17744 | Medium | 6.1 | 2017-12-19 | A cross-site scripting (XSS) vulnerability in the custom-map plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2017-17719 | Medium | 6.1 | 2017-12-19 | A cross-site scripting (XSS) vulnerability in the wp-concours plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML v… |
CVE-2017-17088 | High | 7.5 | 2017-12-19 | The Enterprise version of SyncBreeze 10.2.12 and earlier is affected by a Remote Denial of Service vulnerability. The web server does not check bounds when rea… |
CVE-2017-16786 | Medium | 6.5 | 2017-12-19 | The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote authenticated users with certain privileges to read arbit… |
CVE-2017-15049 | High | 8.8 | 2017-12-19 | The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when constructing a shell command, which allo… |
CVE-2017-15048 | High | 8.8 | 2017-12-19 | Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote attackers to execute arbitrary code by… |
CVE-2017-17759 | Critical | 9.8 | 2017-12-19 | Conarc iChannel allows remote attackers to obtain sensitive information, modify the configuration, or cause a denial of service (by deleting the configuration)… |
CVE-2017-17758 | High | 8.8 | 2017-12-19 | TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/dh… |
CVE-2017-17757 | High | 8.8 | 2017-12-19 | TP-Link TL-WVR and TL-WAR devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the interface field of an admin/wp… |
CVE-2017-17107 | Critical | 9.8 | 2017-12-19 | Zivif PR115-204-P-RS V2.3.4.2103 web cameras contain a hard-coded cat1029 password for the root user. The SONIX operating system's setup renders this password… |
CVE-2017-17106 | Critical | 9.8 | 2017-12-19 | Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?c… |
CVE-2017-17105 | Critical | 9.8 | 2017-12-19 | Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras are vulnerable to unauthenticated, blind remote command injecti… |
CVE-2017-16949 | Critical | 9.8 | 2017-12-19 | An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to… |
CVE-2017-15877 | Critical | 9.8 | 2017-12-19 | Insecure Permissions vulnerability in db.php file in GPWeb 8.4.61 allows remote attackers to view the password and user database. |
CVE-2017-15876 | High | 7.2 | 2017-12-19 | Unrestricted File Upload vulnerability in GPWeb 8.4.61 allows remote authenticated users to upload any type of file, including a PHP shell. |
CVE-2017-15875 | Critical | 9.8 | 2017-12-19 | SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary SQL commands via the "checkemail" parameter. |
CVE-2017-15524 | Critical | 9.1 | 2017-12-19 | The Application Firewall Pack (AFP, aka Web Application Firewall) component on Kemp Load Balancer devices with software before 7.2.40.1 allows a Security Featu… |
CVE-2017-11562 | High | 8.8 | 2017-12-19 | A Session Fixation Vulnerability exists in the MT4 Networks SenhaSegura Web Application 2.2.23.8 via login_if.php. |
CVE-2017-15700 | High | 8.8 | 2017-12-18 | A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, through the Sling log… |
CVE-2017-15104 | High | 7.8 | 2017-12-18 | An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could r… |
CVE-2017-15103 | High | 8.8 | 2017-12-18 | A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially crafted requests to… |
CVE-2017-17721 | Critical | 9.8 | 2017-12-18 | CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, assignto, building, domain, jobtype, site… |
CVE-2017-14583 | Medium | 6.5 | 2017-12-18 | NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and 9.2P2 are susceptible to a vulnerability which allows an attacker to cause a Denial of Service (Do… |
CVE-2017-12630 | Medium | 5.4 | 2017-12-18 | In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page… |
CVE-2017-17651 | Critical | 9.8 | 2017-12-18 | Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php f… |
CVE-2017-17649 | Medium | 6.1 | 2017-12-18 | Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter. |
CVE-2017-17645 | Critical | 9.8 | 2017-12-18 | Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php. |
CVE-2017-17643 | Critical | 9.8 | 2017-12-18 | FS Lynda Clone 1.0 has SQL Injection via the keywords parameter to tutorial/. |
CVE-2017-17741 | Medium | 6.5 | 2017-12-18 | The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio sta… |
CVE-2017-17740 | High | 7.5 | 2017-12-18 | contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that wa… |
CVE-2017-17739 | Critical | 9.8 | 2017-12-18 | The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html rp parameter, allowing an attacker to r… |
CVE-2017-17738 | High | 7.5 | 2017-12-18 | The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and modifying files via /tools.html. |
CVE-2017-17737 | Medium | 6.1 | 2017-12-18 | The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network_diagnostics.html or /storage_info.html. |
CVE-2017-17735 | Critical | 9.8 | 2017-12-18 | CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies. |
CVE-2017-17734 | Critical | 9.8 | 2017-12-18 | CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions. |
CVE-2017-17733 | Critical | 9.8 | 2017-12-18 | Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request. |
CVE-2017-17731 | Critical | 9.8 | 2017-12-18 | DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php. |
CVE-2017-17730 | Critical | 9.8 | 2017-12-18 | DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php. |
CVE-2017-17727 | High | 8.8 | 2017-12-18 | DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to mem… |
CVE-2017-16997 | High | 7.8 | 2017-12-18 | elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE… |
CVE-2017-17718 | Medium | 5.9 | 2017-12-17 | The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation. |
CVE-2017-17717 | Critical | 9.8 | 2017-12-17 | Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature. |
CVE-2017-17716 | Medium | 5.9 | 2017-12-17 | GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was mentioned in the 9.4 release announceme… |
CVE-2017-16950 | Medium | 6.1 | 2017-12-17 | Cross - site scripting (XSS) vulnerability in UrBackup Server before 2.1.20 allows remote attackers to inject arbitrary web script or HTML via the action param… |
CVE-2017-17714 | Medium | 6.1 | 2017-12-16 | Trape before 2017-11-05 has XSS via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /r… |
CVE-2017-17713 | Critical | 9.8 | 2017-12-16 | Trape before 2017-11-05 has SQL injection via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country paramet… |
CVE-2017-17715 | High | 8.8 | 2017-12-16 | The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal via a pathname obtai… |
CVE-2017-14134 | Medium | 6.1 | 2017-12-16 | A Reflected XSS Vulnerability affects the forgotten password page of Maplesoft Maple T.A. 2016.0.6 (Customer Hosted) via the emailAddress parameter to password… |
CVE-2017-3196 | High | 7.8 | 2017-12-16 | PCAUSA Rawether framework does not properly validate BPF data, allowing a crafted malicious BPF program to perform operations on memory outside of its typical… |
CVE-2017-3195 | Critical | 9.8 | 2017-12-16 | Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability th… |
CVE-2017-3194 | High | 8.1 | 2017-12-16 | Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-i… |
CVE-2017-3193 | High | 8.8 | 2017-12-16 | Multiple D-Link devices including the DIR-850L firmware versions 1.14B07 and 2.07.B05 contain a stack-based buffer overflow vulnerability in the web administra… |
CVE-2017-3192 | Critical | 9.8 | 2017-12-16 | D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page disclose… |
CVE-2017-3191 | Critical | 9.8 | 2017-12-16 | D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that… |
CVE-2017-3190 | High | 7.5 | 2017-12-16 | Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTT… |
CVE-2017-3186 | Critical | 9.8 | 2017-12-16 | ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all devices. A remote att… |
CVE-2017-3185 | Critical | 9.8 | 2017-12-16 | ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests… |
CVE-2017-3184 | Critical | 9.8 | 2017-12-16 | ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC fail to properly restrict access to the factory reset page. An unau… |