2017 CVEs (page 45)
Page 45 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-14093 | Medium | 6.1 | 2017-12-16 | The Log Query and Quarantine Query pages in Trend Micro ScanMail for Exchange 12.0 are vulnerable to cross site scripting (XSS) attacks. |
CVE-2017-14092 | High | 8.8 | 2017-12-16 | The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticated requests when an… |
CVE-2017-14091 | High | 7.5 | 2017-12-16 | A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific installations that utilize a uncommon feature - Other Update Sources… |
CVE-2017-14090 | Critical | 9.1 | 2017-12-16 | A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted. |
CVE-2017-11397 | High | 7.8 | 2017-12-16 | A service DLL preloading vulnerability in Trend Micro Encryption for Email versions 5.6 and below could allow an unauthenticated remote attacker to execute arb… |
CVE-2017-10905 | Medium | 5.3 | 2017-12-16 | A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variables via unspecified vectors. |
CVE-2017-10904 | Critical | 9.8 | 2017-12-16 | Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2017-17712 | High | 7.0 | 2017-12-16 | The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet->hdrincl that leads to uninitialized stack pointer… |
CVE-2017-14184 | High | 8.8 | 2017-12-15 | An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and Fort… |
CVE-2017-17701 | Critical | 9.8 | 2017-12-15 | K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025c8 DeviceIoControl request. |
CVE-2017-17700 | Critical | 9.8 | 2017-12-15 | K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025a4 DeviceIoControl request. |
CVE-2017-17699 | Critical | 9.8 | 2017-12-15 | K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025ac DeviceIoControl request. |
CVE-2017-12373 | Medium | 5.9 | 2017-12-15 | A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550) devices could allow an unauthenticate… |
CVE-2017-17698 | Medium | 6.1 | 2017-12-15 | Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec. |
CVE-2017-17556 | Medium | 5.1 | 2017-12-15 | A debug tool in Synaptics TouchPad drivers allows local users with administrative access to obtain sensitive information about keyboard scan codes by modifying… |
CVE-2017-16788 | High | 7.2 | 2017-12-15 | Directory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24… |
CVE-2017-16787 | Medium | 6.5 | 2017-12-15 | The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure t… |
CVE-2017-16776 | High | 8.1 | 2017-12-15 | Security researchers discovered an authentication bypass vulnerability in version 2.0.2 of the Conserus Workflow Intelligence application by McKesson Medical I… |
CVE-2017-14101 | Critical | 9.8 | 2017-12-15 | A security researcher found an XML External Entity (XXE) vulnerability on the Conserus Image Repository archive solution version 2.1.1.105 by McKesson Medical… |
CVE-2017-15890 | Medium | 4.8 | 2017-12-15 | Cross-site scripting (XSS) vulnerability in Disclaimer in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary web… |
CVE-2017-17697 | High | 8.6 | 2017-12-15 | The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping. |
CVE-2017-17696 | Medium | 4.3 | 2017-12-15 | Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php. |
CVE-2017-17695 | High | 8.8 | 2017-12-15 | Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter. |
CVE-2017-17694 | Medium | 5.4 | 2017-12-15 | Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter. |
CVE-2017-17693 | Medium | 4.3 | 2017-12-15 | Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remove feedback. |
CVE-2017-17670 | High | 8.8 | 2017-12-15 | In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid… |
CVE-2017-17405 | High | 8.8 | 2017-12-15 | Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a lo… |
CVE-2017-16355 | Medium | 4.7 | 2017-12-14 | In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is runnin… |
CVE-2017-5264 | High | 8.8 | 2017-12-14 | Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application… |
CVE-2017-7344 | High | 8.1 | 2017-12-14 | A privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privilege via exploiting the Windows "securit… |
CVE-2017-17535 | High | 8.8 | 2017-12-14 | lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow r… |
CVE-2017-17534 | High | 8.8 | 2017-12-14 | uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote at… |
CVE-2017-17533 | High | 8.8 | 2017-12-14 | default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attac… |
CVE-2017-17532 | High | 8.8 | 2017-12-14 | examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which mig… |
CVE-2017-17531 | High | 8.8 | 2017-12-14 | gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote at… |
CVE-2017-17530 | High | 8.8 | 2017-12-14 | common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote… |
CVE-2017-17529 | High | 8.8 | 2017-12-14 | af/util/xp/ut_go_file.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment variable, which might… |
CVE-2017-17528 | High | 8.8 | 2017-12-14 | backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, wh… |
CVE-2017-17527 | High | 8.8 | 2017-12-14 | delphi_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment variable, which mi… |
CVE-2017-17526 | High | 8.8 | 2017-12-14 | Input.cc in Bernard Parisse Giac 1.2.3.57 does not validate strings before launching the program specified by the BROWSER environment variable, which might all… |
CVE-2017-17525 | High | 8.8 | 2017-12-14 | guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environment variable, which m… |
CVE-2017-17524 | High | 8.8 | 2017-12-14 | library/www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might al… |
CVE-2017-17522 | High | 8.8 | 2017-12-14 | Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might all… |
CVE-2017-17521 | High | 8.8 | 2017-12-14 | uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow… |
CVE-2017-17520 | High | 8.8 | 2017-12-14 | tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remot… |
CVE-2017-17519 | High | 8.8 | 2017-12-14 | batteriesConfig.mlp in OCaml Batteries Included (aka ocaml-batteries) 2.6 does not validate strings before launching the program specified by the BROWSER envir… |
CVE-2017-17518 | High | 8.8 | 2017-12-14 | swt/motif/browser.c in White_dune (aka whitedune) 0.30.10 does not validate strings before launching the program specified by the BROWSER environment variable… |
CVE-2017-17517 | High | 8.8 | 2017-12-14 | libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allo… |
CVE-2017-17516 | High | 8.8 | 2017-12-14 | scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by the BROWSER environmen… |
CVE-2017-17515 | High | 8.8 | 2017-12-14 | etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote… |
CVE-2017-17514 | High | 8.8 | 2017-12-14 | boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers… |
CVE-2017-17513 | High | 8.8 | 2017-12-14 | TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attack… |
CVE-2017-17511 | High | 8.8 | 2017-12-14 | KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to co… |
CVE-2017-5663 | High | 8.8 | 2017-12-14 | In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able… |
CVE-2017-17684 | High | 7.5 | 2017-12-14 | Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c04 \\.\PSMEMDriver DeviceIoControl request. |
CVE-2017-17683 | High | 7.5 | 2017-12-14 | Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c44 \\.\PSMEMDriver DeviceIoControl request. |
CVE-2017-17682 | Medium | 6.5 | 2017-12-14 | In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, which allows attackers to cause a denial o… |
CVE-2017-17681 | Medium | 6.5 | 2017-12-14 | In ImageMagick 7.0.7-12 Q16, an infinite loop vulnerability was found in the function ReadPSDChannelZip in coders/psd.c, which allows attackers to cause a deni… |
CVE-2017-17680 | Medium | 6.5 | 2017-12-14 | In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in coders/xpm.c, which allows attackers to cause a denial of se… |
CVE-2017-17672 | Critical | 9.8 | 2017-12-14 | In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, c… |
CVE-2017-17671 | Critical | 9.8 | 2017-12-14 | vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include d… |
CVE-2017-7738 | High | 7.2 | 2017-12-13 | An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with super_admin privile… |
CVE-2017-17669 | Medium | 5.5 | 2017-12-13 | There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp in Exiv2 0.26. A crafted PNG file will lead t… |
CVE-2017-11305 | Medium | 6.5 | 2017-12-13 | A regression affecting Adobe Flash Player version 27.0.0.187 (and earlier versions) causes the unintended reset of the global settings preference file when a u… |
CVE-2017-17665 | High | 8.8 | 2017-12-13 | In Octopus Deploy before 4.1.3, the machine update process doesn't check that the user has access to all environments. This allows an access-control bypass bec… |
CVE-2017-17664 | Medium | 5.9 | 2017-12-13 | A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified Asterisk before 13.13… |
CVE-2017-14380 | Medium | 6.7 | 2017-12-13 | In EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, 8.0.0.0 - 8.0.0.4, 7.2.1.0 - 7.2.1.5, 7.2.0.x, and 7.1.1.x, a malicious compliance admin (compadmin) account us… |
CVE-2017-15530 | Low | 3.3 | 2017-12-13 | Prior to 4.4.1.10, the Norton Family Android App can be susceptible to an Information Disclosure issue. Information disclosure is a very common issue that atta… |
CVE-2017-15529 | Medium | 6.2 | 2017-12-13 | Prior to 4.4.1.10, the Norton Family Android App can be susceptible to a Denial of Service (DoS) exploit. A DoS attack is a type of attack whereby the perpetra… |
CVE-2017-1716 | Low | 3.3 | 2017-12-13 | IBM Tivoli Workload Scheduler 8.6.0, 9.1.0, and 9.2.0 could disclose sensitive information to a local attacker due to improper permission settings. IBM X-Force… |
CVE-2017-1635 | High | 8.0 | 2017-12-13 | IBM Tivoli Monitoring V6 6.2.2.x could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free error. A remote attacker cou… |
CVE-2017-1558 | Medium | 6.1 | 2017-12-13 | IBM Maximo Asset Management 7.5 and 7.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to vis… |
CVE-2017-1546 | Medium | 5.4 | 2017-12-13 | IBM DOORS Next Generation (DNG/RRC) 4.07, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod… |
CVE-2017-1421 | Medium | 6.1 | 2017-12-13 | IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended f… |
CVE-2017-17648 | Critical | 9.8 | 2017-12-13 | Entrepreneur Dating Script 2.0.1 has SQL Injection via the search_result.php marital, gender, country, or profileid parameter. |
CVE-2017-17549 | Medium | 5.9 | 2017-12-13 | Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12… |
CVE-2017-17537 | High | 7.5 | 2017-12-13 | MikroTik RouterBOARD v6.39.2 and v6.40.5 allows an unauthenticated remote attacker to cause a denial of service by connecting to TCP port 53 and sending data t… |
CVE-2017-17427 | Medium | 5.9 | 2017-12-13 | Radware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vulnerable to an adaptive-chosen ciphertext attack ("Bleichenbacher attack"). This… |
CVE-2017-17382 | Medium | 5.9 | 2017-12-13 | Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12… |
CVE-2017-14590 | Critical | 9.1 | 2017-12-13 | Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who has permission to create a repository i… |
CVE-2017-14589 | Critical | 9.6 | 2017-12-13 | It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted administration right… |
CVE-2017-17642 | Critical | 9.8 | 2017-12-13 | Basic Job Site Script 2.0.5 has SQL Injection via the keyword parameter to /job. |
CVE-2017-17641 | Critical | 9.8 | 2017-12-13 | Resume Clone Script 2.0.5 has SQL Injection via the preview.php id parameter. |
CVE-2017-17640 | Critical | 9.8 | 2017-12-13 | Advanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or the state.php country parameter. |
CVE-2017-17639 | Critical | 9.8 | 2017-12-13 | Muslim Matrimonial Script 3.02 has SQL Injection via the success-story.php succid parameter. |
CVE-2017-17638 | Critical | 9.8 | 2017-12-13 | Groupon Clone Script 3.01 has SQL Injection via the city_ajax.php state_id parameter. |
CVE-2017-17637 | Critical | 9.8 | 2017-12-13 | Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter. |
CVE-2017-17636 | Critical | 9.8 | 2017-12-13 | MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter. |
CVE-2017-17635 | Critical | 9.8 | 2017-12-13 | MLM Forex Market Plan Script 2.0.4 has SQL Injection via the news_detail.php newid parameter or the event_detail.php eventid parameter. |
CVE-2017-17634 | Critical | 9.8 | 2017-12-13 | Single Theater Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter. |
CVE-2017-17633 | Critical | 9.8 | 2017-12-13 | Multiplex Movie Theater Booking Script 3.1.5 has SQL Injection via the trailer-detail.php moid parameter, show-time.php moid parameter, or event-detail.php eid… |
CVE-2017-17632 | Critical | 9.8 | 2017-12-13 | Responsive Events And Movie Ticket Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter. |
CVE-2017-17631 | Critical | 9.8 | 2017-12-13 | Multireligion Responsive Matrimonial 4.7.2 has SQL Injection via the success-story.php succid parameter. |
CVE-2017-17630 | Critical | 9.8 | 2017-12-13 | Yoga Class Script 1.0 has SQL Injection via the /list city parameter. |
CVE-2017-17629 | Critical | 9.8 | 2017-12-13 | Secure E-commerce Script 2.0.1 has SQL Injection via the category.php searchmain or searchcat parameter, or the single_detail.php sid parameter. |
CVE-2017-17628 | Critical | 9.8 | 2017-12-13 | Responsive Realestate Script 3.2 has SQL Injection via the property-list tbud parameter. |
CVE-2017-17627 | Critical | 9.8 | 2017-12-13 | Readymade Video Sharing Script 3.2 has SQL Injection via the single-video-detail.php report_videos array parameter. |
CVE-2017-17626 | Critical | 9.8 | 2017-12-13 | Readymade PHP Classified Script 3.3 has SQL Injection via the /categories subctid or mctid parameter. |
CVE-2017-17625 | Critical | 9.8 | 2017-12-13 | Professional Service Script 1.0 has SQL Injection via the service-list city parameter. |
CVE-2017-17624 | Critical | 9.8 | 2017-12-13 | PHP Multivendor Ecommerce 1.0 has SQL Injection via the single_detail.php sid parameter, or the category.php searchcat or chid1 parameter. |