2017 CVEs (page 47)
Page 47 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-11885 | Medium | 6.6 | 2017-12-12 | Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Serv… |
CVE-2017-1000385 | Medium | 5.9 | 2017-12-12 | The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content… |
CVE-2017-5717 | High | 7.8 | 2017-12-12 | Type Confusion in Content Protection HECI Service in Intel Graphics Driver allows unprivileged user to elevate privileges via local access. |
CVE-2017-12155 | Medium | 6.3 | 2017-12-12 | A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local… |
CVE-2017-17562 | High | 8.1 | 2017-12-12 | Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the env… |
CVE-2017-17561 | High | 7.2 | 2017-12-12 | SeaCMS 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/admin_ping.php, which interacts with da… |
CVE-2017-17560 | Critical | 9.8 | 2017-12-12 | An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquery/uploader/multi_uploadify.php, provide… |
CVE-2017-17558 | Medium | 6.6 | 2017-12-12 | The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum… |
CVE-2017-16691 | Medium | 6.5 | 2017-12-12 | SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of t… |
CVE-2017-16690 | High | 7.8 | 2017-12-12 | A malicious DLL preload attack possible on NwSapSetup and Installation self-extracting program for SAP Plant Connectivity 2.3 and 15.0. It is possible that SAP… |
CVE-2017-16689 | High | 8.8 | 2017-12-12 | A Trusted RFC connection in SAP KERNEL 32NUC, SAP KERNEL 32Unicode, SAP KERNEL 64NUC, SAP KERNEL 64Unicode 7.21, 7.21EXT, 7.22, 7.22EXT; SAP KERNEL from 7.21 t… |
CVE-2017-16687 | Medium | 5.3 | 2017-12-12 | The user self-service tools of SAP HANA extended application services, classic user self-service, a part of SAP HANA Database versions 1.00 and 2.00, can be mi… |
CVE-2017-16685 | Medium | 6.1 | 2017-12-12 | Cross-Site scripting (XSS) in SAP Business Warehouse Universal Data Integration, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to insufficient encoding… |
CVE-2017-16684 | Critical | 9.8 | 2017-12-12 | SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, and 4.30, does not perform authentication checks for functionalities that re… |
CVE-2017-16683 | Medium | 6.5 | 2017-12-12 | Denial of Service (DOS) in SAP Business Objects Platform, Enterprise 4.10 and 4.20, that could allow an attacker to prevent legitimate users from accessing a s… |
CVE-2017-16682 | High | 7.2 | 2017-12-12 | SAP NetWeaver Internet Transaction Server (ITS), SAP Basis from 7.00 to 7.02, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker with administrator creden… |
CVE-2017-16681 | Medium | 6.1 | 2017-12-12 | Cross-Site Scripting (XSS) vulnerability in SAP Business Intelligence Promotion Management Application, Enterprise 4.10, 4.20, 4.30, as user controlled inputs… |
CVE-2017-16680 | High | 7.5 | 2017-12-12 | Two potential audit log injections in SAP HANA extended application services 1.0, advanced model: 1) Certain HTTP/REST endpoints of controller service are miss… |
CVE-2017-16679 | Medium | 6.1 | 2017-12-12 | URL redirection vulnerability in SAP's Startup Service, SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22… |
CVE-2017-16678 | Medium | 4.7 | 2017-12-12 | Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7… |
CVE-2017-17555 | Medium | 6.5 | 2017-12-12 | The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products, allows rem… |
CVE-2017-17554 | Medium | 5.5 | 2017-12-12 | A NULL pointer dereference (DoS) Vulnerability was found in the function aubio_source_avcodec_readframe in io/source_avcodec.c of aubio 0.4.6, which may lead t… |
CVE-2017-17553 | Medium | 5.3 | 2017-12-12 | The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. This vulnerability could allow attackers to ab… |
CVE-2017-2886 | High | 7.8 | 2017-12-11 | A memory corruption vulnerability exists in the .PSD parsing functionality of ACDSee Ultimate 10.0.0.292. A specially crafted .PSD file can cause an out of bou… |
CVE-2017-8867 | Medium | 5.9 | 2017-12-11 | Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 use AES-128 with ECB mode to encrypt voice traffic between the device and remote se… |
CVE-2017-8866 | Medium | 5.9 | 2017-12-11 | Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 share a fixed small pool of hardcoded keys, allowing a remote attacker to use a dif… |
CVE-2017-8865 | Medium | 5.9 | 2017-12-11 | Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 do not provide sufficient protections against capture-replay attacks, allowing an a… |
CVE-2017-1760 | High | 7.1 | 2017-12-11 | IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow a local user to crash the queue manager agent thread and expose some sensitive information. IBM X-Force ID: 1264… |
CVE-2017-1683 | Medium | 5.4 | 2017-12-11 | IBM Connections Engagement Center 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI t… |
CVE-2017-1632 | Medium | 5.4 | 2017-12-11 | IBM Sterling File Gateway 2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2017-1613 | Medium | 5.3 | 2017-12-11 | IBM Connections 6.0 could allow an unauthenticated remote attacker to gain unauthenticated or unauthorized access to non-sensitive Engagement Center template d… |
CVE-2017-1606 | High | 8.8 | 2017-12-11 | IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) 3.0.0.0 through 3.0.0.7 is vulnerable to SQL injection. A remote attacker could send specially-… |
CVE-2017-15897 | Low | 3.1 | 2017-12-11 | Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified… |
CVE-2017-15896 | Critical | 9.1 | 2017-12-11 | Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active net… |
CVE-2017-1550 | Medium | 6.5 | 2017-12-11 | IBM Sterling File Gateway 2.2 could allow an authenticated user to change other user's passwords. IBM X-Force ID: 131290. |
CVE-2017-1549 | Medium | 5.4 | 2017-12-11 | IBM Sterling File Gateway 2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2017-1548 | Medium | 5.3 | 2017-12-11 | IBM Sterling File Gateway 2.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request conta… |
CVE-2017-1536 | Medium | 5.4 | 2017-12-11 | IBM Support Tools for Lotus WCM (IBM WebSphere Portal 7.0, 8.0, 8.5 and 9.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed ar… |
CVE-2017-1507 | Medium | 4.3 | 2017-12-11 | IBM Jazz Foundation Products could disclose sensitive information during a scan that could lead to further attacks against the system. IBM X-Force ID: 129619. |
CVE-2017-1000407 | High | 7.4 | 2017-12-11 | The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel p… |
CVE-2017-17551 | High | 8.8 | 2017-12-11 | The Backup and Restore feature in Mobotap Dolphin Browser for Android 12.0.2 suffers from an arbitrary file write vulnerability when attempting to restore brow… |
CVE-2017-17111 | Critical | 9.8 | 2017-12-11 | Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-details.php?ID= request. |
CVE-2017-17110 | Critical | 9.8 | 2017-12-11 | Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request. |
CVE-2017-15944 | Critical | 9.8 | 2017-12-11 | Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via… |
CVE-2017-15943 | Medium | 5.3 | 2017-12-11 | The configuration file import for applications, spyware and vulnerability objects functionality in the web interface in Palo Alto Networks PAN-OS before 6.1.19… |
CVE-2017-15942 | High | 7.5 | 2017-12-11 | Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.13, and 8.0.x before 8.0.6 allows remote attackers to cause a denial of service… |
CVE-2017-15940 | Critical | 9.8 | 2017-12-11 | The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8… |
CVE-2017-15870 | Medium | 6.7 | 2017-12-11 | Palo Alto Networks GlobalProtect Agent before 4.0.3 allows attackers with administration rights on the local station to gain SYSTEM privileges via vectors invo… |
CVE-2017-11319 | High | 8.8 | 2017-12-11 | Perspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and consequently gain privileges by leveragi… |
CVE-2017-16723 | Medium | 6.1 | 2017-12-11 | A Cross-site Scripting issue was discovered in PHOENIX CONTACT FL COMSERVER BASIC 232/422/485, FL COMSERVER UNI 232/422/485, FL COMSERVER BAS 232/422/485-T, FL… |
CVE-2017-13070 | High | 7.8 | 2017-12-11 | A DLL Hijacking vulnerability in QNAP Qsync for Windows (exe) version 4.2.2.0724 and earlier could allow remote attackers to execute arbitrary code on Windows… |
CVE-2017-11507 | Medium | 6.1 | 2017-12-11 | A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9, allowing an unauthenticated attack… |
CVE-2017-15708 | Critical | 9.8 | 2017-12-11 | In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2… |
CVE-2017-17536 | High | 8.8 | 2017-12-11 | Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary… |
CVE-2017-17523 | High | 8.8 | 2017-12-11 | lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows r… |
CVE-2017-17512 | High | 8.8 | 2017-12-11 | sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which al… |
CVE-2017-11463 | High | 8.8 | 2017-12-11 | In Ivanti Service Desk (formerly LANDESK Management Suite) versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/upd… |
CVE-2017-17509 | High | 8.8 | 2017-12-11 | In HDF5 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in libhdf5.a. For example, h5dump would crash o… |
CVE-2017-17508 | Medium | 6.5 | 2017-12-11 | In HDF5 1.10.1, there is a divide-by-zero vulnerability in the function H5T_set_loc in the H5T.c file in libhdf5.a. For example, h5dump would crash when someon… |
CVE-2017-17507 | Medium | 6.5 | 2017-12-11 | In HDF5 1.10.1, there is an out of bounds read vulnerability in the function H5T_conv_struct_opt in H5Tconv.c in libhdf5.a. For example, h5dump would crash whe… |
CVE-2017-17506 | Medium | 6.5 | 2017-12-11 | In HDF5 1.10.1, there is an out of bounds read vulnerability in the function H5Opline_pline_decode in H5Opline.c in libhdf5.a. For example, h5dump would crash… |
CVE-2017-17505 | Medium | 6.5 | 2017-12-11 | In HDF5 1.10.1, there is a NULL pointer dereference in the function H5O_pline_decode in the H5Opline.c file in libhdf5.a. For example, h5dump would crash when… |
CVE-2017-17504 | Medium | 6.5 | 2017-12-11 | ImageMagick before 7.0.7-12 has a coders/png.c Magick_png_read_raw_profile heap-based buffer over-read via a crafted file, related to ReadOneMNGImage. |
CVE-2017-17503 | High | 8.8 | 2017-12-11 | ReadGRAYImage in coders/gray.c in GraphicsMagick 1.3.26 has a magick/import.c ImportGrayQuantumType heap-based buffer over-read via a crafted file. |
CVE-2017-17502 | High | 8.8 | 2017-12-11 | ReadCMYKImage in coders/cmyk.c in GraphicsMagick 1.3.26 has a magick/import.c ImportCMYKQuantumType heap-based buffer over-read via a crafted file. |
CVE-2017-17501 | High | 8.8 | 2017-12-11 | WriteOnePNGImage in coders/png.c in GraphicsMagick 1.3.26 has a heap-based buffer over-read via a crafted file. |
CVE-2017-17500 | High | 8.8 | 2017-12-11 | ReadRGBImage in coders/rgb.c in GraphicsMagick 1.3.26 has a magick/import.c ImportRGBQuantumType heap-based buffer over-read via a crafted file. |
CVE-2017-17499 | Critical | 9.8 | 2017-12-11 | ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in Magick::Image::read in Magick++/lib/Image.cpp. |
CVE-2017-17498 | High | 8.8 | 2017-12-11 | WritePNMImage in coders/pnm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (bit_stream.c MagickBitStreamMSBWrite heap-based bu… |
CVE-2017-16789 | Medium | 4.8 | 2017-12-11 | Cross-site scripting (XSS) vulnerability in Integration Matters nJAMS 3 before 3.2.0 Hotfix 7, as used in TIBCO BusinessWorks Process Monitor through 3.0.1.3 a… |
CVE-2017-17497 | High | 7.5 | 2017-12-10 | In Tidy 5.7.0, the prvTidyTidyMetaCharset function in clean.c allows attackers to cause a denial of service (Segmentation Fault), because the currentNode varia… |
CVE-2017-17484 | Critical | 9.8 | 2017-12-10 | The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through 60.1 mishandles ucnv_convertEx calls for UTF-8 to… |
CVE-2017-16241 | High | 7.5 | 2017-12-10 | Incorrect access control in AMAG Symmetry Door Edge Network Controllers (EN-1DBC Boot App 23611 03.60 and STD App 23603 03.60; EN-2DBC Boot App 24451 01.00 and… |
CVE-2017-3114 | Critical | 9.8 | 2017-12-09 | An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is p… |
CVE-2017-3112 | Critical | 9.8 | 2017-12-09 | An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is p… |
CVE-2017-3111 | High | 7.5 | 2017-12-09 | An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. Sensitive tokens are included in http GET requests under certain circumstances. |
CVE-2017-3109 | Medium | 6.1 | 2017-12-09 | An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. Adobe Experience Manager has a reflected cross-site scripting vulnerability in the Html… |
CVE-2017-16420 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16419 | Medium | 6.5 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16418 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16417 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16416 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16415 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16414 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16413 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16412 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16411 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16410 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16409 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16408 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16407 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16406 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16405 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16404 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16403 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16402 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16401 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16400 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16399 | High | 8.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |
CVE-2017-16398 | Critical | 9.8 | 2017-12-09 | An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi… |