2017 CVEs (page 49)
Page 49 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-1481 | Medium | 4.3 | 2017-12-07 | IBM Sterling B2B Integrator Standard Edition 5.2 allows a user to view sensitive information that belongs to another user. IBM X-Force ID: 128619. |
CVE-2017-1465 | Medium | 5.4 | 2017-12-07 | IBM TRIRIGA 3.2, 3.3, 3.4, and 3.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web s… |
CVE-2017-1433 | Medium | 6.5 | 2017-12-07 | IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow an authenticated user to insert messages with a corrupt RFH header into the channel which would cause it to rest… |
CVE-2017-1356 | High | 8.8 | 2017-12-07 | IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow… |
CVE-2017-1355 | Low | 3.7 | 2017-12-07 | IBM Atlas eDiscovery Process Management 6.0.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties h… |
CVE-2017-1354 | Medium | 5.4 | 2017-12-07 | IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2017-1353 | Low | 3.5 | 2017-12-07 | IBM Atlas eDiscovery Process Management 6.0.3 could allow an authenticated attacker to obtain sensitive information when an unsuspecting user clicks on unsafe… |
CVE-2017-1342 | Medium | 4.3 | 2017-12-07 | IBM Insights Foundation for Energy 2.0 could reveal sensitive information in error messages to authenticated users that could e used to conduct further attacks… |
CVE-2017-1341 | Low | 3.7 | 2017-12-07 | IBM WebSphere MQ 8.0 and 9.0 could allow, under special circumstances, an unauthorized user to access an object which they should have been denied access. IBM… |
CVE-2017-1336 | Medium | 4.4 | 2017-12-07 | IBM Infosphere BigInsights 4.2.0 could allow an attacker to inject code that could allow access to restricted data and files. IBM X-Force ID: 126244. |
CVE-2017-1271 | High | 7.5 | 2017-12-07 | IBM Security Guardium 9.0, 9.1, and 9.5 supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a p… |
CVE-2017-17430 | Critical | 9.8 | 2017-12-07 | Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote attackers to execute arbitrary commands via the web interface. |
CVE-2017-17384 | High | 8.8 | 2017-12-07 | ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job. |
CVE-2017-17381 | Medium | 6.5 | 2017-12-07 | The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error and QEMU process crash) by unsetting vri… |
CVE-2017-17055 | Critical | 9.0 | 2017-12-07 | Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site scripting (XSS) attack involving the u… |
CVE-2017-16884 | Medium | 6.1 | 2017-12-07 | Cross-site scripting (XSS) vulnerability in MistServer before 2.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to failed… |
CVE-2017-15121 | Medium | 5.5 | 2017-12-07 | A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned… |
CVE-2017-17451 | Medium | 6.1 | 2017-12-07 | The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php. |
CVE-2017-17450 | High | 7.8 | 2017-12-07 | net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which… |
CVE-2017-17449 | Medium | 4.7 | 2017-12-07 | The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observat… |
CVE-2017-17448 | High | 7.8 | 2017-12-07 | net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for new, get, and del operations, which all… |
CVE-2017-17436 | High | 8.8 | 2017-12-07 | An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe… |
CVE-2017-17435 | High | 8.8 | 2017-12-07 | An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this product line withou… |
CVE-2017-17446 | Medium | 6.5 | 2017-12-06 | The Mem_File_Reader::read_avail function in Data_Reader.cpp in the Game_Music_Emu library (aka game-music-emu) 0.6.1 does not ensure a non-negative size, which… |
CVE-2017-17068 | High | 7.5 | 2017-12-06 | A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire auth… |
CVE-2017-6276 | High | 7.8 | 2017-12-06 | NVIDIA mediaserver contains a vulnerability where it is possible a use after free malfunction can occur due to an incorrect bounds check which could enable una… |
CVE-2017-6263 | High | 7.8 | 2017-12-06 | NVIDIA driver contains a vulnerability where it is possible a use after free malfunction can occur due to improper usage of the list_for_each kernel macro whic… |
CVE-2017-6262 | High | 7.0 | 2017-12-06 | NVIDIA driver contains a vulnerability where it is possible a use after free malfunction can occur due to a race condition which could enable unauthorized code… |
CVE-2017-17440 | Medium | 6.5 | 2017-12-06 | GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted GIF, IT (Impulse Track… |
CVE-2017-17439 | High | 7.5 | 2017-12-06 | In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name… |
CVE-2017-13175 | High | 7.5 | 2017-12-06 | An information disclosure vulnerability in the NVIDIA libwilhelm. Product: Android. Versions: Android kernel. Android ID A-64339309. References: N-CVE-2017-131… |
CVE-2017-13174 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the kernel edl. Product: Android. Versions: Android kernel. Android ID A-63100473. |
CVE-2017-13173 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the MediaTek system server. Product: Android. Versions: Android kernel. Android ID A-28067350. References: M-ALPS026… |
CVE-2017-13172 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the MediaTek bluetooth driver. Product: Android. Versions: Android kernel. Android ID A-36493287. References: M-ALPS… |
CVE-2017-13171 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the MediaTek performance service. Product: Android. Versions: Android kernel. Android ID A-64316572. References: M-A… |
CVE-2017-13170 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the MediaTek display driver. Product: Android. Versions: Android kernel. Android ID A-36102397. References: M-ALPS03… |
CVE-2017-13169 | High | 7.5 | 2017-12-06 | An information disclosure vulnerability in the kernel camera server. Product: Android. Versions: Android kernel. Android ID A-37512375. |
CVE-2017-13168 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the kernel scsi driver. Product: Android. Versions: Android kernel. Android ID A-65023233. |
CVE-2017-13167 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the kernel sound timer. Product: Android. Versions: Android kernel. Android ID A-37240993. |
CVE-2017-13166 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the kernel v4l2 video driver. Product: Android. Versions: Android kernel. Android ID A-34624167. |
CVE-2017-13165 | Medium | 5.3 | 2017-12-06 | An elevation of privilege vulnerability in the kernel file system. Product: Android. Versions: Android kernel. Android ID A-31269937. |
CVE-2017-13164 | High | 7.5 | 2017-12-06 | An information disclosure vulnerability in the kernel binder driver. Product: Android. Versions: Android kernel. Android ID A-36007193. |
CVE-2017-13163 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the kernel mtp usb driver. Product: Android. Versions: Android kernel. Android ID A-37429972. |
CVE-2017-13162 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the kernel binder. Product: Android. Versions: Android kernel. Android ID A-64216036. |
CVE-2017-13161 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the Broadcom wireless driver. Product: Android. Versions: Android kernel. Android ID A-63930471. References: BC-V201… |
CVE-2017-13160 | Critical | 9.8 | 2017-12-06 | A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-37160362. |
CVE-2017-13159 | High | 7.5 | 2017-12-06 | An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0… |
CVE-2017-13158 | High | 7.5 | 2017-12-06 | An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0… |
CVE-2017-13157 | High | 7.5 | 2017-12-06 | An information disclosure vulnerability in the Android system (activitymanagerservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0… |
CVE-2017-13156 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-642118… |
CVE-2017-13154 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0… |
CVE-2017-13153 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the Android media framework (libaudioservice). Product: Android. Versions: 8.0. Android ID A-65280854. |
CVE-2017-13152 | High | 7.5 | 2017-12-06 | An information disclosure vulnerability in the Android media framework (libmedia drm). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. A… |
CVE-2017-13151 | High | 8.8 | 2017-12-06 | A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-6… |
CVE-2017-13150 | Critical | 9.1 | 2017-12-06 | An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-38328132. |
CVE-2017-13149 | Critical | 9.1 | 2017-12-06 | An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65719872. |
CVE-2017-13148 | Medium | 6.5 | 2017-12-06 | A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65717… |
CVE-2017-0880 | Medium | 6.5 | 2017-12-06 | A denial of service vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID A-65646012. |
CVE-2017-0879 | Critical | 9.1 | 2017-12-06 | An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65025028. |
CVE-2017-0878 | High | 8.8 | 2017-12-06 | A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 8.0. Android ID A-65186291. |
CVE-2017-0877 | High | 8.8 | 2017-12-06 | A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-66372937. |
CVE-2017-0876 | High | 8.8 | 2017-12-06 | A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-64964675. |
CVE-2017-0874 | Medium | 6.5 | 2017-12-06 | A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-6331593… |
CVE-2017-0873 | Medium | 6.5 | 2017-12-06 | A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63316… |
CVE-2017-0872 | High | 8.8 | 2017-12-06 | A remote code execution vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65290323. |
CVE-2017-0871 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the Android framework (framework base). Product: Android. Versions: 8.0. Android ID A-65281159. |
CVE-2017-0870 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the Android framework (libminikin). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android I… |
CVE-2017-0837 | High | 7.8 | 2017-12-06 | An elevation of privilege vulnerability in the Android media framework (libaudiopolicymanager). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1… |
CVE-2017-17383 | Medium | 4.7 | 2017-12-06 | Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form, as demonstrated by… |
CVE-2017-17069 | High | 7.8 | 2017-12-06 | ActiveSetupN.exe in Amazon Audible for Windows before November 2017 allows attackers to execute arbitrary DLL code if ActiveSetupN.exe is launched from a direc… |
CVE-2017-17434 | Critical | 9.8 | 2017-12-06 | The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv… |
CVE-2017-17433 | Low | 3.7 | 2017-12-06 | The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before… |
CVE-2017-17432 | High | 7.5 | 2017-12-06 | OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system crash or application cr… |
CVE-2017-14374 | Critical | 9.8 | 2017-12-06 | The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 (aka 2016 R3.20) is protected using a hard-coded password. A remote user with the knowl… |
CVE-2017-15868 | High | 7.8 | 2017-12-05 | The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not ensure that an l2cap socket is available, which allows l… |
CVE-2017-14018 | Medium | 4.8 | 2017-12-05 | An improper authentication issue was discovered in Johnson & Johnson Ethicon Endo-Surgery Generator Gen11, all versions released before November 29, 2017. The… |
CVE-2017-4920 | Medium | 5.9 | 2017-12-05 | The implementation of the OSPF protocol in VMware NSX-V Edge 6.2.x prior to 6.2.8 and NSX-V Edge 6.3.x prior to 6.3.3 doesn't correctly handle the link-state a… |
CVE-2017-17431 | Medium | 6.1 | 2017-12-05 | GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter. NOTE: this might overlap CVE-2017-14761, CVE-2017-14762, o… |
CVE-2017-14355 | High | 7.8 | 2017-12-05 | A potential security vulnerability has been identified in HPE Connected Backup versions 8.6 and 8.8.6. The vulnerability could be exploited locally to allow es… |
CVE-2017-9716 | High | 7.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the qbt1000 driver implements an alternative ch… |
CVE-2017-6211 | Critical | 9.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the processing of a downlink supplementary s… |
CVE-2017-14918 | Critical | 9.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the GPS location wireless interface, a Use A… |
CVE-2017-14917 | Critical | 9.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer sizes in the message passing interface a… |
CVE-2017-14916 | Critical | 9.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer sizes in the message passing interface a… |
CVE-2017-14914 | Critical | 9.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, handles in the global client structure can beco… |
CVE-2017-14909 | Critical | 9.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a count value that is read from a file is not p… |
CVE-2017-14908 | Critical | 9.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the SafeSwitch test application does not proper… |
CVE-2017-14904 | High | 7.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a crafted binder request can cause an arbitrary… |
CVE-2017-14902 | High | 7.0 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to a race condition in the GLink kernel dri… |
CVE-2017-14897 | High | 7.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while handling the QSEOS_RPMB_CHECK_PROV_STATUS… |
CVE-2017-14895 | High | 7.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, after a subsystem reset, iwpriv is not giving c… |
CVE-2017-11043 | High | 7.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a WiFI driver function, an integer overflow… |
CVE-2017-11007 | High | 7.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possibility of stack corruption due… |
CVE-2017-11006 | Critical | 9.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a Use After Free condition can occur during pos… |
CVE-2017-11005 | Critical | 9.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a Use After Free condition can occur during a d… |
CVE-2017-17051 | High | 8.6 | 2017-12-05 | An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user ma… |
CVE-2017-9722 | High | 7.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when updating custom EDID (hdmi_tx_sysfs_wta_ed… |
CVE-2017-9718 | High | 7.0 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in a multimedia driver can pot… |
CVE-2017-9710 | High | 7.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, IOCTL interface to send QMI NOTIFY REQ messages… |
CVE-2017-9709 | Critical | 9.8 | 2017-12-05 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a privilege escalation vulnerability exists in… |