2017 CVEs (page 51)
Page 51 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-15607 | Critical | 9.8 | 2017-12-01 | Inedo Otter before 1.7.4 has directory traversal in filesystem-based rafts via vectors involving '/' characters or initial '.' characters, aka OT-181. |
CVE-2017-11286 | High | 7.5 | 2017-12-01 | Adobe ColdFusion has an XML external entity (XXE) injection vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and ea… |
CVE-2017-11285 | Medium | 6.1 | 2017-12-01 | Adobe ColdFusion has a cross-site scripting (XSS) vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier vers… |
CVE-2017-11284 | Critical | 9.8 | 2017-12-01 | Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier… |
CVE-2017-11283 | Critical | 9.8 | 2017-12-01 | Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier… |
CVE-2017-11282 | Critical | 9.8 | 2017-12-01 | Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution. T… |
CVE-2017-11281 | Critical | 9.8 | 2017-12-01 | Adobe Flash Player has an exploitable memory corruption vulnerability in the text handling function. Successful exploitation could lead to arbitrary code execu… |
CVE-2017-1000405 | High | 7.0 | 2017-11-30 | The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd() function inside the THP implementation. touch_pmd() ca… |
CVE-2017-17081 | Medium | 6.5 | 2017-11-30 | The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 2.3 and 3.4 does not properly validate widths and heights, which allows remote attackers to cau… |
CVE-2017-17080 | Medium | 5.5 | 2017-11-30 | elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate sizes of core notes, which allows remo… |
CVE-2017-1000406 | High | 7.5 | 2017-11-30 | OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used until the Karaf cache is manually cleare… |
CVE-2017-3764 | Medium | 5.3 | 2017-11-30 | A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with… |
CVE-2017-15116 | Medium | 5.5 | 2017-11-30 | The rngapi_reset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service (NULL pointer dereference). |
CVE-2017-14949 | High | 7.5 | 2017-11-30 | Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only… |
CVE-2017-14868 | High | 7.5 | 2017-11-30 | Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request… |
CVE-2017-17065 | High | 7.5 | 2017-11-30 | An issue was discovered on D-Link DIR-605L Model B before FW2.11betaB06_hbrf devices, related to the code that handles the authentication values for HNAP. An a… |
CVE-2017-12631 | High | 8.8 | 2017-11-30 | Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnera… |
CVE-2017-12372 | Critical | 9.6 | 2017-11-30 | A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF)… |
CVE-2017-12371 | Critical | 9.6 | 2017-11-30 | A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF)… |
CVE-2017-12370 | Critical | 9.6 | 2017-11-30 | A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF)… |
CVE-2017-12369 | Critical | 9.6 | 2017-11-30 | A "Cisco WebEx Network Recording Player Out-of-Bounds Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) and Web… |
CVE-2017-12368 | Critical | 9.6 | 2017-11-30 | A "Cisco WebEx Network Recording Player Remote Code Execution Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF)… |
CVE-2017-12367 | Critical | 9.6 | 2017-11-30 | A "Cisco WebEx Network Recording Player Denial of Service Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) and… |
CVE-2017-12366 | Medium | 6.1 | 2017-11-30 | A vulnerability in Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of… |
CVE-2017-12365 | Medium | 4.3 | 2017-11-30 | A vulnerability in Cisco WebEx Event Center could allow an authenticated, remote attacker to view unlisted meeting information. The vulnerability is due to a d… |
CVE-2017-12364 | Medium | 6.5 | 2017-11-30 | A SQL Injection vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unauthorized Struc… |
CVE-2017-12363 | Medium | 5.3 | 2017-11-30 | A vulnerability in Cisco WebEx Meeting Server could allow an unauthenticated, remote attacker to modify the welcome message of a meeting on an affected system… |
CVE-2017-12362 | Medium | 6.5 | 2017-11-30 | A vulnerability in Cisco Meeting Server versions prior to 2.2.2 could allow an authenticated, remote attacker to cause the system to reload, resulting in a den… |
CVE-2017-12361 | Medium | 4.0 | 2017-11-30 | A vulnerability in Cisco Jabber for Windows could allow an unauthenticated, local attacker to access sensitive communications made by the Jabber client. An att… |
CVE-2017-12360 | Medium | 4.3 | 2017-11-30 | A vulnerability in Cisco WebEx Network Recording Player for WebEx Recording Format (WRF) files could allow an attacker to cause a denial of service (DoS) condi… |
CVE-2017-12359 | Medium | 6.5 | 2017-11-30 | A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (.arf) files could allow an attacker to execute arbitrary… |
CVE-2017-12358 | Medium | 5.4 | 2017-11-30 | A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an authenticated, remote attacker to condu… |
CVE-2017-12357 | Medium | 5.4 | 2017-11-30 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a cross-… |
CVE-2017-12356 | Medium | 6.1 | 2017-11-30 | A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an unauthenticated, remote attacker to con… |
CVE-2017-12355 | Medium | 5.3 | 2017-11-30 | A vulnerability in the Local Packet Transport Services (LPTS) ingress frame-processing functionality of Cisco IOS XR Software could allow an unauthenticated, r… |
CVE-2017-12354 | Medium | 5.3 | 2017-11-30 | A vulnerability in the web-based interface of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to view sensitive inform… |
CVE-2017-12353 | Medium | 5.8 | 2017-11-30 | A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an… |
CVE-2017-12352 | Medium | 6.7 | 2017-11-30 | A vulnerability in certain system script files that are installed at boot time on Cisco Application Policy Infrastructure Controllers could allow an authentica… |
CVE-2017-12351 | Medium | 5.7 | 2017-11-30 | A vulnerability in the guest shell feature of Cisco NX-OS System Software could allow an authenticated, local attacker to read and send packets outside the sco… |
CVE-2017-12349 | Medium | 5.4 | 2017-11-30 | Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cross-site scripting (X… |
CVE-2017-12348 | Medium | 5.4 | 2017-11-30 | Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cross-site scripting (X… |
CVE-2017-12347 | Medium | 6.1 | 2017-11-30 | Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration… |
CVE-2017-12346 | Medium | 6.1 | 2017-11-30 | Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration… |
CVE-2017-12345 | Medium | 4.7 | 2017-11-30 | Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration… |
CVE-2017-12344 | Medium | 6.1 | 2017-11-30 | Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration… |
CVE-2017-12343 | High | 8.8 | 2017-11-30 | Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration… |
CVE-2017-12342 | Medium | 6.8 | 2017-11-30 | A vulnerability in the Open Agent Container (OAC) feature of Cisco Nexus Series Switches could allow an unauthenticated, local attacker to read and send packet… |
CVE-2017-12341 | Medium | 6.7 | 2017-11-30 | A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. An attacker would… |
CVE-2017-12340 | Medium | 4.2 | 2017-11-30 | A vulnerability in Cisco NX-OS System Software running on Cisco MDS Multilayer Director Switches, Cisco Nexus 7000 Series Switches, and Cisco Nexus 7700 Series… |
CVE-2017-12339 | Medium | 5.7 | 2017-11-30 | A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability… |
CVE-2017-12338 | Medium | 6.0 | 2017-11-30 | A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to read the contents of arbitrary files. The vulnerabili… |
CVE-2017-12336 | Medium | 4.2 | 2017-11-30 | A vulnerability in the TCL scripting subsystem of Cisco NX-OS System Software could allow an authenticated, local attacker to escape the interactive TCL shell… |
CVE-2017-12335 | Medium | 6.3 | 2017-11-30 | A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability… |
CVE-2017-12334 | Medium | 6.7 | 2017-11-30 | A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. An attacker would… |
CVE-2017-12333 | Medium | 6.7 | 2017-11-30 | A vulnerability in Cisco NX-OS System Software could allow an authenticated, local attacker to bypass signature verification when loading a software image. The… |
CVE-2017-12332 | Medium | 4.4 | 2017-11-30 | A vulnerability in Cisco NX-OS System Software patch installation could allow an authenticated, local attacker to write a file to arbitrary locations. The vuln… |
CVE-2017-12331 | Medium | 6.7 | 2017-11-30 | A vulnerability in Cisco NX-OS System Software could allow an authenticated, local attacker to bypass signature verification when loading a software patch. The… |
CVE-2017-12330 | Medium | 6.3 | 2017-11-30 | A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability… |
CVE-2017-12329 | Medium | 6.3 | 2017-11-30 | A vulnerability in the CLI of Cisco Firepower Extensible Operating System (FXOS) and NX-OS System Software could allow an authenticated, local attacker to perf… |
CVE-2017-12328 | Medium | 5.8 | 2017-11-30 | A vulnerability in Session Initiation Protocol (SIP) call handling in Cisco IP Phone 8800 Series devices could allow an unauthenticated, remote attacker to cau… |
CVE-2017-12297 | Medium | 5.0 | 2017-11-30 | A vulnerability in Cisco WebEx Meeting Center could allow an authenticated, remote attacker to initiate connections to arbitrary hosts, aka a "URL Redirection… |
CVE-2017-17067 | Critical | 9.8 | 2017-11-30 | Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and 6.3.x before 6.3.12, when the SAML auth… |
CVE-2017-14198 | High | 8.8 | 2017-11-30 | An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. Authenticated users with permissions to edit design assets can cause Remote Co… |
CVE-2017-14197 | Medium | 6.1 | 2017-11-30 | An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. There are multiple reflected Cross-Site Scripting (XSS) issues in Matrix WYSIW… |
CVE-2017-14196 | High | 7.5 | 2017-11-30 | An issue was discovered in Squiz Matrix from 5.3 through to 5.3.6.1 and 5.4.1.3. An information disclosure caused by a Path Traversal issue in the 'File Bridge… |
CVE-2017-14591 | Critical | 9.0 | 2017-11-29 | Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, all… |
CVE-2017-14189 | Critical | 9.8 | 2017-11-29 | An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regardless the… |
CVE-2017-14186 | Medium | 5.4 | 2017-11-29 | A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote… |
CVE-2017-8818 | Critical | 9.8 | 2017-11-29 | curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash) or possibly have u… |
CVE-2017-8817 | Critical | 9.8 | 2017-11-29 | The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or… |
CVE-2017-8816 | Critical | 9.8 | 2017-11-29 | The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resul… |
CVE-2017-14378 | Critical | 10.0 | 2017-11-29 | EMC RSA Authentication Agent API 8.5 for C and RSA Authentication Agent SDK 8.6 for C allow attackers to bypass authentication, aka an "Error Handling Vulnerab… |
CVE-2017-14377 | Critical | 9.8 | 2017-11-29 | EMC RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618 ha… |
CVE-2017-17059 | Medium | 6.1 | 2017-11-29 | XSS exists in the amtyThumb amty-thumb-recent-post (aka amtyThumb posts or wp-thumb-post) plugin 8.1.3 for WordPress via the query string to amtyThumbPostsAdmi… |
CVE-2017-13872 | High | 8.1 | 2017-11-29 | An issue was discovered in certain Apple products. macOS High Sierra before Security Update 2017-001 is affected. The issue involves the "Directory Utility" co… |
CVE-2017-17058 | High | 7.5 | 2017-11-29 | The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, whi… |
CVE-2017-17054 | Medium | 5.5 | 2017-11-29 | In aubio 0.4.6, a divide-by-zero error exists in the function new_aubio_source_wavread() in source_wavread.c, which may lead to DoS when playing a crafted audi… |
CVE-2017-17053 | High | 7.0 | 2017-11-29 | The init_new_context function in arch/x86/include/asm/mmu_context.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table allocati… |
CVE-2017-17052 | High | 7.8 | 2017-11-29 | The mm_init function in kernel/fork.c in the Linux kernel before 4.12.10 does not clear the ->exe_file member of a new process's mm_struct, allowing a local at… |
CVE-2017-17050 | High | 7.8 | 2017-11-29 | TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a… |
CVE-2017-17049 | High | 7.8 | 2017-11-29 | TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a… |
CVE-2017-17046 | Medium | 6.5 | 2017-11-28 | An issue was discovered in Xen through 4.9.x on the ARM platform allowing guest OS users to obtain sensitive information from DRAM after a reboot, because disj… |
CVE-2017-17045 | High | 8.8 | 2017-11-28 | An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to gain privileges on the host OS, obtain sensitive information, or cause a denial of… |
CVE-2017-17044 | Medium | 6.5 | 2017-11-28 | An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to cause a denial of service (infinite loop and host OS hang) by leveraging the mishan… |
CVE-2017-17043 | Medium | 6.1 | 2017-11-28 | The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/temp… |
CVE-2017-17042 | High | 7.5 | 2017-11-28 | lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct dir… |
CVE-2017-9315 | Critical | 9.8 | 2017-11-28 | Customer of Dahua IP camera or IP PTZ could submit relevant device information to receive a time limited temporary password from Dahua authorized dealer to res… |
CVE-2017-16952 | Medium | 5.5 | 2017-11-28 | KMPlayer 4.2.2.4 allows remote attackers to cause a denial of service via a crafted NSV file. |
CVE-2017-16951 | Medium | 5.5 | 2017-11-28 | Winamp Pro 5.66 Build 3512 allows remote attackers to cause a denial of service via a crafted WAV, WMV, AU, ASF, AIFF, or AIF file. |
CVE-2017-15673 | High | 7.2 | 2017-11-28 | The files function in the administration section in CS-Cart 4.6.2 and earlier allows attackers to execute arbitrary PHP code via vectors involving a custom pag… |
CVE-2017-8020 | Critical | 9.8 | 2017-11-28 | An issue was discovered in EMC ScaleIO 2.0.1.x. A buffer overflow vulnerability in the SDBG service may potentially allow a remote unauthenticated attacker to… |
CVE-2017-8019 | High | 7.5 | 2017-11-28 | An issue was discovered in EMC ScaleIO 2.0.1.x. A vulnerability in message parsers (MDM, SDS, and LIA) could potentially allow an unauthenticated remote attack… |
CVE-2017-8001 | High | 8.4 | 2017-11-28 | An issue was discovered in EMC ScaleIO 2.0.1.x. In a Linux environment, one of the support scripts saves the credentials of the ScaleIO MDM user who executed t… |
CVE-2017-14389 | Medium | 6.5 | 2017-11-28 | An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), and cf-deployment (al… |
CVE-2017-14379 | Medium | 5.4 | 2017-11-28 | EMC RSA Authentication Manager before 8.2 SP1 P6 has a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise… |
CVE-2017-15275 | High | 7.5 | 2017-11-27 | Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory. |
CVE-2017-14746 | Critical | 9.8 | 2017-11-27 | Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request. |
CVE-2017-1689 | Medium | 5.4 | 2017-11-27 | IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2017-1688 | Medium | 5.4 | 2017-11-27 | IBM DOORS Next Generation (DNG/RRC) 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2017-1678 | Medium | 5.4 | 2017-11-27 | IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |