2017 CVEs (page 60)
Page 60 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2890 | High | 8.8 | 2017-11-07 | An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets ca… |
CVE-2017-2889 | High | 7.5 | 2017-11-07 | An exploitable Denial of Service vulnerability exists in the API daemon of Circle with Disney running firmware 2.0.1. A large amount of simultaneous TCP connec… |
CVE-2017-2884 | High | 7.5 | 2017-11-07 | An exploitable vulnerability exists in the user photo update functionality of Circle with Disney running firmware 2.0.1. A repeated set of specially crafted AP… |
CVE-2017-2883 | High | 8.1 | 2017-11-07 | An exploitable vulnerability exists in the database update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can ca… |
CVE-2017-2882 | High | 8.1 | 2017-11-07 | An exploitable vulnerability exists in the servers update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cau… |
CVE-2017-2881 | High | 8.8 | 2017-11-07 | An exploitable vulnerability exists in the torlist update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cau… |
CVE-2017-2866 | High | 8.8 | 2017-11-07 | An exploitable vulnerability exists in the /api/CONFIG/backup functionality of Circle with Disney. Specially crafted network packets can cause an OS command in… |
CVE-2017-2865 | High | 7.5 | 2017-11-07 | An exploitable vulnerability exists in the firmware update functionality of Circle with Disney. Specially crafted network packets can cause the product to run… |
CVE-2017-2864 | Critical | 9.8 | 2017-11-07 | An exploitable vulnerability exists in the generation of authentication token functionality of Circle with Disney. Specially crafted network packets can cause… |
CVE-2017-12096 | Medium | 6.5 | 2017-11-07 | An exploitable vulnerability exists in the WiFi management of Circle with Disney. A crafted Access Point with the same name as the legitimate one can be used t… |
CVE-2017-12094 | High | 7.4 | 2017-11-07 | An exploitable vulnerability exists in the WiFi Channel parsing of Circle with Disney running firmware 2.0.1. A specially crafted SSID can cause the device to… |
CVE-2017-12085 | Critical | 9.0 | 2017-11-07 | An exploitable routing vulnerability exists in the Circle with Disney cloud infrastructure. A specially crafted packet can make the Circle cloud route a packet… |
CVE-2017-12084 | High | 8.0 | 2017-11-07 | A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specific set of network packets can remotely st… |
CVE-2017-12083 | Medium | 5.8 | 2017-11-07 | An exploitable information disclosure vulnerability exists in the apid daemon of the Circle with Disney running firmware 2.0.1. A specially crafted set of pack… |
CVE-2017-15887 | Critical | 9.8 | 2017-11-07 | An improper restriction of excessive authentication attempts vulnerability in /principals in Synology CardDAV Server before 6.0.7-0085 allows remote attackers… |
CVE-2017-6331 | High | 7.1 | 2017-11-06 | Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a type of attack that bypasses the real t… |
CVE-2017-16638 | Critical | 9.8 | 2017-11-06 | The Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the "qemu" group to gain root privileges by creating a hard link in a directory on… |
CVE-2017-13681 | High | 7.8 | 2017-11-06 | Symantec Endpoint Protection prior to SEP 12.1 RU6 MP9 could be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a use… |
CVE-2017-13680 | Medium | 5.5 | 2017-11-06 | Prior to SEP 12.1 RU6 MP9 & SEP 14 RU1 Symantec Endpoint Protection Windows endpoint can encounter a situation whereby an attacker could use the product's UI t… |
CVE-2017-16637 | Medium | 4.4 | 2017-11-06 | In Vectura Perfect Privacy VPN Manager v1.10.10 and v1.10.11, when resetting the network data via the software client, with a running VPN connection, a critica… |
CVE-2017-16636 | Medium | 5.4 | 2017-11-06 | In Bludit v1.5.2 and v2.0.1, an XSS vulnerability is located in the new page, new category, and edit post function body message context. Remote attackers are a… |
CVE-2017-16635 | Medium | 5.4 | 2017-11-06 | In TinyWebGallery v2.4, an XSS vulnerability is located in the `mkname`, `mkitem`, and `item` parameters of the `Add/Create` module. Remote attackers with low-… |
CVE-2017-14031 | High | 7.8 | 2017-11-06 | An Improper Access Control issue was discovered in Trihedral VTScada 11.3.03 and prior. A local, non-administrator user has privileges to read and write to the… |
CVE-2017-14029 | High | 7.8 | 2017-11-06 | An Uncontrolled Search Path Element issue was discovered in Trihedral VTScada 11.3.03 and prior. The program will execute specially crafted malicious dll files… |
CVE-2017-14025 | Medium | 5.5 | 2017-11-06 | An Improper Input Validation issue was discovered in ABB FOX515T release 1.0. An improper input validation vulnerability has been identified, allowing a local… |
CVE-2017-14023 | Medium | 4.9 | 2017-11-06 | An Improper Input Validation issue was discovered in Siemens SIMATIC PCS 7 V8.1 prior to V8.1 SP1 with WinCC V7.3 Upd 13, and V8.2 all versions. The improper i… |
CVE-2017-14016 | Medium | 6.3 | 2017-11-06 | A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. The application lacks proper validation of the lengt… |
CVE-2017-12719 | High | 7.5 | 2017-11-06 | An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A remote attacker is able to execute code to dere… |
CVE-2017-15306 | Medium | 5.5 | 2017-11-06 | The kvm_vm_ioctl_check_extension function in arch/powerpc/kvm/powerpc.c in the Linux kernel before 4.13.11 allows local users to cause a denial of service (NUL… |
CVE-2017-7425 | High | 7.6 | 2017-11-06 | Multiple potential reflected XSS issues exist in NetIQ iManager versions before 2.7.7 Patch 10 HF2 and 3.0.3.2. |
CVE-2017-16001 | High | 7.8 | 2017-11-06 | In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin update process in orde… |
CVE-2017-15672 | High | 8.8 | 2017-11-06 | The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted… |
CVE-2017-11177 | High | 7.5 | 2017-11-06 | TRITON AP-EMAIL 8.2 before 8.2 IB does not properly restrict file access in an unspecified directory. |
CVE-2017-16570 | High | 8.8 | 2017-11-06 | KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In oth… |
CVE-2017-16569 | Medium | 4.8 | 2017-11-06 | An Open URL Redirect issue exists in Zurmo 3.2.1.57987acc3018 via an http: URL in the redirectUrl parameter to app/index.php/meetings/default/createMeeting. |
CVE-2017-16565 | High | 8.8 | 2017-11-06 | Cross-Site Request Forgery (CSRF) in /cgi-bin/login on Vonage (Grandstream) HT802 devices allows attackers to authenticate a user via the login screen using th… |
CVE-2017-16564 | Medium | 5.4 | 2017-11-06 | Stored Cross-site scripting (XSS) vulnerability in /cgi-bin/config2 on Vonage (Grandstream) HT802 devices allows remote authenticated users to inject arbitrary… |
CVE-2017-16563 | High | 8.0 | 2017-11-06 | Cross-Site Request Forgery (CSRF) in the Basic Settings screen on Vonage (Grandstream) HT802 devices allows attackers to modify settings, related to cgi-bin/up… |
CVE-2017-16524 | High | 8.8 | 2017-11-06 | Web Viewer 1.0.0.193 on Samsung SRN-1670D devices suffers from an Unrestricted file upload vulnerability: 'network_ssl_upload.php' allows remote authenticated… |
CVE-2017-15039 | Medium | 4.8 | 2017-11-06 | Cross-site scripting (XSS) exists in Zurmo 3.2.1.57987acc3018 via a data: URL in the redirectUrl parameter to app/index.php/meetings/default/createMeeting. |
CVE-2017-16548 | Critical | 9.8 | 2017-11-06 | The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote… |
CVE-2017-16547 | High | 8.8 | 2017-11-06 | The DrawImage function in magick/render.c in GraphicsMagick 1.3.26 does not properly look for pop keywords that are associated with push keywords, which allows… |
CVE-2017-16546 | High | 8.8 | 2017-11-05 | The ReadWPGImage function in coders/wpg.c in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which allows remote attackers… |
CVE-2017-16545 | High | 8.8 | 2017-11-05 | The ReadWPGImage function in coders/wpg.c in GraphicsMagick 1.3.26 does not properly validate colormapped images, which allows remote attackers to cause a deni… |
CVE-2017-16543 | Critical | 9.8 | 2017-11-05 | Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or… |
CVE-2017-16542 | High | 8.8 | 2017-11-05 | Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name parameter in a manageApplications.do?method=… |
CVE-2017-16540 | High | 7.5 | 2017-11-04 | OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an… |
CVE-2017-16541 | Medium | 6.5 | 2017-11-04 | Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors invol… |
CVE-2017-16539 | Medium | 5.9 | 2017-11-04 | The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data… |
CVE-2017-16538 | Medium | 6.6 | 2017-11-04 | drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (general protection fault and system… |
CVE-2017-16537 | Medium | 6.6 | 2017-11-04 | The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereferenc… |
CVE-2017-16536 | Medium | 6.6 | 2017-11-04 | The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service… |
CVE-2017-16535 | Medium | 6.6 | 2017-11-04 | The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows local users to cause a denial of service (out-of-bou… |
CVE-2017-16534 | Medium | 6.8 | 2017-11-04 | The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bound… |
CVE-2017-16533 | Medium | 6.6 | 2017-11-04 | The usbhid_parse function in drivers/hid/usbhid/hid-core.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (out-of-bounds rea… |
CVE-2017-16532 | Medium | 6.6 | 2017-11-04 | The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dere… |
CVE-2017-16531 | Medium | 6.6 | 2017-11-04 | drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly h… |
CVE-2017-16530 | Medium | 6.6 | 2017-11-04 | The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspeci… |
CVE-2017-16529 | Medium | 6.6 | 2017-11-04 | The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read a… |
CVE-2017-16528 | Medium | 6.6 | 2017-11-04 | sound/core/seq_device.c in the Linux kernel before 4.13.4 allows local users to cause a denial of service (snd_rawmidi_dev_seq_free use-after-free and system c… |
CVE-2017-16527 | Medium | 6.6 | 2017-11-04 | sound/usb/mixer.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (snd_usb_mixer_interrupt use-after-free and system crash) o… |
CVE-2017-16526 | High | 7.8 | 2017-11-04 | drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (general protection fault and system crash) or possibly ha… |
CVE-2017-16525 | Medium | 6.6 | 2017-11-04 | The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service (u… |
CVE-2017-14359 | Medium | 5.4 | 2017-11-03 | A potential security vulnerability has been identified in HPE Performance Center versions 12.20. The vulnerability could be remotely exploited to allow cross-s… |
CVE-2017-1000171 | Critical | 9.8 | 2017-11-03 | Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text. |
CVE-2017-1000157 | Medium | 4.4 | 2017-11-03 | Mahara 15.04 before 15.04.13 and 16.04 before 16.04.7 and 16.10 before 16.10.4 and 17.04 before 17.04.2 are vulnerable to recording plain text passwords in the… |
CVE-2017-1000156 | Medium | 6.5 | 2017-11-03 | Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member… |
CVE-2017-1000155 | Medium | 4.3 | 2017-11-03 | Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to profile pictures being accessed without any access control chec… |
CVE-2017-1000154 | Critical | 9.8 | 2017-11-03 | Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to some authentication methods, which do not use Mahara's built-in… |
CVE-2017-1000153 | Critical | 9.8 | 2017-11-03 | Mahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to incorrect access control after the password reset link is sent… |
CVE-2017-1000152 | Critical | 9.8 | 2017-11-03 | Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 running PHP 5.3 are vulnerable to one user being logged in as another user on a separate computer as the s… |
CVE-2017-1000151 | High | 7.5 | 2017-11-03 | Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to passwords or other sensitive information being passed by unusua… |
CVE-2017-1000150 | High | 8.8 | 2017-11-03 | Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the s… |
CVE-2017-1000149 | Medium | 5.4 | 2017-11-03 | Mahara 1.10 before 1.10.9 and 15.04 before 15.04.6 and 15.10 before 15.10.2 are vulnerable to XSS due to window.opener (target="_blank" and window.open()) |
CVE-2017-1000148 | High | 8.8 | 2017-11-03 | Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML thr… |
CVE-2017-1000147 | Medium | 6.8 | 2017-11-03 | Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery (CSRF) attack on the uploader co… |
CVE-2017-1000146 | Medium | 5.4 | 2017-11-03 | Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to the arbitrary execution of Javascript in the browser of a logged-in u… |
CVE-2017-1000145 | Medium | 4.9 | 2017-11-03 | Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to anonymous comments being able to be placed on artefact detail pages e… |
CVE-2017-1000144 | Medium | 4.8 | 2017-11-03 | Mahara 1.9 before 1.9.6 and 1.10 before 1.10.4 and 15.04 before 15.04.1 are vulnerable to a site admin or institution admin being able to place HTML and Javasc… |
CVE-2017-1000143 | Medium | 4.3 | 2017-11-03 | Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to users receiving watchlist notifications about pa… |
CVE-2017-1000142 | Medium | 6.5 | 2017-11-03 | Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to users being able to delete their submitted page… |
CVE-2017-1000140 | Medium | 5.4 | 2017-11-03 | Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to a maliciously created .xml file that can have it… |
CVE-2017-1000139 | High | 8.0 | 2017-11-03 | Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to server-side request forgery attacks as not all p… |
CVE-2017-1000138 | Medium | 5.4 | 2017-11-03 | Mahara 1.10 before 1.10.0 and 15.04 before 15.04.0 are vulnerable to possible cross site scripting when dragging/dropping files into a collection if the file h… |
CVE-2017-1000137 | Medium | 5.4 | 2017-11-03 | Mahara 1.10 before 1.10.0 and 15.04 before 15.04.0 are vulnerable to possible cross site scripting when adding a text block to a page via the keyboard (rather… |
CVE-2017-1000136 | Medium | 6.5 | 2017-11-03 | Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable to old sessions not being invalidated after a passw… |
CVE-2017-1000135 | Medium | 6.5 | 2017-11-03 | Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable as logged-in users can stay logged in after the ins… |
CVE-2017-1000134 | High | 8.1 | 2017-11-03 | Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable because group members can lose access to the group… |
CVE-2017-1000133 | High | 7.5 | 2017-11-03 | Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to a user - in some circumstances causing another user's artefacts… |
CVE-2017-1000132 | Medium | 4.8 | 2017-11-03 | Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to a maliciously created .swf files that can have i… |
CVE-2017-1000131 | Medium | 6.5 | 2017-11-03 | Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to users staying logged in to their Mahara account even when they… |
CVE-2017-16523 | Critical | 9.8 | 2017-11-03 | MitraStar GPT-2541GNAC (HGU) 1.00(VNJ0)b1 and DSL-100HN-T1 ES_113WJY0b16 devices have a zyad1234 password for the zyad1234 account, which is equivalent to root… |
CVE-2017-16522 | High | 8.8 | 2017-11-03 | MitraStar GPT-2541GNAC (HGU) 1.00(VNJ0)b1 and DSL-100HN-T1 ES_113WJY0b16 devices allow remote authenticated users to obtain root access by specifying /bin/sh a… |
CVE-2017-16516 | High | 7.5 | 2017-11-03 | In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_… |
CVE-2017-16513 | High | 7.8 | 2017-11-03 | Ipswitch WS_FTP Professional before 12.6.0.3 has buffer overflows in the local search field and the backup locations field, aka WSCLT-1729. |
CVE-2017-16237 | High | 7.8 | 2017-11-03 | In Vir.IT eXplorer Anti-Virus before 8.5.42, the driver file (VIAGLT64.SYS) contains an Arbitrary Write vulnerability because of not validating input values fr… |
CVE-2017-11767 | Critical | 9.8 | 2017-11-02 | ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory… |
CVE-2017-3736 | Medium | 6.5 | 2017-11-02 | There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. A… |
CVE-2017-11508 | High | 8.8 | 2017-11-02 | SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient privilege… |
CVE-2017-16510 | Critical | 9.8 | 2017-11-02 | WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plu… |