2017 CVEs (page 61)
Page 61 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12295 | Medium | 5.3 | 2017-11-02 | A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the application. An attacker coul… |
CVE-2017-12294 | Medium | 5.4 | 2017-11-02 | A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of t… |
CVE-2017-12283 | Medium | 6.1 | 2017-11-02 | A vulnerability in the handling of 802.11w Protected Management Frames (PAF) by Cisco Aironet 3800 Series Access Points could allow an unauthenticated, adjacen… |
CVE-2017-12282 | Medium | 6.1 | 2017-11-02 | A vulnerability in the Access Network Query Protocol (ANQP) ingress frame processing functionality of Cisco Wireless LAN Controllers could allow an unauthentic… |
CVE-2017-12281 | High | 7.5 | 2017-11-02 | A vulnerability in the implementation of Protected Extensible Authentication Protocol (PEAP) functionality for standalone configurations of Cisco Aironet 1800… |
CVE-2017-12280 | High | 7.5 | 2017-11-02 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) Discovery Request parsing functionality of Cisco Wireless LAN Controllers co… |
CVE-2017-12279 | Medium | 4.3 | 2017-11-02 | A vulnerability in the packet processing code of Cisco IOS Software for Cisco Aironet Access Points could allow an unauthenticated, adjacent attacker to retrie… |
CVE-2017-12278 | Medium | 6.3 | 2017-11-02 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco Wireless LAN Controllers could allow an authenticated, remote attacker to c… |
CVE-2017-12277 | High | 8.8 | 2017-11-02 | A vulnerability in the Smart Licensing Manager service of the Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Firepower 9300 Security Appliance… |
CVE-2017-12276 | High | 8.1 | 2017-11-02 | A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated… |
CVE-2017-12275 | High | 7.4 | 2017-11-02 | A vulnerability in the implementation of 802.11v Basic Service Set (BSS) Transition Management functionality in Cisco Wireless LAN Controllers could allow an u… |
CVE-2017-12274 | Medium | 6.5 | 2017-11-02 | A vulnerability in Extensible Authentication Protocol (EAP) ingress frame processing for the Cisco Aironet 1560, 2800, and 3800 Series Access Points could allo… |
CVE-2017-12273 | Medium | 6.5 | 2017-11-02 | A vulnerability in 802.11 association request frame processing for the Cisco Aironet 1560, 2800, and 3800 Series Access Points could allow an unauthenticated… |
CVE-2017-12262 | High | 8.8 | 2017-11-02 | A vulnerability within the firewall configuration of the Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) could allow an unauthen… |
CVE-2017-12261 | High | 7.8 | 2017-11-02 | A vulnerability in the restricted shell of the Cisco Identity Services Engine (ISE) that is accessible via SSH could allow an authenticated, local attacker to… |
CVE-2017-12243 | High | 7.8 | 2017-11-02 | A vulnerability in the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Secu… |
CVE-2017-10873 | High | 8.1 | 2017-11-02 | OpenAM (Open Source Edition) allows an attacker to bypass authentication and access unauthorized contents via unspecified vectors. Note that this vulnerability… |
CVE-2017-10870 | High | 7.8 | 2017-11-02 | Memory corruption vulnerability in Rakuraku Hagaki (Rakuraku Hagaki 2018, Rakuraku Hagaki 2017, Rakuraku Hagaki 2016) and Rakuraku Hagaki Select for Ichitaro (… |
CVE-2017-10825 | High | 7.8 | 2017-11-02 | Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in… |
CVE-2017-1554 | Medium | 5.4 | 2017-11-01 | IBM Infosphere BigInsights 4.2.0 and 4.2.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicio… |
CVE-2017-1553 | Medium | 5.4 | 2017-11-01 | IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2017-1552 | Medium | 5.4 | 2017-11-01 | IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker… |
CVE-2017-1340 | Medium | 5.0 | 2017-11-01 | IBM Jazz Reporting Service (JRS) 6.0.4 could allow an authenticated user to obtain information on another server that the current report builder interacts with… |
CVE-2017-1333 | Medium | 5.3 | 2017-11-01 | IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow an unauthenticated user to obtain sensitive information about the server that could be used in future… |
CVE-2017-1300 | High | 8.8 | 2017-11-01 | IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2017-1290 | Medium | 5.4 | 2017-11-01 | IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W… |
CVE-2017-1148 | Medium | 5.3 | 2017-11-01 | IBM OpenPages GRC Platform 7.2 and 7.3 with OpenPages Loss Event Entry (LEE) application could allow a user to obtain sensitive information including private A… |
CVE-2017-1147 | Medium | 5.4 | 2017-11-01 | IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W… |
CVE-2017-1000122 | Medium | 5.3 | 2017-11-01 | The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromised secondary proce… |
CVE-2017-1000121 | Critical | 9.8 | 2017-11-01 | The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised secondary process… |
CVE-2017-16359 | Medium | 5.5 | 2017-11-01 | In radare 2.0.1, a pointer wraparound vulnerability exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c. |
CVE-2017-16358 | High | 7.8 | 2017-11-01 | In radare 2.0.1, an out-of-bounds read vulnerability exists in string_scan_range() in libr/bin/bin.c when doing a string search. |
CVE-2017-16357 | High | 7.8 | 2017-11-01 | In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c, a… |
CVE-2017-15918 | High | 7.8 | 2017-11-01 | Sera 1.2 stores the user's login password in plain text in their home directory. This makes privilege escalation trivial and also exposes the user and system k… |
CVE-2017-15566 | High | 7.8 | 2017-11-01 | Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, allowing privilege es… |
CVE-2017-14992 | Medium | 6.5 | 2017-11-01 | Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and ea… |
CVE-2017-1001001 | Medium | 5.4 | 2017-11-01 | PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalation of privileges. |
CVE-2017-16353 | Medium | 6.5 | 2017-11-01 | GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function of the magick/describe.c file, because… |
CVE-2017-16352 | High | 8.8 | 2017-11-01 | GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overflow vulnerability found in the "Display visual image directory" feature of the DescribeImage()… |
CVE-2017-12625 | Medium | 4.3 | 2017-11-01 | Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views… |
CVE-2017-1000245 | Critical | 9.8 | 2017-11-01 | The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are sto… |
CVE-2017-1000244 | High | 8.8 | 2017-11-01 | Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification |
CVE-2017-1000243 | Medium | 4.3 | 2017-11-01 | Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites |
CVE-2017-1000242 | Low | 3.3 | 2017-11-01 | Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure |
CVE-2017-14027 | Critical | 9.8 | 2017-11-01 | A Use of Hard-coded Credentials issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX version 1.4, JetNe… |
CVE-2017-14021 | Critical | 9.8 | 2017-11-01 | A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX version 1.4… |
CVE-2017-16248 | High | 7.5 | 2017-11-01 | The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathn… |
CVE-2017-16244 | High | 8.8 | 2017-11-01 | Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker t… |
CVE-2017-15535 | Critical | 9.1 | 2017-11-01 | MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression)… |
CVE-2017-14376 | High | 7.8 | 2017-11-01 | EMC AppSync Server prior to 3.5.0.1 contains database accounts with hardcoded passwords that could potentially be exploited by malicious users to compromise th… |
CVE-2017-14375 | Critical | 9.8 | 2017-11-01 | EMC Unisphere for VMAX Virtual Appliance (vApp) versions prior to 8.4.0.15, EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.15, EMC VASA Virtua… |
CVE-2017-1000257 | Critical | 9.1 | 2017-10-31 | An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on… |
CVE-2017-1000383 | Medium | 5.5 | 2017-10-31 | GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting in files that may b… |
CVE-2017-1000382 | Medium | 5.5 | 2017-10-31 | VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world… |
CVE-2017-10954 | High | 8.8 | 2017-10-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security Internet Security 2018 prior… |
CVE-2017-10953 | High | 8.8 | 2017-10-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to e… |
CVE-2017-10948 | High | 8.8 | 2017-10-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to ex… |
CVE-2017-10947 | High | 8.8 | 2017-10-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to ex… |
CVE-2017-10946 | High | 8.8 | 2017-10-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to ex… |
CVE-2017-10945 | High | 8.8 | 2017-10-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to e… |
CVE-2017-10944 | Medium | 6.5 | 2017-10-31 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is requi… |
CVE-2017-10943 | Medium | 6.5 | 2017-10-31 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is requi… |
CVE-2017-10942 | Medium | 6.5 | 2017-10-31 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is requi… |
CVE-2017-10941 | High | 8.8 | 2017-10-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to e… |
CVE-2017-10940 | High | 8.8 | 2017-10-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to agentsshar@1.0.0-release-… |
CVE-2017-15884 | High | 7.0 | 2017-10-31 | In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.0, a local attacker or malware can silently subvert the plugin update process in orde… |
CVE-2017-15273 | Medium | 5.4 | 2017-10-31 | Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous pa… |
CVE-2017-14752 | Medium | 5.4 | 2017-10-31 | Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous pa… |
CVE-2017-14163 | High | 8.8 | 2017-10-31 | An issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3. When one closes the browser without lo… |
CVE-2017-14358 | Medium | 6.1 | 2017-10-31 | A URL redirection to untrusted site vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1… |
CVE-2017-14357 | Medium | 6.1 | 2017-10-31 | A Reflected and Stored Cross-Site Scripting (XSS) vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6… |
CVE-2017-14356 | Critical | 9.8 | 2017-10-31 | An SQL Injection vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability… |
CVE-2017-1000256 | High | 8.1 | 2017-10-31 | libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate S… |
CVE-2017-3935 | High | 7.5 | 2017-10-31 | Network Data Loss Prevention is vulnerable to MIME type sniffing which allows older versions of Internet Explorer to perform MIME-sniffing on the response body… |
CVE-2017-3934 | Medium | 5.9 | 2017-10-31 | Missing HTTP Strict Transport Security state information vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows man-in-the-midd… |
CVE-2017-3933 | Medium | 5.4 | 2017-10-31 | Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential… |
CVE-2017-15950 | High | 7.8 | 2017-10-31 | Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution. The flaw is triggered by… |
CVE-2017-15993 | Critical | 9.8 | 2017-10-31 | Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter. |
CVE-2017-15992 | Critical | 9.8 | 2017-10-31 | Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php. |
CVE-2017-15991 | Critical | 9.8 | 2017-10-31 | Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or sear… |
CVE-2017-15990 | Critical | 9.8 | 2017-10-31 | Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/. |
CVE-2017-15989 | Critical | 9.8 | 2017-10-31 | Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action. |
CVE-2017-15988 | Critical | 9.8 | 2017-10-31 | Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008-6525. |
CVE-2017-15987 | Critical | 9.8 | 2017-10-31 | Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter. |
CVE-2017-15986 | Critical | 9.8 | 2017-10-31 | CPA Lead Reward Script allows SQL Injection via the username parameter. |
CVE-2017-15985 | Critical | 9.8 | 2017-10-31 | Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter. |
CVE-2017-15984 | Critical | 9.8 | 2017-10-31 | Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php. |
CVE-2017-15983 | Critical | 9.8 | 2017-10-31 | MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing. |
CVE-2017-15982 | Critical | 9.8 | 2017-10-31 | Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing. |
CVE-2017-15981 | Critical | 9.8 | 2017-10-31 | Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing. |
CVE-2017-15980 | Critical | 9.8 | 2017-10-31 | US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter. |
CVE-2017-15979 | Critical | 9.8 | 2017-10-31 | Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter. |
CVE-2017-15978 | Critical | 9.8 | 2017-10-31 | AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter. |
CVE-2017-15977 | Critical | 9.8 | 2017-10-31 | Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter. |
CVE-2017-14373 | Medium | 6.1 | 2017-10-31 | EMC RSA Authentication Manager 8.2 SP1 P4 and earlier contains a reflected cross-site scripting vulnerability that could potentially be exploited by malicious… |
CVE-2017-10151 | Critical | 10.0 | 2017-10-30 | Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). Supported versions that are affected are 11… |
CVE-2017-1000255 | Medium | 5.5 | 2017-10-30 | On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn so that the kernel will take an exceptio… |
CVE-2017-16230 | Medium | 5.4 | 2017-10-30 | In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article content, resulting i… |
CVE-2017-14919 | High | 7.5 | 2017-10-30 | Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging… |
CVE-2017-15888 | Medium | 5.4 | 2017-10-30 | Cross-site scripting (XSS) vulnerability in Custom Internet Radio List in Synology Audio Station before 6.3.0-3260 allows remote authenticated attackers to inj… |