2017 CVEs (page 62)
Page 62 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-15921 | High | 7.5 | 2017-10-30 | In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer dereference vulnerability that gets tr… |
CVE-2017-15920 | High | 7.5 | 2017-10-30 | In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer dereference vulnerability that gets tr… |
CVE-2017-9450 | High | 7.8 | 2017-10-30 | The Amazon Web Services (AWS) CloudFormation bootstrap tools package (aka aws-cfn-bootstrap) before 1.4-19.10 allows local users to execute arbitrary code with… |
CVE-2017-9377 | High | 8.8 | 2017-10-30 | A command injection was identified on Barco ClickShare Base Unit devices with CSM-1 firmware before 1.7.0.3 and CSC-1 firmware before 1.10.0.10. An attacker wi… |
CVE-2017-7411 | High | 8.8 | 2017-10-30 | An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements() method is using the unserializ… |
CVE-2017-15597 | Critical | 9.1 | 2017-10-30 | An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin would be accompanied by a suitable page reference. Othe… |
CVE-2017-12460 | Medium | 5.4 | 2017-10-30 | An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10. An authenticated user can manage the wallpape… |
CVE-2017-16228 | Critical | 9.8 | 2017-10-29 | Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in t… |
CVE-2017-16227 | High | 7.5 | 2017-10-29 | The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages… |
CVE-2017-16000 | High | 7.2 | 2017-10-29 | SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands… |
CVE-2017-15999 | Critical | 9.8 | 2017-10-29 | In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username… |
CVE-2017-15998 | High | 7.5 | 2017-10-29 | In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact data. This makes it e… |
CVE-2017-15997 | High | 7.8 | 2017-10-29 | In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password locally stored in shared preferences. Bec… |
CVE-2017-15996 | High | 7.8 | 2017-10-29 | elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other… |
CVE-2017-15994 | Critical | 9.8 | 2017-10-29 | rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE… |
CVE-2017-15976 | Critical | 9.8 | 2017-10-29 | ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-2008-3604. |
CVE-2017-15975 | Critical | 9.8 | 2017-10-29 | Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability than CVE-2008-4461. |
CVE-2017-15974 | Critical | 9.8 | 2017-10-29 | tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php. |
CVE-2017-15973 | Critical | 9.8 | 2017-10-29 | Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view.php. |
CVE-2017-15972 | Critical | 9.8 | 2017-10-29 | SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sender_id parameter, or the /admin Ema… |
CVE-2017-15971 | Critical | 9.8 | 2017-10-29 | Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sender_id parameter, or the /admin Email fi… |
CVE-2017-15970 | Critical | 9.8 | 2017-10-29 | PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter. |
CVE-2017-15969 | Critical | 9.8 | 2017-10-29 | PG All Share Video 1.0 allows SQL Injection via the PATH_INFO to search/tag, friends/index, users/profile, or video_catalog/category. |
CVE-2017-15968 | Critical | 9.8 | 2017-10-29 | MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter. |
CVE-2017-15967 | Critical | 9.8 | 2017-10-29 | Mailing List Manager Pro 3.0 allows SQL Injection via the edit parameter to admin/users in a sort=login action, or the edit parameter to admin/template. |
CVE-2017-15966 | Critical | 9.8 | 2017-10-29 | The Zh YandexMap (aka com_zhyandexmap) component 6.1.1.0 for Joomla! allows SQL Injection via the placemarklistid parameter to index.php. |
CVE-2017-15965 | Critical | 9.8 | 2017-10-29 | The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in an invoice.create action. |
CVE-2017-15964 | Critical | 9.8 | 2017-10-29 | Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI. |
CVE-2017-15963 | Critical | 9.8 | 2017-10-29 | iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser parameter. |
CVE-2017-15962 | Critical | 9.8 | 2017-10-29 | iStock Management System 1.0 allows Arbitrary File Upload via user/profile. |
CVE-2017-15961 | Critical | 9.8 | 2017-10-29 | iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php. |
CVE-2017-15960 | Critical | 9.8 | 2017-10-29 | Article Directory Script 3.0 allows SQL Injection via the id parameter to author.php or category.php. |
CVE-2017-15959 | Critical | 9.8 | 2017-10-29 | Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-2007-6576. |
CVE-2017-15958 | Critical | 9.8 | 2017-10-29 | D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php. |
CVE-2017-15957 | High | 8.8 | 2017-10-29 | my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file. |
CVE-2017-15956 | High | 7.5 | 2017-10-29 | ConverTo Video Downloader & Converter 1.4.1 allows Arbitrary File Download via the token parameter to download.php. |
CVE-2017-15955 | Medium | 5.5 | 2017-10-28 | bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to an "Access violation near NULL on destination operand" and crash when processing a malformed CU… |
CVE-2017-15954 | Medium | 5.5 | 2017-10-28 | bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow (with a resultant invalid free) and crash when processing a malfor… |
CVE-2017-15953 | Medium | 5.5 | 2017-10-28 | bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap-based buffer overflow and crash when processing a malformed CUE (.cue) file. |
CVE-2017-15951 | High | 7.8 | 2017-10-28 | The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the "negative" state to av… |
CVE-2017-15949 | High | 7.2 | 2017-10-28 | Xavier PHP Management Panel 2.4 allows SQL injection via the usertoedit parameter to admin/adminuseredit.php or the log_id parameter to admin/editgroup.php. |
CVE-2017-15948 | Medium | 4.8 | 2017-10-28 | Perch Content Management System 3.0.3 allows unrestricted file upload (with resultant XSS) via the Asset Title field in conjunction with the Select File field… |
CVE-2017-15947 | Medium | 5.4 | 2017-10-28 | Simple ASC Content Management System v1.2 has XSS in the location field in the sign function, related to guestbook.asp, formgb.asp, and msggb.asp. |
CVE-2017-15946 | Critical | 9.8 | 2017-10-28 | In the com_tag component 1.7.6 for Joomla!, a SQL injection vulnerability is located in the `tag` parameter to index.php. The request method to execute is GET. |
CVE-2017-15945 | High | 7.8 | 2017-10-27 | The installation scripts in the Gentoo dev-db/mysql, dev-db/mariadb, dev-db/percona-server, dev-db/mysql-cluster, and dev-db/mariadb-galera packages before 201… |
CVE-2017-15939 | Medium | 5.5 | 2017-10-27 | dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles NULL files in a .debug_line file table, whic… |
CVE-2017-15938 | High | 7.5 | 2017-10-27 | dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, miscalculates DW_FORM_ref_addr die refs in the case of… |
CVE-2017-15937 | Medium | 6.5 | 2017-10-27 | Artica Pandora FMS version 7.0 leaks a full installation pathname via GET data when intercepting the main page's graph requisition. This also implies that gene… |
CVE-2017-15936 | Medium | 5.4 | 2017-10-27 | In Artica Pandora FMS version 7.0, an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, th… |
CVE-2017-15935 | High | 7.2 | 2017-10-27 | Artica Pandora FMS version 7.0 is vulnerable to remote PHP code execution through the manager files function. This is only exploitable by administrators who up… |
CVE-2017-15934 | Medium | 5.4 | 2017-10-27 | Artica Pandora FMS version 7.0 is vulnerable to stored Cross-Site Scripting in the map name parameter. |
CVE-2017-15582 | High | 7.5 | 2017-10-27 | In net.MCrypt in the "Diary with lock" (aka WriteDiary) application 4.72 for Android, hardcoded SecretKey and iv variables are used for the AES parameters, whi… |
CVE-2017-15581 | High | 7.5 | 2017-10-27 | In the "Diary with lock" (aka WriteDiary) application 4.72 for Android, neither HTTPS nor other encryption is used for transmitting data, despite the documenta… |
CVE-2017-15933 | High | 7.2 | 2017-10-27 | SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary… |
CVE-2017-13090 | High | 8.8 | 2017-10-27 | The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strto… |
CVE-2017-13089 | High | 8.8 | 2017-10-27 | The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19… |
CVE-2017-15932 | High | 7.8 | 2017-10-27 | In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/el… |
CVE-2017-15931 | High | 7.8 | 2017-10-27 | In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verneed() in libr/bin/format/elf/e… |
CVE-2017-15930 | High | 8.8 | 2017-10-27 | In ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26, a Null Pointer Dereference occurs while transferring JPEG scanlines, related to a PixelPacket poin… |
CVE-2017-15928 | High | 7.5 | 2017-10-27 | In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox shou… |
CVE-2017-15924 | High | 7.8 | 2017-10-27 | In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request recei… |
CVE-2017-6163 | Medium | 5.9 | 2017-10-27 | In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, PSM software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, when a virtual server us… |
CVE-2017-6162 | Medium | 5.9 | 2017-10-27 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11… |
CVE-2017-6161 | Medium | 5.3 | 2017-10-27 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator software version 12.0.0 - 12.1.2, 11.6.0 - 11.6.1… |
CVE-2017-6160 | Medium | 5.9 | 2017-10-27 | In F5 BIG-IP AAM and PEM software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.4.1 to 11.5.4, a remote attacker may create maliciously crafted HTTP request t… |
CVE-2017-6159 | Medium | 5.9 | 2017-10-27 | F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, Websafe software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 are vulnerable to a d… |
CVE-2017-6157 | High | 8.1 | 2017-10-27 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 12.0.0 to 12.1.1, 11.6.0 to 11.6.1, 11.5.0 - 11.5… |
CVE-2017-0303 | High | 7.5 | 2017-10-27 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2 and 11.5.1 to 11.6.1, und… |
CVE-2017-7733 | Medium | 6.1 | 2017-10-27 | A Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 and 5.6.0 allows a remote unauthenticated attacker to execute arbitrary javascrip… |
CVE-2017-14182 | Medium | 6.5 | 2017-10-27 | A Denial of Service (DoS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an authenticated user to cause the web GUI to be temporarily unresponsive, vi… |
CVE-2017-5122 | High | 8.8 | 2017-10-27 | Inappropriate use of table size handling in V8 in Google Chrome prior to 61.0.3163.100 for Windows allowed a remote attacker to trigger out-of-bounds access vi… |
CVE-2017-5121 | High | 8.8 | 2017-10-27 | Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary… |
CVE-2017-5120 | Medium | 6.5 | 2017-10-27 | Inappropriate use of www mismatch redirects in browser navigation in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Andr… |
CVE-2017-5119 | Medium | 4.3 | 2017-10-27 | Use of an uninitialized value in Skia in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attack… |
CVE-2017-5118 | Medium | 4.3 | 2017-10-27 | Blink in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, failed to correctly propagate CSP restrictions to javas… |
CVE-2017-5117 | Medium | 6.5 | 2017-10-27 | Use of an uninitialized value in Skia in Google Chrome prior to 61.0.3163.79 for Linux and Windows allowed a remote attacker to obtain potentially sensitive in… |
CVE-2017-5116 | High | 8.8 | 2017-10-27 | Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to execute arb… |
CVE-2017-5115 | High | 8.8 | 2017-10-27 | Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote attacker to potentially exploit object corruption via a crafted HTML p… |
CVE-2017-5114 | High | 8.8 | 2017-10-27 | Inappropriate use of partition alloc in PDFium in Google Chrome prior to 61.0.3163.79 for Linux, Windows, and Mac, and 61.0.3163.81 for Android, allowed a remo… |
CVE-2017-5113 | High | 8.8 | 2017-10-27 | Math overflow in Skia in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to potentiall… |
CVE-2017-5112 | High | 8.8 | 2017-10-27 | Heap buffer overflow in WebGL in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote attacker to execute arbitrary code inside a sandbox via a cra… |
CVE-2017-5111 | High | 8.8 | 2017-10-27 | A use after free in PDFium in Google Chrome prior to 61.0.3163.79 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit memory corruptio… |
CVE-2017-5110 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux… |
CVE-2017-5109 | Medium | 4.3 | 2017-10-27 | Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remo… |
CVE-2017-5108 | High | 8.8 | 2017-10-27 | Type confusion in PDFium in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modif… |
CVE-2017-5107 | Medium | 5.3 | 2017-10-27 | A timing attack in SVG rendering in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to extract pixel values from a cr… |
CVE-2017-5106 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform dom… |
CVE-2017-5105 | Medium | 6.5 | 2017-10-27 | Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform dom… |
CVE-2017-5104 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation in interstitials in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to spoof the contents of the omnibox via… |
CVE-2017-5103 | Medium | 4.3 | 2017-10-27 | Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to obtain potentially sensit… |
CVE-2017-5102 | Medium | 4.3 | 2017-10-27 | Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to obtain potential… |
CVE-2017-5101 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation in Omnibox in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of t… |
CVE-2017-5100 | High | 8.8 | 2017-10-27 | A use after free in Apps in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTM… |
CVE-2017-5099 | High | 8.8 | 2017-10-27 | Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privil… |
CVE-2017-5098 | High | 8.8 | 2017-10-27 | A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform an out of bounds memory… |
CVE-2017-5097 | High | 8.8 | 2017-10-27 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux allowed a remote attacker to perform an out of bounds memor… |
CVE-2017-5096 | Medium | 4.3 | 2017-10-27 | Insufficient policy enforcement during navigation between different schemes in Google Chrome prior to 60.0.3112.78 for Android allowed a remote attacker to per… |
CVE-2017-5095 | High | 8.8 | 2017-10-27 | Stack overflow in PDFium in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit stack corruption v… |
CVE-2017-5094 | Medium | 6.5 | 2017-10-27 | Type confusion in extensions JavaScript bindings in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to poten… |
CVE-2017-5093 | Medium | 6.5 | 2017-10-27 | Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote att… |