2017 CVEs (page 70)
Page 70 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-15286 | High | 7.5 | 2017-10-12 | SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` i… |
CVE-2017-15285 | High | 8.8 | 2017-10-12 | X-Cart 5.2.23, 5.3.1.9, 5.3.2.13, and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote fil… |
CVE-2017-15284 | Medium | 5.4 | 2017-10-12 | Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avat… |
CVE-2017-15281 | High | 8.8 | 2017-10-12 | ReadPSDImage in coders/psd.c in ImageMagick 7.0.7-6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other… |
CVE-2017-15280 | Medium | 5.5 | 2017-10-12 | XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending… |
CVE-2017-15279 | Medium | 5.4 | 2017-10-12 | Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka no… |
CVE-2017-15278 | Medium | 5.4 | 2017-10-12 | Cross-Site Scripting (XSS) was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data (in /sources/folders.que… |
CVE-2017-15277 | Medium | 6.5 | 2017-10-12 | ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a gl… |
CVE-2017-15274 | Medium | 5.5 | 2017-10-12 | security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in conjunction with a nonzero length value, which allows… |
CVE-2017-12192 | Medium | 5.5 | 2017-10-12 | The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properly consider that a k… |
CVE-2017-5791 | Critical | 9.8 | 2017-10-11 | The doFilter method in UrlAccessController in HPE Intelligent Management Center (iMC) PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified… |
CVE-2017-5789 | Critical | 9.8 | 2017-10-11 | HPE LoadRunner before 12.53 Patch 4 and HPE Performance Center before 12.53 Patch 4 allow remote attackers to execute arbitrary code via unspecified vectors. A… |
CVE-2017-8025 | High | 7.4 | 2017-10-11 | RSA Archer GRC Platform prior to 6.2.0.5 is affected by an arbitrary file upload vulnerability. A remote unauthenticated attacker may potentially exploit this… |
CVE-2017-8017 | Medium | 6.1 | 2017-10-11 | EMC Network Configuration Manager (NCM) 9.3.x, 9.4.0.x, 9.4.1.x, and 9.4.2.x is affected by a reflected cross-site scripting Vulnerability that could potential… |
CVE-2017-8016 | Medium | 5.4 | 2017-10-11 | RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Questionnaire ID field. An authenticated attacker may potentially e… |
CVE-2017-14372 | Medium | 6.1 | 2017-10-11 | RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting vulnerabilities via certain RSA Archer Help pages. Attackers could poten… |
CVE-2017-14371 | Medium | 6.1 | 2017-10-11 | RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting via the request URL. Attackers could potentially exploit this to execute… |
CVE-2017-14370 | Medium | 5.4 | 2017-10-11 | RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Source Asset ID field. An authenticated attacker may potentially ex… |
CVE-2017-14369 | Medium | 4.3 | 2017-10-11 | RSA Archer GRC Platform prior to 6.2.0.5 is affected by a privilege escalation vulnerability. A low privileged RSA Archer user may potentially exploit this vul… |
CVE-2017-14003 | Critical | 9.8 | 2017-10-11 | An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running firmware versions 6.01.00/29.03.2007 and prior versions. An i… |
CVE-2017-2888 | High | 8.8 | 2017-10-11 | An exploitable integer overflow vulnerability exists when creating a new RGB Surface in SDL 2.0.5. A specially crafted file can cause an integer overflow resul… |
CVE-2017-2887 | High | 8.8 | 2017-10-11 | An exploitable buffer overflow vulnerability exists in the XCF property handling functionality of SDL_image 2.0.1. A specially crafted xcf file can cause a sta… |
CVE-2017-15264 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .tif file, related to "Dat… |
CVE-2017-15263 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft… |
CVE-2017-15262 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, re… |
CVE-2017-15261 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft… |
CVE-2017-15260 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft… |
CVE-2017-15259 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft… |
CVE-2017-15258 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft… |
CVE-2017-15257 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, re… |
CVE-2017-15256 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft… |
CVE-2017-15255 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft… |
CVE-2017-15254 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft… |
CVE-2017-15253 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, re… |
CVE-2017-15252 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, re… |
CVE-2017-15251 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, re… |
CVE-2017-15250 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft… |
CVE-2017-15249 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, re… |
CVE-2017-15248 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, re… |
CVE-2017-15247 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft… |
CVE-2017-15246 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, re… |
CVE-2017-15245 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft… |
CVE-2017-15244 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft… |
CVE-2017-15243 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft… |
CVE-2017-15242 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file, re… |
CVE-2017-15241 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft… |
CVE-2017-15240 | High | 7.8 | 2017-10-11 | IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a craft… |
CVE-2017-15239 | High | 7.8 | 2017-10-11 | IrfanView 4.44 - 32bit with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf… |
CVE-2017-14588 | Medium | 6.1 | 2017-10-11 | Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripti… |
CVE-2017-14587 | Medium | 5.4 | 2017-10-11 | The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript… |
CVE-2017-0903 | Critical | 9.8 | 2017-10-11 | RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can byp… |
CVE-2017-15267 | High | 7.5 | 2017-10-11 | In GNU Libextractor 1.4, there is a NULL Pointer Dereference in flac_metadata in flac_extractor.c. |
CVE-2017-15266 | Medium | 5.5 | 2017-10-11 | In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample rate. |
CVE-2017-13722 | High | 7.1 | 2017-10-11 | In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary check (for PCF files) could be used by… |
CVE-2017-13720 | High | 7.1 | 2017-10-11 | In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffe… |
CVE-2017-12188 | High | 7.8 | 2017-10-11 | arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a gues… |
CVE-2017-15220 | Critical | 9.8 | 2017-10-11 | Flexense VX Search Enterprise 10.1.12 is vulnerable to a buffer overflow via an empty POST request to a long URI beginning with a /../ substring. This allows r… |
CVE-2017-7352 | Medium | 5.4 | 2017-10-11 | Stored Cross-site scripting (XSS) vulnerability in Pure Storage Purity 4.7.5 allows remote authenticated users to inject arbitrary web script or HTML via the "… |
CVE-2017-15238 | High | 8.8 | 2017-10-11 | ReadOneJNGImage in coders/png.c in GraphicsMagick 1.3.26 has a use-after-free issue when the height or width is zero, related to ReadJNGImage. |
CVE-2017-15236 | High | 7.5 | 2017-10-11 | Tiandy IP cameras 5.56.17.120 do not properly restrict a certain proprietary protocol, which allows remote attackers to read settings via a crafted request to… |
CVE-2017-15235 | High | 7.5 | 2017-10-11 | The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn pa… |
CVE-2017-15232 | Medium | 6.5 | 2017-10-11 | libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file. |
CVE-2017-15215 | Medium | 6.1 | 2017-10-11 | Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.php. If the victim… |
CVE-2017-15214 | Medium | 5.4 | 2017-10-11 | Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges and also to exec… |
CVE-2017-15213 | Medium | 5.4 | 2017-10-11 | Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via the real_name or em… |
CVE-2017-15212 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another user. |
CVE-2017-15211 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user. |
CVE-2017-15210 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another user. |
CVE-2017-15209 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user. |
CVE-2017-15208 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user. |
CVE-2017-15207 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user. |
CVE-2017-15206 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user. |
CVE-2017-15205 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user. |
CVE-2017-15204 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user. |
CVE-2017-15203 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user. |
CVE-2017-15202 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user. |
CVE-2017-15201 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another user. |
CVE-2017-15200 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user. |
CVE-2017-15199 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email… |
CVE-2017-15198 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a private project of another user. |
CVE-2017-15197 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of another user. |
CVE-2017-15196 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user. |
CVE-2017-15195 | Medium | 4.3 | 2017-10-11 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of another user. |
CVE-2017-15194 | Medium | 6.1 | 2017-10-11 | include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page. |
CVE-2017-15188 | Medium | 4.8 | 2017-10-11 | A persistent (stored) XSS vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to inject arbitrary we… |
CVE-2017-5722 | High | 7.5 | 2017-10-11 | Incorrect policy enforcement in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows attackers with… |
CVE-2017-5721 | High | 7.5 | 2017-10-11 | Insufficient input validation in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows local attacke… |
CVE-2017-5701 | High | 7.1 | 2017-10-11 | Insecure platform configuration in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows an attacker… |
CVE-2017-5700 | High | 8.4 | 2017-10-11 | Insufficient protection of password storage in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows… |
CVE-2017-15226 | Critical | 9.8 | 2017-10-10 | Zyxel NBG6716 V1.00(AAKG.9)C0 devices allow command injection in the ozkerz component because beginIndex and endIndex are used directly in a popen call. |
CVE-2017-15225 | Medium | 5.5 | 2017-10-10 | _bfd_dwarf2_cleanup_debug_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attacke… |
CVE-2017-8994 | Critical | 9.8 | 2017-10-10 | A input validation vulnerability in HPE Operations Orchestration product all versions prior to 10.80, allows for the execution of code remotely. |
CVE-2017-1538 | Medium | 6.5 | 2017-10-10 | IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive information from an undocumen… |
CVE-2017-15219 | Medium | 5.4 | 2017-10-10 | The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting (XSS) affecting a vanity-urls Title field, a containers Description field, and a temp… |
CVE-2017-15193 | High | 7.5 | 2017-10-10 | In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by… |
CVE-2017-15192 | High | 7.5 | 2017-10-10 | In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case wh… |
CVE-2017-15191 | High | 7.5 | 2017-10-10 | In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validati… |
CVE-2017-15190 | High | 7.5 | 2017-10-10 | In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. This was addressed in epan/dissectors/packet-rtsp.c by correcting the scope of a variable. |
CVE-2017-15189 | High | 7.5 | 2017-10-10 | In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by adding decrements. |
CVE-2017-1503 | Medium | 6.1 | 2017-10-10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability us… |