2017 CVEs (page 71)
Page 71 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-9717 | High | 7.5 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while parsing Netlink attributes, a buffer over… |
CVE-2017-9715 | High | 7.5 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a vendor command, a buffer ove… |
CVE-2017-9714 | High | 7.8 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an out of bound memory access may happen in lim… |
CVE-2017-9706 | High | 7.8 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an array out-of-bounds access can potentially o… |
CVE-2017-9697 | High | 7.0 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition can allow access to already fr… |
CVE-2017-9687 | High | 7.8 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, two concurrent threads/processes can write the… |
CVE-2017-9686 | High | 7.8 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possible double free/use after free… |
CVE-2017-9683 | High | 7.8 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing a meta image, an integer overflo… |
CVE-2017-15218 | Medium | 6.5 | 2017-10-10 | ImageMagick 7.0.7-2 has a memory leak in ReadOneJNGImage in coders/png.c. |
CVE-2017-15217 | Medium | 6.5 | 2017-10-10 | ImageMagick 7.0.7-2 has a memory leak in ReadSGIImage in coders/sgi.c. |
CVE-2017-11067 | High | 7.8 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the Athdiag procfs entry does not have a proper… |
CVE-2017-11064 | High | 7.5 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed during processing… |
CVE-2017-11063 | Medium | 5.9 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, as a result of a race condition between two use… |
CVE-2017-11062 | High | 7.5 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, currently attributes are not validated in __wla… |
CVE-2017-11061 | High | 7.5 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing cfg80211 vendor sub command QC… |
CVE-2017-11060 | High | 7.5 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed during processing… |
CVE-2017-11059 | High | 7.8 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, setting the HMAC key by different threads durin… |
CVE-2017-11057 | High | 7.8 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in compatibility mode, flash_data from 64-bit u… |
CVE-2017-11056 | High | 7.8 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while doing sha and cipher operations, a usersp… |
CVE-2017-11055 | High | 7.5 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted QCA_NL8021… |
CVE-2017-11054 | High | 7.5 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted cfg80211 v… |
CVE-2017-11053 | High | 7.8 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when qos map set IE of length less than 16 is r… |
CVE-2017-11052 | High | 7.5 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted QCA_NL8021… |
CVE-2017-11051 | High | 7.5 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, information disclosure is possible in function… |
CVE-2017-11050 | High | 7.8 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when the pktlogconf tool gives a pktlog buffer… |
CVE-2017-11048 | High | 7.8 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a display driver function, a Use After Free… |
CVE-2017-11046 | High | 7.8 | 2017-10-10 | In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when an audio driver ioctl handler is called, a… |
CVE-2017-13679 | Medium | 4.2 | 2017-10-10 | A denial of service (DoS) attack in Symantec Encryption Desktop before SED 10.4.1 MP2HF1 allows remote attackers to make a particular machine or network resour… |
CVE-2017-13675 | Medium | 4.2 | 2017-10-10 | A denial of service (DoS) attack in Symantec Endpoint Encryption before SEE 11.1.3HF2 allows remote attackers to make a particular machine or network resource… |
CVE-2017-15216 | Medium | 6.1 | 2017-10-10 | MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfi… |
CVE-2017-12623 | Medium | 6.5 | 2017-10-10 | An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to prop… |
CVE-2017-13706 | Critical | 9.9 | 2017-10-10 | XML external entity (XXE) vulnerability in the import package functionality of the deployment module in Lansweeper before 6.0.100.67 allows remote authenticate… |
CVE-2017-12861 | Critical | 9.8 | 2017-10-10 | The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a unique 4-digit cod… |
CVE-2017-12860 | Critical | 9.8 | 2017-10-10 | The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a unique 4-digit cod… |
CVE-2017-14943 | High | 7.5 | 2017-10-10 | Trapeze TransitMaster is vulnerable to information disclosure (emails / hashed passwords) via a modified userID field in JSON data to ManageSubscriber.aspx/Get… |
CVE-2017-5637 | High | 7.5 | 2017-10-10 | Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the s… |
CVE-2017-15038 | Medium | 5.6 | 2017-10-10 | Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from hos… |
CVE-2017-14980 | Critical | 9.8 | 2017-10-10 | Buffer overflow in Sync Breeze Enterprise 10.0.28 allows remote attackers to have unspecified impact via a long username parameter to /login. |
CVE-2017-14614 | Medium | 6.5 | 2017-10-10 | Directory traversal vulnerability in the Visor GUI Console in GridGain before 1.7.16, 1.8.x before 1.8.12, 1.9.x before 1.9.7, and 8.x before 8.1.5 allows remo… |
CVE-2017-14603 | High | 7.5 | 2017-10-10 | In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before 13.13-cert6, insuff… |
CVE-2017-13723 | High | 7.8 | 2017-10-10 | In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of… |
CVE-2017-13721 | Medium | 4.7 | 2017-10-10 | In X.Org Server (aka xserver and xorg-server) before 1.19.4, an attacker authenticated to an X server with the X shared memory extension enabled can cause abor… |
CVE-2017-15185 | Medium | 5.0 | 2017-10-09 | plugins/ogg.c in Libmp3splt 0.9.2 calls the libvorbis vorbis_block_clear function with uninitialized data upon detection of invalid input, which allows remote… |
CVE-2017-14973 | Medium | 5.4 | 2017-10-09 | IDenticard Two-Reader Controller Configuration Manager 1.18.8 (396) is vulnerable to Stored Cross-Site Scripting (XSS) via the notes field in /~user_handler?fi… |
CVE-2017-14972 | High | 7.5 | 2017-10-09 | InFocus Mondopad 2.2.08 is vulnerable to authentication bypass when accessing uploaded files by entering Control-Alt-Delete, and then using Task Manager to rea… |
CVE-2017-14971 | Medium | 5.5 | 2017-10-09 | Infocus Mondopad 2.2.08 is vulnerable to a Hashed Credential Disclosure vulnerability. The attacker provides a crafted Microsoft Office document containing a l… |
CVE-2017-15084 | Medium | 6.5 | 2017-10-06 | The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22. |
CVE-2017-15079 | High | 7.5 | 2017-10-06 | The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal. |
CVE-2017-13069 | Critical | 9.8 | 2017-10-06 | QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 (for QTS 4.2.x), 5.0.7 (for QTS 4.3.x), and earlier. If exp… |
CVE-2017-9273 | Medium | 5.3 | 2017-10-06 | The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to unauthorized log configuration changes. |
CVE-2017-9272 | High | 7.5 | 2017-10-06 | The Bi-directional driver in IDM 4.5 before 4.0.3.0 could be susceptible to a denial of service attack. |
CVE-2017-13068 | High | 7.5 | 2017-10-06 | QNAP has already patched this vulnerability. This security concern allows a remote attacker to perform an SQL injection on the application and obtain Helpdesk… |
CVE-2017-1002153 | High | 7.5 | 2017-10-06 | Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission. |
CVE-2017-1000254 | High | 7.5 | 2017-10-06 | libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks… |
CVE-2017-15063 | High | 8.8 | 2017-10-06 | There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF… |
CVE-2017-15056 | High | 7.8 | 2017-10-06 | p_lx_elf.cpp in UPX 3.94 mishandles ELF headers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified ot… |
CVE-2017-15047 | Critical | 9.8 | 2017-10-06 | The clusterLoadConfig function in cluster.c in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and application crash) or p… |
CVE-2017-15046 | Medium | 5.5 | 2017-10-06 | LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a stack-based buffer overflow in unpack_read_samples in frontend/get_audio.c, a different vulnerability… |
CVE-2017-15045 | Medium | 5.5 | 2017-10-06 | LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3.98.2 and 3.98 has a heap-based buffer over-read in fill_buffer in libmp3lame/util.c, related to la… |
CVE-2017-12730 | High | 7.8 | 2017-10-06 | An Unquoted Search Path issue was discovered in mySCADA myPRO Versions 7.0.26 and prior. Application services utilize unquoted search path elements, which coul… |
CVE-2017-14089 | Critical | 9.8 | 2017-10-06 | An Unauthorized Memory Corruption vulnerability in Trend Micro OfficeScan 11.0 and XG may allow remote unauthenticated users who can access the OfficeScan serv… |
CVE-2017-14088 | High | 7.0 | 2017-10-06 | Memory Corruption Privilege Escalation vulnerabilities in Trend Micro OfficeScan 11.0 and XG allows local attackers to execute arbitrary code and escalate priv… |
CVE-2017-14087 | High | 7.5 | 2017-10-06 | A Host Header Injection vulnerability in Trend Micro OfficeScan XG (12.0) may allow an attacker to spoof a particular Host header, allowing the attacker to ren… |
CVE-2017-14086 | High | 7.5 | 2017-10-06 | Pre-authorization Start Remote Process vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan serv… |
CVE-2017-14085 | Medium | 5.3 | 2017-10-06 | Information disclosure vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan server to query the… |
CVE-2017-14084 | High | 8.1 | 2017-10-06 | A potential Man-in-the-Middle (MitM) attack vulnerability in Trend Micro OfficeScan 11.0 and XG may allow attackers to execute arbitrary code on vulnerable ins… |
CVE-2017-14083 | High | 7.5 | 2017-10-06 | A vulnerability in Trend Micro OfficeScan 11.0 and XG allows remote unauthenticated users who can access the system to download the OfficeScan encryption file. |
CVE-2017-15042 | Medium | 5.9 | 2017-10-05 | An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on… |
CVE-2017-15041 | Critical | 9.8 | 2017-10-05 | Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg… |
CVE-2017-13998 | High | 7.5 | 2017-10-05 | An Insufficiently Protected Credentials issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not sufficiently protect sensitiv… |
CVE-2017-13996 | High | 8.8 | 2017-10-05 | A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access to critical files tha… |
CVE-2017-13994 | Medium | 6.1 | 2017-10-05 | A Cross-site Scripting issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web interface lacks proper web request validation, which could allo… |
CVE-2017-13992 | High | 8.1 | 2017-10-05 | An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently random number generation… |
CVE-2017-12732 | Medium | 6.8 | 2017-10-05 | A Stack-based Buffer Overflow issue was discovered in GE CIMPLICITY Versions 9.0 and prior. A function reads a packet to indicate the next packet length. The n… |
CVE-2017-2920 | High | 7.8 | 2017-10-05 | An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel Photoline 20.02. A specially crafted .SVG file can cause a vulnera… |
CVE-2017-2880 | High | 7.8 | 2017-10-05 | An memory corruption vulnerability exists in the .GIF parsing functionality of Computerinsel Photoline 20.02. A specially crafted .GIF file can cause a vulnera… |
CVE-2017-12106 | High | 8.8 | 2017-10-05 | A memory corruption vulnerability exists in the .TGA parsing functionality of Computerinsel Photoline 20.02. A specially crafted .TGA file can cause an out of… |
CVE-2017-1522 | Medium | 5.4 | 2017-10-05 | IBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2017-1378 | High | 7.8 | 2017-10-05 | IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) disclosed unencrypted login credentials to Vmware vCenter in the application trace output wh… |
CVE-2017-1339 | Medium | 4.4 | 2017-10-05 | IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) Server uses weak encryption for the password. A database administrator may be able to decryp… |
CVE-2017-1301 | Medium | 5.5 | 2017-10-05 | IBM Spectrum Protect 7.1 and 8.1 could allow a local attacker to launch a symlink attack. IBM Spectrum Protect Backup-archive Client creates temporary files in… |
CVE-2017-1201 | High | 7.8 | 2017-10-05 | IBM BigFix Compliance Analytics 1.9.79 (TEMA SUAv1 SCA SCM) stores user credentials in clear text which can be read by a local user. IBM X-Force ID: 123676. |
CVE-2017-14354 | Medium | 6.1 | 2017-10-05 | A remote cross-site scripting vulnerability in HP UCMDB Foundation Software versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, and 10.33 could be… |
CVE-2017-14353 | High | 8.8 | 2017-10-05 | A remote code execution vulnerability in HP UCMDB Foundation Software versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, and 10.33, could be remo… |
CVE-2017-15037 | High | 8.1 | 2017-10-05 | In FreeBSD through 11.1, the smb_strdupin function in sys/netsmb/smb_subr.c has a race condition with a resultant out-of-bounds read, because it can cause t2p-… |
CVE-2017-15035 | High | 7.5 | 2017-10-05 | EmTec PyroBatchFTP before 3.18 allows remote servers to cause a denial of service (application crash). |
CVE-2017-15033 | High | 7.5 | 2017-10-05 | ImageMagick version 7.0.7-2 contains a memory leak in ReadYUVImage in coders/yuv.c. |
CVE-2017-15032 | Critical | 9.8 | 2017-10-05 | ImageMagick version 7.0.7-2 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. |
CVE-2017-12270 | High | 7.5 | 2017-10-05 | A vulnerability in the gRPC code of Cisco IOS XR Software for Cisco Network Convergence System (NCS) 5500 Series Routers could allow an unauthenticated, remote… |
CVE-2017-12269 | Medium | 5.4 | 2017-10-05 | A vulnerability in the web UI of Cisco Spark Messaging Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) at… |
CVE-2017-12268 | Medium | 6.5 | 2017-10-05 | A vulnerability in the Network Access Manager (NAM) of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker to enable multiple… |
CVE-2017-12267 | Medium | 5.3 | 2017-10-05 | A vulnerability in the Independent Computing Architecture (ICA) accelerator feature for the Cisco Wide Area Application Services (WAAS) could allow an unauthen… |
CVE-2017-12266 | Medium | 4.2 | 2017-10-05 | A vulnerability in the routine that loads DLL files in Cisco Meeting App for Windows could allow an authenticated, local attacker to run an executable file wit… |
CVE-2017-12265 | Medium | 6.1 | 2017-10-05 | A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to co… |
CVE-2017-12264 | Medium | 5.3 | 2017-10-05 | A vulnerability in the Web Admin Interface of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition… |
CVE-2017-12263 | High | 7.5 | 2017-10-05 | A vulnerability in the web interface of Cisco License Manager software could allow an unauthenticated, remote attacker to download and view files within the ap… |
CVE-2017-12258 | Medium | 6.1 | 2017-10-05 | A vulnerability in the web-based UI of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to execute a cross-frame scripting… |
CVE-2017-12257 | Medium | 6.1 | 2017-10-05 | A vulnerability in the web framework of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) att… |
CVE-2017-12256 | Medium | 6.5 | 2017-10-05 | A vulnerability in the Akamai Connect feature of Cisco Wide Area Application Services (WAAS) Appliances could allow an unauthenticated, remote attacker to caus… |
CVE-2017-12246 | High | 8.6 | 2017-10-05 | A vulnerability in the implementation of the direct authentication feature in Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated… |