2017 CVEs (page 72)
Page 72 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12245 | High | 8.6 | 2017-10-05 | A vulnerability in SSL traffic decryption for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause depletion… |
CVE-2017-12244 | High | 8.6 | 2017-10-05 | A vulnerability in the detection engine parsing of IPv6 packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause hi… |
CVE-2017-9628 | Medium | 5.3 | 2017-10-05 | An Information Exposure issue was discovered in Saia Burgess Controls PCD Controllers with PCD firmware versions prior to 1.28.16 or 1.24.69. In certain circum… |
CVE-2017-15025 | Medium | 5.5 | 2017-10-05 | decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a… |
CVE-2017-15024 | Medium | 5.5 | 2017-10-05 | find_abstract_instance_name in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers… |
CVE-2017-15023 | Medium | 5.5 | 2017-10-05 | read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not properly validate th… |
CVE-2017-15022 | Medium | 5.5 | 2017-10-05 | dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the DW_AT_name data type, which allow… |
CVE-2017-15021 | Medium | 5.5 | 2017-10-05 | bfd_get_debug_link_info_1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to… |
CVE-2017-15020 | High | 7.8 | 2017-10-05 | dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows remote attackers to c… |
CVE-2017-15019 | High | 7.8 | 2017-10-05 | LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a malformed mpg file, because of an incorre… |
CVE-2017-15018 | Medium | 5.5 | 2017-10-05 | LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file in k_34_4 in vbrqu… |
CVE-2017-15017 | High | 8.8 | 2017-10-05 | ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c. |
CVE-2017-15016 | High | 8.8 | 2017-10-05 | ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadEnhMetaFile in coders/emf.c. |
CVE-2017-15015 | High | 8.8 | 2017-10-05 | ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in PDFDelegateMessage in coders/pdf.c. |
CVE-2017-14000 | Critical | 9.4 | 2017-10-05 | An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11. By accessing a specific uniform resourc… |
CVE-2017-13995 | Critical | 10.0 | 2017-10-05 | An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100. The webserver does not properly authent… |
CVE-2017-13993 | High | 7.8 | 2017-10-05 | An Uncontrolled Search Path or Element issue was discovered in i-SENS SmartLog Diabetes Management Software, Version 2.4.0 and prior versions. An uncontrolled… |
CVE-2017-12728 | High | 7.8 | 2017-10-05 | An Improper Privilege Management issue was discovered in SpiderControl SCADA Web Server Version 2.02.0007 and prior. Authenticated, non-administrative local us… |
CVE-2017-1000253 | High | 7.8 | 2017-10-05 | Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on Apri… |
CVE-2017-1000120 | High | 8.8 | 2017-10-05 | [ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerability in frappe.share.get_users allows remote authenticated users to execute arbitrary SQL commands v… |
CVE-2017-1000119 | High | 7.2 | 2017-10-05 | October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the… |
CVE-2017-1000118 | High | 7.5 | 2017-10-05 | Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service |
CVE-2017-1000117 | High | 8.8 | 2017-10-05 | A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on… |
CVE-2017-1000116 | Critical | 9.8 | 2017-10-05 | Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks. |
CVE-2017-1000115 | High | 7.5 | 2017-10-05 | Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository |
CVE-2017-1000114 | Low | 3.1 | 2017-10-05 | The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypted on disk, it was t… |
CVE-2017-1000113 | Medium | 5.5 | 2017-10-05 | The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or u… |
CVE-2017-1000112 | High | 7.0 | 2017-10-05 | Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_… |
CVE-2017-1000111 | High | 7.8 | 2017-10-05 | Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that c… |
CVE-2017-1000110 | Medium | 4.3 | 2017-10-05 | Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsf… |
CVE-2017-1000109 | Medium | 6.1 | 2017-10-05 | The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scripting vulnerability… |
CVE-2017-1000108 | High | 7.5 | 2017-10-05 | The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed… |
CVE-2017-1000107 | High | 8.8 | 2017-10-05 | Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor invocations, method re… |
CVE-2017-1000106 | High | 8.5 | 2017-10-05 | Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsf… |
CVE-2017-1000105 | Medium | 5.3 | 2017-10-05 | The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before providing access to arc… |
CVE-2017-1000104 | Medium | 6.5 | 2017-10-05 | The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with only Overall/Read acc… |
CVE-2017-1000103 | Medium | 5.4 | 2017-10-05 | The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users ab… |
CVE-2017-1000102 | Medium | 5.4 | 2017-10-05 | The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to inf… |
CVE-2017-1000101 | Medium | 6.5 | 2017-10-05 | curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the… |
CVE-2017-1000100 | Medium | 6.5 | 2017-10-05 | When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit… |
CVE-2017-1000099 | Medium | 6.5 | 2017-10-05 | When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this wou… |
CVE-2017-1000098 | High | 7.5 | 2017-10-05 | The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It… |
CVE-2017-1000097 | High | 7.5 | 2017-10-05 | On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not… |
CVE-2017-1000096 | High | 8.8 | 2017-10-05 | Arbitrary code execution due to incomplete sandbox protection: Constructors, instance variable initializers, and instance initializers in Pipeline scripts were… |
CVE-2017-1000095 | Medium | 6.5 | 2017-10-05 | The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); DefaultGroovyMethods.getAt(Object, String). Th… |
CVE-2017-1000094 | Medium | 6.5 | 2017-10-05 | Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use to authenticate with a… |
CVE-2017-1000093 | High | 8.8 | 2017-10-05 | Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to… |
CVE-2017-1000092 | High | 7.5 | 2017-10-05 | Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username… |
CVE-2017-1000091 | Medium | 6.3 | 2017-10-05 | GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to verify Scan… |
CVE-2017-1000090 | High | 8.8 | 2017-10-05 | Role-based Authorization Strategy Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks… |
CVE-2017-1000089 | Medium | 5.3 | 2017-10-05 | Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeli… |
CVE-2017-1000088 | Medium | 5.4 | 2017-10-05 | The Sidebar Link plugin allows users able to configure jobs, views, and agents to add entries to the sidebar of these objects. There was no input validation, w… |
CVE-2017-1000087 | Medium | 4.3 | 2017-10-05 | GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did… |
CVE-2017-1000086 | High | 8.0 | 2017-10-05 | The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore b… |
CVE-2017-1000085 | Medium | 6.5 | 2017-10-05 | Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperl… |
CVE-2017-1000084 | Medium | 6.5 | 2017-10-05 | Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication it was running as an… |
CVE-2017-12149 | Critical | 9.8 | 2017-10-04 | In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of t… |
CVE-2017-9792 | Medium | 6.5 | 2017-10-04 | In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any other Kudu table data by altering the… |
CVE-2017-8048 | High | 7.8 | 2017-10-04 | In Cloud Foundry capi-release versions 1.33.0 and later, prior to 1.42.0 and cf-release versions 268 and later, prior to 274, the original fix for CVE-2017-803… |
CVE-2017-8047 | Medium | 6.1 | 2017-10-04 | In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it is possible to appen… |
CVE-2017-1541 | High | 7.3 | 2017-10-04 | A flaw in the AIX 5.3, 6.1, 7.1, and 7.2 JRE/SDK installp and updatep packages prevented the java.security, java.policy and javaws.policy files from being upda… |
CVE-2017-15011 | High | 7.5 | 2017-10-04 | The named pipes in qtsingleapp in Qt 5.x, as used in qBittorrent and SugarSync, are configured for remote access and allow remote attackers to cause a denial o… |
CVE-2017-15010 | High | 7.5 | 2017-10-04 | A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP req… |
CVE-2017-15009 | Medium | 6.1 | 2017-10-04 | PRTG Network Monitor version 17.3.33.2830 is vulnerable to reflected Cross-Site Scripting on error.htm (the error page), via the errormsg parameter. |
CVE-2017-15008 | Medium | 4.8 | 2017-10-04 | PRTG Network Monitor version 17.3.33.2830 is vulnerable to stored Cross-Site Scripting on all sensor titles, related to incorrect error handling for a %00 in t… |
CVE-2017-14997 | Medium | 6.5 | 2017-10-04 | GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in ReadPICTImage in co… |
CVE-2017-14995 | Medium | 6.1 | 2017-10-04 | The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex Event Processor 4.2… |
CVE-2017-14994 | Medium | 6.5 | 2017-10-04 | ReadDCMImage in coders/dcm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted DICOM image… |
CVE-2017-14991 | Medium | 5.5 | 2017-10-04 | The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive information from uninitialized kernel heap-… |
CVE-2017-14491 | Critical | 9.8 | 2017-10-04 | Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS resp… |
CVE-2017-12822 | Critical | 9.9 | 2017-10-04 | Remote enabling and disabling admin interface in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to ne… |
CVE-2017-12821 | Critical | 9.8 | 2017-10-04 | Memory corruption in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 might cause remote code execution. |
CVE-2017-12820 | High | 7.5 | 2017-10-04 | Arbitrary memory read from controlled memory pointer in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 lead… |
CVE-2017-12819 | Critical | 9.8 | 2017-10-04 | Remote manipulations with language pack updater lead to NTLM-relay attack for system user in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior… |
CVE-2017-12818 | High | 7.5 | 2017-10-04 | Stack overflow in custom XML-parser in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to remote denia… |
CVE-2017-12617 | High | 8.1 | 2017-10-04 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the re… |
CVE-2017-12166 | Critical | 9.8 | 2017-10-04 | OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code ex… |
CVE-2017-1126 | Medium | 5.3 | 2017-10-04 | IBM WebSphere Message Broker (IBM Integration Bus 9.0 and 10.0) could allow an unauthorized user to obtain sensitive information about software versions that c… |
CVE-2017-11122 | High | 7.5 | 2017-10-04 | On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56, an attacker can trigger an information leak due to insufficient length validation, related to ICMPv6 route… |
CVE-2017-0829 | Critical | 9.8 | 2017-10-04 | An elevation of privilege vulnerability in the Motorola bootloader. Product: Android. Versions: Android kernel. Android ID: A-62345044. |
CVE-2017-0828 | Critical | 9.8 | 2017-10-04 | An elevation of privilege vulnerability in the Huawei bootloader. Product: Android. Versions: Android kernel. Android ID: A-34622855. |
CVE-2017-0827 | High | 7.8 | 2017-10-04 | An elevation of privilege vulnerability in the MediaTek soc driver. Product: Android. Versions: Android kernel. Android ID: A-62539960. References: M-ALPS03353… |
CVE-2017-0826 | High | 7.8 | 2017-10-04 | An elevation of privilege vulnerability in the HTC bootloader. Product: Android. Versions: Android kernel. Android ID: A-34949781. |
CVE-2017-0825 | High | 7.5 | 2017-10-04 | An information disclosure vulnerability in the Broadcom wifi driver. Product: Android. Versions: Android kernel. Android ID: A-37305633. References: B-V2017063… |
CVE-2017-0824 | Critical | 9.8 | 2017-10-04 | An elevation of privilege vulnerability in the Broadcom wifi driver. Product: Android. Versions: Android kernel. Android ID: A-37622847. References: B-V2017063… |
CVE-2017-0823 | High | 7.5 | 2017-10-04 | An information disclosure vulnerability in the Android system (rild). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android I… |
CVE-2017-0822 | Critical | 9.8 | 2017-10-04 | An elevation of privilege vulnerability in the Android system (camera). Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63787722. |
CVE-2017-0820 | High | 7.5 | 2017-10-04 | A vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62187433. |
CVE-2017-0819 | High | 7.5 | 2017-10-04 | A vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63045918. |
CVE-2017-0818 | High | 7.5 | 2017-10-04 | A vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63581671. |
CVE-2017-0817 | High | 7.5 | 2017-10-04 | An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1… |
CVE-2017-0816 | Medium | 5.5 | 2017-10-04 | An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7… |
CVE-2017-0815 | Medium | 5.5 | 2017-10-04 | An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7… |
CVE-2017-0814 | High | 7.5 | 2017-10-04 | An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62800140. |
CVE-2017-0813 | High | 7.5 | 2017-10-04 | A denial of service vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36531046. |
CVE-2017-0812 | High | 7.8 | 2017-10-04 | An elevation of privilege vulnerability in the Android media framework (audio hal). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62873231. |
CVE-2017-0811 | High | 7.8 | 2017-10-04 | A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. A… |
CVE-2017-0810 | High | 7.8 | 2017-10-04 | A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-… |
CVE-2017-0809 | High | 7.8 | 2017-10-04 | A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1… |
CVE-2017-0808 | High | 7.5 | 2017-10-04 | An information disclosure vulnerability in the Android framework (file system). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62301183. |