2017 CVEs (page 73)
Page 73 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-0807 | Critical | 9.8 | 2017-10-04 | An elevation of privilege vulnerability in the Android framework (ui framework). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2… |
CVE-2017-0806 | High | 7.8 | 2017-10-04 | An elevation of privilege vulnerability in the Android framework (gatekeeperresponse). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android… |
CVE-2017-9797 | Medium | 6.5 | 2017-10-03 | When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata me… |
CVE-2017-9538 | Medium | 4.9 | 2017-10-03 | The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to cause a denial of serv… |
CVE-2017-9537 | Medium | 4.8 | 2017-10-03 | Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows remote attackers to intro… |
CVE-2017-8021 | Critical | 9.8 | 2017-10-03 | EMC Elastic Cloud Storage (ECS) before 3.1 is affected by an undocumented account vulnerability that could potentially be leveraged by malicious users to compr… |
CVE-2017-8018 | High | 7.5 | 2017-10-03 | EMC AppSync host plug-in versions 3.5 and below (Windows platform only) includes a denial of service (DoS) vulnerability that could potentially be exploited by… |
CVE-2017-6090 | High | 8.8 | 2017-10-03 | Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by… |
CVE-2017-6089 | Critical | 9.8 | 2017-10-03 | SQL injection vulnerability in PhpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) project or id parameters to to… |
CVE-2017-1569 | High | 7.5 | 2017-10-03 | IBM WebSphere Commerce 7.0 and 8.0 contains an unspecified vulnerability in Marketing ESpot's that could cause a denial of service. IBM X-Force ID: 131779. |
CVE-2017-14990 | Medium | 6.5 | 2017-10-03 | WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it… |
CVE-2017-14989 | Medium | 6.5 | 2017-10-03 | A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a crafted font file, becau… |
CVE-2017-14988 | Medium | 5.5 | 2017-10-03 | Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessive memory allocation) via a crafted file… |
CVE-2017-14985 | Medium | 5.4 | 2017-10-03 | Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script… |
CVE-2017-14984 | Medium | 5.4 | 2017-10-03 | Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script… |
CVE-2017-14983 | Medium | 4.8 | 2017-10-03 | Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to inject arbitrary w… |
CVE-2017-14981 | Medium | 5.4 | 2017-10-03 | Cross-Site Scripting (XSS) was discovered in ATutor before 2.2.3. The vulnerability exists due to insufficient filtration of data (url in /mods/_standard/rss_f… |
CVE-2017-14979 | High | 7.5 | 2017-10-03 | Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathn… |
CVE-2017-14848 | High | 8.8 | 2017-10-03 | WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter. |
CVE-2017-14773 | High | 7.8 | 2017-10-03 | Skybox Manager Client Application prior to 8.5.501 is prone to an elevation of privileges vulnerability during authentication of a valid user in a debugger-pau… |
CVE-2017-14772 | Low | 3.3 | 2017-10-03 | Skybox Manager Client Application is prone to information disclosure via a username enumeration attack. A local unauthenticated attacker could exploit the flaw… |
CVE-2017-14771 | Medium | 5.5 | 2017-10-03 | Skybox Manager Client Application prior to 8.5.501 is prone to an arbitrary file upload vulnerability due to insufficient input validation of user-supplied fil… |
CVE-2017-14770 | Medium | 5.5 | 2017-10-03 | Skybox Manager Client Application prior to 8.5.501 is prone to an information disclosure vulnerability of user password hashes. A local authenticated attacker… |
CVE-2017-14759 | Critical | 9.8 | 2017-10-03 | OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to an XML… |
CVE-2017-14758 | High | 8.8 | 2017-10-03 | OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to SQL Inj… |
CVE-2017-14757 | High | 8.8 | 2017-10-03 | OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to SQL Inj… |
CVE-2017-14756 | Medium | 6.1 | 2017-10-03 | OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Cross-S… |
CVE-2017-14755 | Medium | 6.1 | 2017-10-03 | OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Cross-S… |
CVE-2017-14754 | Medium | 6.5 | 2017-10-03 | OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Arbitra… |
CVE-2017-14496 | High | 7.5 | 2017-10-03 | Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote… |
CVE-2017-14495 | High | 7.5 | 2017-10-03 | Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service… |
CVE-2017-14494 | Medium | 5.9 | 2017-10-03 | dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded… |
CVE-2017-14493 | Critical | 9.8 | 2017-10-03 | Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6… |
CVE-2017-14492 | Critical | 9.8 | 2017-10-03 | Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 rou… |
CVE-2017-1429 | Medium | 5.4 | 2017-10-03 | IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2017-13997 | Critical | 9.8 | 2017-10-03 | A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8… |
CVE-2017-13704 | High | 7.5 | 2017-10-03 | In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigne… |
CVE-2017-1369 | Medium | 5.4 | 2017-10-03 | IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2017-1364 | Medium | 5.4 | 2017-10-03 | IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2017-1359 | Medium | 5.4 | 2017-10-03 | IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2017-1345 | Medium | 5.4 | 2017-10-03 | IBM Insights Foundation for Energy 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2017-1335 | Medium | 5.4 | 2017-10-03 | IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2017-1334 | Medium | 5.4 | 2017-10-03 | IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2017-1324 | Medium | 5.4 | 2017-10-03 | IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2017-1311 | High | 8.8 | 2017-10-03 | IBM Insights Foundation for Energy 2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the att… |
CVE-2017-12792 | Medium | 6.1 | 2017-10-03 | Multiple cross-site request forgery (CSRF) vulnerabilities in NexusPHP 1.5 allow remote attackers to hijack the authentication of administrators for requests t… |
CVE-2017-12639 | Critical | 9.8 | 2017-10-03 | Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspecified vectors in IM… |
CVE-2017-12638 | Critical | 9.8 | 2017-10-03 | Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspecified vectors in IM… |
CVE-2017-12620 | Critical | 9.8 | 2017-10-03 | When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications… |
CVE-2017-11498 | High | 7.5 | 2017-10-03 | Buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to shut… |
CVE-2017-11497 | Critical | 9.8 | 2017-10-03 | Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers t… |
CVE-2017-11496 | Critical | 9.8 | 2017-10-03 | Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers t… |
CVE-2017-11322 | High | 8.2 | 2017-10-03 | The chroothole_client executable in UCOPIA Wireless Appliance before 5.1.8 allows remote attackers to gain root privileges via a dollar sign ($) metacharacter… |
CVE-2017-11321 | High | 7.2 | 2017-10-03 | The restricted shell interface in UCOPIA Wireless Appliance before 5.1.8 allows remote authenticated users to gain 'admin' privileges via shell metacharacters… |
CVE-2017-14977 | High | 7.5 | 2017-10-02 | The FoFiTrueType::getCFFBlock function in FoFiTrueType.cc in Poppler 0.59.0 has a NULL pointer dereference vulnerability due to lack of validation of a table p… |
CVE-2017-14976 | High | 7.5 | 2017-10-02 | The FoFiType1C::convertToType0 function in FoFiType1C.cc in Poppler 0.59.0 has a heap-based buffer over-read vulnerability if an out-of-bounds font dictionary… |
CVE-2017-14975 | High | 7.5 | 2017-10-02 | The FoFiType1C::convertToType0 function in FoFiType1C.cc in Poppler 0.59.0 has a NULL pointer dereference vulnerability because a data structure is not initial… |
CVE-2017-14974 | Medium | 5.5 | 2017-10-02 | The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandle the failure of a… |
CVE-2017-14970 | Medium | 5.9 | 2017-10-02 | In lib/ofp-util.c in Open vSwitch (OvS) before 2.8.1, there are multiple memory leaks while parsing malformed OpenFlow group mod messages. NOTE: the vendor dis… |
CVE-2017-14958 | High | 7.2 | 2017-10-02 | lib.php in PivotX 2.3.11 does not properly block uploads of dangerous file types by admin users, which allows remote PHP code execution via an upload of a .php… |
CVE-2017-14957 | Medium | 6.1 | 2017-10-02 | Stored XSS vulnerability via a comment in inc/conv.php in BlogoText before 3.7.6 allows an unauthenticated attacker to inject JavaScript. If the victim is an a… |
CVE-2017-14955 | Medium | 5.9 | 2017-10-02 | Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain se… |
CVE-2017-14954 | Medium | 5.5 | 2017-10-02 | The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4 accesses rusage data structures in unintended cases, which allows local users to… |
CVE-2017-14941 | Medium | 6.5 | 2017-10-02 | Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source… |
CVE-2017-14797 | High | 7.5 | 2017-10-01 | Lack of Transport Encryption in the public API in Philips Hue Bridge BSB002 SW 1707040932 allows remote attackers to read API keys (and consequently bypass the… |
CVE-2017-9794 | Medium | 4.3 | 2017-09-30 | When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In… |
CVE-2017-14947 | High | 7.8 | 2017-09-30 | Artifex GSView 6.0 Beta on Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "Read Access V… |
CVE-2017-14946 | High | 7.8 | 2017-09-30 | Artifex GSView 6.0 Beta on Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to… |
CVE-2017-14945 | High | 7.8 | 2017-09-30 | Artifex GSView 6.0 Beta on Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .pdf file, related to… |
CVE-2017-14944 | High | 7.5 | 2017-09-30 | Inedo ProGet before 4.7.14 does not properly address dangerous package IDs during package addition, aka PG-1060. |
CVE-2017-14942 | Critical | 9.8 | 2017-09-30 | Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct request for cgi-bin/Downl… |
CVE-2017-14940 | Medium | 5.5 | 2017-09-30 | scan_unit_for_symbols in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cau… |
CVE-2017-14939 | Medium | 5.5 | 2017-09-30 | decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a length calculation, wh… |
CVE-2017-14938 | Medium | 5.5 | 2017-09-30 | _bfd_elf_slurp_version_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers t… |
CVE-2017-14935 | High | 7.5 | 2017-09-30 | Pulse Secure Pulse One On-Premise 2.0.1649 and below does not properly validate requests, which allows remote users to query and obtain sensitive information. |
CVE-2017-14934 | Medium | 5.5 | 2017-09-30 | process_debug_info in dwarf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a… |
CVE-2017-14933 | Medium | 5.5 | 2017-09-30 | read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to ca… |
CVE-2017-14932 | Medium | 5.5 | 2017-09-30 | decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a… |
CVE-2017-14931 | Medium | 5.5 | 2017-09-30 | ExifImageFile::readDQT in ExifImageFileRead.cpp in OpenExif 2.1.4 allows remote attackers to cause a denial of service (stack-based buffer over-read and applic… |
CVE-2017-14930 | Medium | 5.5 | 2017-09-30 | Memory leak in decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attack… |
CVE-2017-14929 | High | 7.5 | 2017-09-30 | In Poppler 0.59.0, memory corruption occurs in a call to Object::dictLookup() in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx… |
CVE-2017-14928 | Medium | 5.5 | 2017-09-30 | In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Configuration::Configuration in Annot.cc via a crafted PDF document. |
CVE-2017-14927 | Medium | 5.5 | 2017-09-30 | In Poppler 0.59.0, a NULL Pointer Dereference exists in the SplashOutputDev::type3D0() function in SplashOutputDev.cc via a crafted PDF document. |
CVE-2017-14926 | Medium | 5.5 | 2017-09-30 | In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF document. |
CVE-2017-14925 | High | 8.0 | 2017-09-30 | Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allo… |
CVE-2017-14924 | High | 8.0 | 2017-09-30 | Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allo… |
CVE-2017-14923 | Medium | 5.4 | 2017-09-30 | Stored XSS vulnerability via IMG element at "Leadname" of CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript… |
CVE-2017-14922 | Medium | 5.4 | 2017-09-30 | Stored XSS vulnerability via IMG element at "History" of Profile, Calendar, Tasks, and CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticat… |
CVE-2017-14921 | Medium | 5.4 | 2017-09-30 | Stored XSS vulnerability via IMG element at "Filename" of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject Jav… |
CVE-2017-14920 | Medium | 6.1 | 2017-09-30 | Stored XSS vulnerability in eGroupware Community Edition before 16.1.20170922 allows an unauthenticated remote attacker to inject JavaScript via the User-Agent… |
CVE-2017-14738 | Critical | 9.8 | 2017-09-30 | FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the metafield parameter inside t… |
CVE-2017-14702 | Critical | 9.8 | 2017-09-30 | ERS Data System 1.8.1.0 allows remote attackers to execute arbitrary code, related to "com.branaghgroup.ecers.update.UpdateRequest" object deserialization. |
CVE-2017-14620 | Medium | 6.1 | 2017-09-30 | SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQueries resulting in Stored Cross Site Sc… |
CVE-2017-14582 | Medium | 5.9 | 2017-09-30 | The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middl… |
CVE-2017-14352 | Medium | 6.1 | 2017-09-30 | A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.23. These vulnerabiliti… |
CVE-2017-14351 | Critical | 9.8 | 2017-09-30 | A potential security vulnerability has been identified in HP UCMDB Configuration Manager versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.23. These vulnerabiliti… |
CVE-2017-14350 | Critical | 9.8 | 2017-09-30 | A potential security vulnerability has been identified in HPE Application Performance Management (BSM) Platform versions 9.26, 9.30, 9.40. The vulnerability co… |
CVE-2017-14349 | Critical | 9.8 | 2017-09-30 | An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interfaces and monitors, pot… |
CVE-2017-13991 | Medium | 5.3 | 2017-09-30 | An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of… |
CVE-2017-13990 | Medium | 5.3 | 2017-09-30 | An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of… |