2017 CVEs (page 77)
Page 77 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-14142 | Medium | 6.1 | 2017-09-19 | Multiple cross-site scripting (XSS) vulnerabilities in Kaltura before 13.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) partnerI… |
CVE-2017-14141 | High | 7.2 | 2017-09-19 | The wiki_decode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks an… |
CVE-2017-10700 | Critical | 9.8 | 2017-09-19 | In the medialibrary component in QNAP NAS 4.3.3.0229, an un-authenticated, remote attacker can execute arbitrary system commands as the root user of the NAS ap… |
CVE-2017-10931 | High | 7.5 | 2017-09-19 | The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to download any files… |
CVE-2017-10930 | Critical | 9.8 | 2017-09-19 | The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in ordinary users being able to download con… |
CVE-2017-12616 | High | 7.5 | 2017-09-19 | When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resour… |
CVE-2017-12615 | High | 8.1 | 2017-09-19 | When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) i… |
CVE-2017-14601 | Medium | 4.9 | 2017-09-19 | Pragyan CMS v3.0 is vulnerable to a Boolean-based SQL injection in cms/admin.lib.php via $_GET['forwhat'], resulting in Information Disclosure. |
CVE-2017-14600 | Medium | 4.9 | 2017-09-19 | Pragyan CMS v3.0 is vulnerable to an Error-Based SQL injection in cms/admin.lib.php via $_GET['del_black'], resulting in Information Disclosure. |
CVE-2017-14597 | Medium | 4.8 | 2017-09-19 | AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain. |
CVE-2017-9803 | High | 7.5 | 2017-09-18 | Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another app… |
CVE-2017-6147 | Medium | 5.9 | 2017-09-18 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.1.2-HF1 and 13.0.0, an undisclosed type of responses may cause TMM t… |
CVE-2017-14580 | High | 7.8 | 2017-09-18 | XnView Classic for Windows Version 2.41 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mod… |
CVE-2017-14579 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "Read Access Violation on Con… |
CVE-2017-14578 | High | 7.8 | 2017-09-18 | IrfanView 4.44 - 32bit allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .ani file, related to "Data from F… |
CVE-2017-14577 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "Read Access Violation on Con… |
CVE-2017-14576 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to a "Possible Sta… |
CVE-2017-14575 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to an "Illegal Instruction Violati… |
CVE-2017-14574 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "User Mode Write AV starting… |
CVE-2017-14573 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to an "Illegal Instruction Violati… |
CVE-2017-14572 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "User Mode Write AV starting… |
CVE-2017-14571 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to an "Illegal Instruction Violati… |
CVE-2017-14570 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "User Mode Write AV near NULL… |
CVE-2017-14569 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to a "Read Access… |
CVE-2017-14568 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to an "Illegal Instruction Violati… |
CVE-2017-14567 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to an "Illegal Instruction Violati… |
CVE-2017-14566 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "User Mode Write AV starting… |
CVE-2017-14565 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to a "Possible Sta… |
CVE-2017-14564 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faul… |
CVE-2017-14563 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "Read Access Violation on Blo… |
CVE-2017-14562 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to an "Error Code… |
CVE-2017-14561 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to an "Illegal Instruction Violati… |
CVE-2017-14560 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faul… |
CVE-2017-14559 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file, related to a "Read Access Violation on Blo… |
CVE-2017-14558 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .djvu file, related to a "User Mode Write AV starting… |
CVE-2017-14557 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .djvu file, related to a "User Mode Write AV starting… |
CVE-2017-14556 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .djvu file, related to a "User Mode Write AV starting… |
CVE-2017-14555 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file, related to "Data from Fau… |
CVE-2017-14554 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file, related to a "Possible St… |
CVE-2017-14553 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .djvu file, related to a "User Mode Write AV starting… |
CVE-2017-14552 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .djvu file, related to a "User Mode Write AV starting… |
CVE-2017-14551 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file, related to "Data from Fau… |
CVE-2017-14550 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file, related to a "Possible St… |
CVE-2017-14549 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .djvu file, related to a "Heap Corruption starting at… |
CVE-2017-14548 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .djvu file, related to a "User Mode Write AV starting… |
CVE-2017-14547 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .mobi file, related to a "Read Access… |
CVE-2017-14546 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .epub file, related to an "Error Code… |
CVE-2017-14545 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .epub file, related to "Data from Fau… |
CVE-2017-14544 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .epub file, related to "Data from Fau… |
CVE-2017-14543 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .epub file, related to "Data from Fau… |
CVE-2017-14542 | High | 7.8 | 2017-09-18 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .epub file, related to a "Read Access Violation on Bl… |
CVE-2017-14541 | High | 7.8 | 2017-09-18 | XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .svg file, relate… |
CVE-2017-14540 | High | 7.8 | 2017-09-18 | IrfanView 4.44 - 32bit allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .svg file, related to "Data from F… |
CVE-2017-14539 | High | 7.8 | 2017-09-18 | IrfanView 4.44 - 32bit allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .svg file, related to "Data from F… |
CVE-2017-14538 | High | 7.8 | 2017-09-18 | XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from… |
CVE-2017-0380 | Medium | 5.9 | 2017-09-18 | The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1… |
CVE-2017-9798 | High | 7.5 | 2017-09-18 | Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has… |
CVE-2017-14534 | Medium | 6.1 | 2017-09-18 | Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to location.php, related to PHP_SELF. |
CVE-2017-12157 | Medium | 4.3 | 2017-09-18 | In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access. |
CVE-2017-12156 | Medium | 6.1 | 2017-09-18 | Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback. |
CVE-2017-9333 | High | 8.8 | 2017-09-18 | OpenWebif 1.2.5 allows remote code execution via a URL to the CallOPKG function in the IpkgController class in plugin/controllers/ipkg.py, when the URL refers… |
CVE-2017-14533 | Medium | 6.5 | 2017-09-18 | ImageMagick 7.0.6-6 has a memory leak in ReadMATImage in coders/mat.c. |
CVE-2017-14532 | Critical | 9.8 | 2017-09-18 | ImageMagick 7.0.7-0 has a NULL Pointer Dereference in TIFFIgnoreTags in coders/tiff.c. |
CVE-2017-14531 | Medium | 6.5 | 2017-09-18 | ImageMagick 7.0.7-0 has a memory exhaustion issue in ReadSUNImage in coders/sun.c. |
CVE-2017-14530 | High | 8.0 | 2017-09-18 | WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstr… |
CVE-2017-14529 | Medium | 5.5 | 2017-09-18 | The pe_print_idata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles HintName ve… |
CVE-2017-14528 | Medium | 6.5 | 2017-09-18 | The TIFFSetProfiles function in coders/tiff.c in ImageMagick 7.0.6 has incorrect expectations about whether LibTIFF TIFFGetField return values imply that data… |
CVE-2017-14520 | High | 7.8 | 2017-09-17 | In Poppler 0.59.0, a floating point exception occurs in Splash::scaleImageYuXd() in Splash.cc, which may lead to a potential attack when handling malicious PDF… |
CVE-2017-14519 | High | 7.5 | 2017-09-17 | In Poppler 0.59.0, memory corruption occurs in a call to Object::streamGetChar in Object.h after a repeating series of Gfx::display, Gfx::go, Gfx::execOp, Gfx… |
CVE-2017-14518 | High | 7.8 | 2017-09-17 | In Poppler 0.59.0, a floating point exception exists in the isImageInterpolationRequired() function in Splash.cc via a crafted PDF document. |
CVE-2017-14517 | Medium | 5.5 | 2017-09-17 | In Poppler 0.59.0, a NULL Pointer Dereference exists in the XRef::parseEntry() function in XRef.cc via a crafted PDF document. |
CVE-2017-14515 | High | 7.5 | 2017-09-17 | Heap-based Buffer Overflow on Tenda W15E devices before 15.11.0.14 allows remote attackers to cause a denial of service (temporary HTTP outage and forced logou… |
CVE-2017-14514 | High | 7.5 | 2017-09-17 | Directory Traversal on Tenda W15E devices before 15.11.0.14 allows remote attackers to read unencrypted files via a crafted URL. |
CVE-2017-14513 | Medium | 5.3 | 2017-09-17 | Directory traversal vulnerability in MetInfo 5.3.17 allows remote attackers to read information from any ini format file via the f_filename parameter in a fing… |
CVE-2017-14512 | Critical | 9.8 | 2017-09-17 | NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an editforum action, a different vulnerability than CVE-2017-12981. |
CVE-2017-14511 | High | 7.5 | 2017-09-17 | An issue was discovered in SAP E-Recruiting (aka ERECRUIT) 605 through 617. When an external applicant registers to the E-Recruiting application, he/she receiv… |
CVE-2017-14510 | Medium | 6.1 | 2017-09-17 | An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture f… |
CVE-2017-14509 | High | 8.8 | 2017-09-17 | An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusio… |
CVE-2017-14508 | High | 8.8 | 2017-09-17 | An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have bee… |
CVE-2017-14505 | Medium | 6.5 | 2017-09-17 | DrawGetStrokeDashArray in wand/drawing-wand.c in ImageMagick 7.0.7-1 mishandles certain NULL arrays, which allows attackers to perform Denial of Service (NULL… |
CVE-2017-14504 | Medium | 6.5 | 2017-09-17 | ReadPNMImage in coders/pnm.c in GraphicsMagick 1.3.26 does not ensure the correct number of colors for the XV 332 format, leading to a NULL Pointer Dereference. |
CVE-2017-14244 | Critical | 9.8 | 2017-09-17 | An authentication bypass vulnerability on iBall Baton ADSL2+ Home Router FW_iB-LR7011A_1.0.2 devices potentially allows attackers to directly access administra… |
CVE-2017-14243 | Critical | 9.8 | 2017-09-17 | An authentication bypass vulnerability on UTStar WA3002G4 ADSL Broadband Modem WA3002G4-0021.01 devices allows attackers to directly access administrative sett… |
CVE-2017-14503 | Medium | 6.5 | 2017-09-17 | libarchive 3.3.2 suffers from an out-of-bounds read within lha_read_data_none() in archive_read_support_format_lha.c when extracting a specially crafted lha ar… |
CVE-2017-14502 | High | 7.5 | 2017-09-17 | read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bo… |
CVE-2017-14501 | Medium | 6.5 | 2017-09-17 | An out-of-bounds read flaw exists in parse_file_info in archive_read_support_format_iso9660.c in libarchive 3.3.2 when extracting a specially crafted iso9660 i… |
CVE-2017-14500 | High | 8.8 | 2017-09-17 | Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote att… |
CVE-2017-9328 | Critical | 9.8 | 2017-09-15 | Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root. |
CVE-2017-9805 | High | 8.1 | 2017-09-15 | The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserializati… |
CVE-2017-0898 | Critical | 9.1 | 2017-09-15 | Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation… |
CVE-2017-2299 | High | 7.5 | 2017-09-15 | Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca` parame… |
CVE-2017-14498 | Medium | 6.1 | 2017-09-15 | SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pa… |
CVE-2017-14497 | High | 7.8 | 2017-09-15 | The tpacket_rcv function in net/packet/af_packet.c in the Linux kernel before 4.13 mishandles vnet headers, which might allow local users to cause a denial of… |
CVE-2017-10860 | High | 7.8 | 2017-09-15 | Untrusted search path vulnerability in "i-filter 6.0 installer" timestamp of code signing is before 23 Aug 2017 (JST) allows an attacker to execute arbitrary c… |
CVE-2017-10859 | High | 7.8 | 2017-09-15 | Untrusted search path vulnerability in "i-filter 6.0 installer" timestamp of code signing is before 23 Aug 2017 (JST) allows an attacker to gain privileges via… |
CVE-2017-10858 | High | 7.8 | 2017-09-15 | Untrusted search path vulnerability in "i-filter 6.0 install program" file version 1.0.8.1 and earlier allows an attacker to gain privileges via a Trojan horse… |
CVE-2017-10856 | Low | 3.7 | 2017-09-15 | SEIL/X 4.60 to 5.72, SEIL/B1 4.60 to 5.72, SEIL/x86 3.20 to 5.72, SEIL/BPV4 5.00 to 5.72 allows remote attackers to cause a temporary failure of the device's e… |
CVE-2017-10855 | High | 7.8 | 2017-09-15 | Untrusted search path vulnerability in FENCE-Explorer for Windows V8.4.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspeci… |
CVE-2017-10846 | High | 7.5 | 2017-09-15 | Wi-Fi STATION L-02F Software version V10b and earlier allows remote attackers to bypass access restrictions to obtain information on device settings via unspec… |
CVE-2017-10845 | Critical | 9.8 | 2017-09-15 | Wi-Fi STATION L-02F Software version V10g and earlier allows remote attackers to access the device with administrative privileges and perform unintended operat… |