2017 CVEs (page 78)
Page 78 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-10814 | Medium | 6.8 | 2017-09-15 | Buffer overflow in CG-WLR300NM Firmware version 1.90 and earlier allows an attacker to execute arbitrary code via unspecified vectors. |
CVE-2017-10813 | Medium | 6.8 | 2017-09-15 | CG-WLR300NM Firmware version 1.90 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors. |
CVE-2017-4926 | Medium | 5.4 | 2017-09-15 | VMware vCenter Server (6.5 prior to 6.5 U1) contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker with VC user privileges… |
CVE-2017-4925 | Medium | 5.5 | 2017-09-15 | VMware ESXi 6.5 without patch ESXi650-201707101-SG, ESXi 6.0 without patch ESXi600-201706101-SG, ESXi 5.5 without patch ESXi550-201709101-SG, Workstation (12.x… |
CVE-2017-4924 | High | 8.8 | 2017-09-15 | VMware ESXi (ESXi 6.5 without patch ESXi650-201707101-SG), Workstation (12.x before 12.5.7) and Fusion (8.x before 8.5.8) contain an out-of-bounds write vulner… |
CVE-2017-14340 | Medium | 5.5 | 2017-09-15 | The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h in the Linux kernel before 4.13.2 does not verify that a filesystem has a realtime device, which allows l… |
CVE-2017-14489 | Medium | 5.5 | 2017-09-15 | The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows local users to cause a denial of service (panic) by l… |
CVE-2017-14484 | High | 7.3 | 2017-09-15 | The Gentoo sci-mathematics/gimps package before 28.10-r1 for Great Internet Mersenne Prime Search (GIMPS) allows local users to gain privileges by creating a h… |
CVE-2017-14483 | Medium | 5.5 | 2017-09-15 | flower.initd in the Gentoo dev-python/flower package before 0.9.1-r1 for Celery Flower sets PID file ownership to a non-root account, which might allow local u… |
CVE-2017-2809 | High | 7.5 | 2017-09-14 | An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python com… |
CVE-2017-0785 | Medium | 6.5 | 2017-09-14 | A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0… |
CVE-2017-0783 | Medium | 6.5 | 2017-09-14 | A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0… |
CVE-2017-0782 | High | 8.8 | 2017-09-14 | A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. A… |
CVE-2017-0781 | High | 8.8 | 2017-09-14 | A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. A… |
CVE-2017-13761 | Medium | 6.5 | 2017-09-14 | The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitiv… |
CVE-2017-14482 | High | 8.8 | 2017-09-14 | GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML e… |
CVE-2017-13067 | Critical | 9.8 | 2017-09-14 | QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 bui… |
CVE-2017-1490 | Medium | 5.3 | 2017-09-14 | An unspecified vulnerability in the Lifecycle Query Engine of Jazz Reporting Service 6.0 through 6.0.4 could disclose highly sensitive information. |
CVE-2017-1002151 | High | 7.5 | 2017-09-14 | Pagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization |
CVE-2017-1002150 | Medium | 6.1 | 2017-09-14 | python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection |
CVE-2017-1002100 | Medium | 6.5 | 2017-09-14 | Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which… |
CVE-2017-1002028 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter… |
CVE-2017-1002027 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query in file ./rk-respo… |
CVE-2017-1002026 | High | 8.8 | 2017-09-14 | Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id paramete… |
CVE-2017-1002025 | High | 7.2 | 2017-09-14 | Vulnerability in wordpress plugin add-edit-delete-listing-for-member-module v1.0, The plugin author does not sanitize user supplied input via $act before passi… |
CVE-2017-1002024 | Medium | 4.3 | 2017-09-14 | Vulnerability in web application Kind Editor v4.1.12, kindeditor/php/upload_json.php does not check authentication before allow users to upload files. |
CVE-2017-1002023 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager… |
CVE-2017-1002022 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query. |
CVE-2017-1002021 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before placing it inside of an… |
CVE-2017-1002020 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query. |
CVE-2017-1002019 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the… |
CVE-2017-1002018 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the e… |
CVE-2017-1002017 | Medium | 6.1 | 2017-09-14 | Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability. |
CVE-2017-1002016 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that… |
CVE-2017-1002015 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via selectMulGalle… |
CVE-2017-1002014 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via gallery_name p… |
CVE-2017-1002013 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.ph… |
CVE-2017-1002012 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/admin_setting.php the following snippet of code does not… |
CVE-2017-1002011 | Medium | 5.4 | 2017-09-14 | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, There is a stored XSS vulnerability via the $value->gallery_name and $value->gallery_des… |
CVE-2017-1002010 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL i… |
CVE-2017-1002009 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL i… |
CVE-2017-1002008 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/d… |
CVE-2017-1002007 | High | 7.5 | 2017-09-14 | Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_mail.php doesn't check that the user is authorized before injecting new contacts into t… |
CVE-2017-1002006 | High | 7.5 | 2017-09-14 | Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts int… |
CVE-2017-1002005 | High | 7.5 | 2017-09-14 | Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the e… |
CVE-2017-1002004 | High | 7.5 | 2017-09-14 | Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of… |
CVE-2017-1002003 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from http://www.inved… |
CVE-2017-1002002 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com/ |
CVE-2017-1002001 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com. |
CVE-2017-1002000 | Critical | 9.8 | 2017-09-14 | Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php… |
CVE-2017-13779 | High | 7.8 | 2017-09-14 | GSTN_offline_tool in India Goods and Services Tax Network (GSTN) Offline Utility tool before 1.2 executes winstart-server.vbs from the "C:\GST Offline Tool" di… |
CVE-2017-13725 | Critical | 9.8 | 2017-09-14 | The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print(). |
CVE-2017-13690 | Critical | 9.8 | 2017-09-14 | The IKEv2 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c, several functions. |
CVE-2017-13689 | Critical | 9.8 | 2017-09-14 | The IKEv1 parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:ikev1_id_print(). |
CVE-2017-13688 | Critical | 9.8 | 2017-09-14 | The OLSR parser in tcpdump before 4.9.2 has a buffer over-read in print-olsr.c:olsr_print(). |
CVE-2017-13687 | Critical | 9.8 | 2017-09-14 | The Cisco HDLC parser in tcpdump before 4.9.2 has a buffer over-read in print-chdlc.c:chdlc_print(). |
CVE-2017-13055 | Critical | 9.8 | 2017-09-14 | The ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print_is_reach_subtlv(). |
CVE-2017-13054 | Critical | 9.8 | 2017-09-14 | The LLDP parser in tcpdump before 4.9.2 has a buffer over-read in print-lldp.c:lldp_private_8023_print(). |
CVE-2017-13053 | Critical | 9.8 | 2017-09-14 | The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:decode_rt_routing_info(). |
CVE-2017-13052 | Critical | 9.8 | 2017-09-14 | The CFM parser in tcpdump before 4.9.2 has a buffer over-read in print-cfm.c:cfm_print(). |
CVE-2017-13051 | Critical | 9.8 | 2017-09-14 | The RSVP parser in tcpdump before 4.9.2 has a buffer over-read in print-rsvp.c:rsvp_obj_print(). |
CVE-2017-13050 | Critical | 9.8 | 2017-09-14 | The RPKI-Router parser in tcpdump before 4.9.2 has a buffer over-read in print-rpki-rtr.c:rpki_rtr_pdu_print(). |
CVE-2017-13049 | Critical | 9.8 | 2017-09-14 | The Rx protocol parser in tcpdump before 4.9.2 has a buffer over-read in print-rx.c:ubik_print(). |
CVE-2017-13048 | Critical | 9.8 | 2017-09-14 | The RSVP parser in tcpdump before 4.9.2 has a buffer over-read in print-rsvp.c:rsvp_obj_print(). |
CVE-2017-13047 | Critical | 9.8 | 2017-09-14 | The ISO ES-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:esis_print(). |
CVE-2017-13046 | Critical | 9.8 | 2017-09-14 | The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:bgp_attr_print(). |
CVE-2017-13045 | Critical | 9.8 | 2017-09-14 | The VQP parser in tcpdump before 4.9.2 has a buffer over-read in print-vqp.c:vqp_print(). |
CVE-2017-13044 | Critical | 9.8 | 2017-09-14 | The HNCP parser in tcpdump before 4.9.2 has a buffer over-read in print-hncp.c:dhcpv4_print(). |
CVE-2017-13043 | Critical | 9.8 | 2017-09-14 | The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:decode_multicast_vpn(). |
CVE-2017-13042 | Critical | 9.8 | 2017-09-14 | The HNCP parser in tcpdump before 4.9.2 has a buffer over-read in print-hncp.c:dhcpv6_print(). |
CVE-2017-13041 | Critical | 9.8 | 2017-09-14 | The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_nodeinfo_print(). |
CVE-2017-13040 | Critical | 9.8 | 2017-09-14 | The MPTCP parser in tcpdump before 4.9.2 has a buffer over-read in print-mptcp.c, several functions. |
CVE-2017-13039 | Critical | 9.8 | 2017-09-14 | The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c, several functions. |
CVE-2017-13038 | Critical | 9.8 | 2017-09-14 | The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:handle_mlppp(). |
CVE-2017-13037 | Critical | 9.8 | 2017-09-14 | The IP parser in tcpdump before 4.9.2 has a buffer over-read in print-ip.c:ip_printts(). |
CVE-2017-13036 | Critical | 9.8 | 2017-09-14 | The OSPFv3 parser in tcpdump before 4.9.2 has a buffer over-read in print-ospf6.c:ospf6_decode_v3(). |
CVE-2017-13035 | Critical | 9.8 | 2017-09-14 | The ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print_id(). |
CVE-2017-13034 | Critical | 9.8 | 2017-09-14 | The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print(). |
CVE-2017-13033 | Critical | 9.8 | 2017-09-14 | The VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print(). |
CVE-2017-13032 | Critical | 9.8 | 2017-09-14 | The RADIUS parser in tcpdump before 4.9.2 has a buffer over-read in print-radius.c:print_attr_string(). |
CVE-2017-13031 | Critical | 9.8 | 2017-09-14 | The IPv6 fragmentation header parser in tcpdump before 4.9.2 has a buffer over-read in print-frag6.c:frag6_print(). |
CVE-2017-13030 | Critical | 9.8 | 2017-09-14 | The PIM parser in tcpdump before 4.9.2 has a buffer over-read in print-pim.c, several functions. |
CVE-2017-13029 | Critical | 9.8 | 2017-09-14 | The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:print_ccp_config_options(). |
CVE-2017-13028 | Critical | 9.8 | 2017-09-14 | The BOOTP parser in tcpdump before 4.9.2 has a buffer over-read in print-bootp.c:bootp_print(). |
CVE-2017-13027 | Critical | 9.8 | 2017-09-14 | The LLDP parser in tcpdump before 4.9.2 has a buffer over-read in print-lldp.c:lldp_mgmt_addr_tlv_print(). |
CVE-2017-13026 | Critical | 9.8 | 2017-09-14 | The ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c, several functions. |
CVE-2017-13025 | Critical | 9.8 | 2017-09-14 | The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print(). |
CVE-2017-13024 | Critical | 9.8 | 2017-09-14 | The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print(). |
CVE-2017-13023 | Critical | 9.8 | 2017-09-14 | The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print(). |
CVE-2017-13022 | Critical | 9.8 | 2017-09-14 | The IP parser in tcpdump before 4.9.2 has a buffer over-read in print-ip.c:ip_printroute(). |
CVE-2017-13021 | Critical | 9.8 | 2017-09-14 | The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_print(). |
CVE-2017-13020 | Critical | 9.8 | 2017-09-14 | The VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print(). |
CVE-2017-13019 | Critical | 9.8 | 2017-09-14 | The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print(). |
CVE-2017-13018 | Critical | 9.8 | 2017-09-14 | The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print(). |
CVE-2017-13017 | Critical | 9.8 | 2017-09-14 | The DHCPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-dhcp6.c:dhcp6opt_print(). |
CVE-2017-13016 | Critical | 9.8 | 2017-09-14 | The ISO ES-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:esis_print(). |
CVE-2017-13015 | Critical | 9.8 | 2017-09-14 | The EAP parser in tcpdump before 4.9.2 has a buffer over-read in print-eap.c:eap_print(). |
CVE-2017-13014 | Critical | 9.8 | 2017-09-14 | The White Board protocol parser in tcpdump before 4.9.2 has a buffer over-read in print-wb.c:wb_prep(), several functions. |
CVE-2017-13013 | Critical | 9.8 | 2017-09-14 | The ARP parser in tcpdump before 4.9.2 has a buffer over-read in print-arp.c, several functions. |
CVE-2017-13012 | Critical | 9.8 | 2017-09-14 | The ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print(). |