2017 CVEs (page 79)
Page 79 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-13011 | Critical | 9.8 | 2017-09-14 | Several protocol parsers in tcpdump before 4.9.2 could cause a buffer overflow in util-print.c:bittok2str_internal(). |
CVE-2017-13010 | Critical | 9.8 | 2017-09-14 | The BEEP parser in tcpdump before 4.9.2 has a buffer over-read in print-beep.c:l_strnstart(). |
CVE-2017-13009 | Critical | 9.8 | 2017-09-14 | The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_print(). |
CVE-2017-13008 | Critical | 9.8 | 2017-09-14 | The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_11.c:parse_elements(). |
CVE-2017-13007 | Critical | 9.8 | 2017-09-14 | The Apple PKTAP parser in tcpdump before 4.9.2 has a buffer over-read in print-pktap.c:pktap_if_print(). |
CVE-2017-13006 | Critical | 9.8 | 2017-09-14 | The L2TP parser in tcpdump before 4.9.2 has a buffer over-read in print-l2tp.c, several functions. |
CVE-2017-13005 | Critical | 9.8 | 2017-09-14 | The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:xid_map_enter(). |
CVE-2017-13004 | Critical | 9.8 | 2017-09-14 | The Juniper protocols parser in tcpdump before 4.9.2 has a buffer over-read in print-juniper.c:juniper_parse_header(). |
CVE-2017-13003 | Critical | 9.8 | 2017-09-14 | The LMP parser in tcpdump before 4.9.2 has a buffer over-read in print-lmp.c:lmp_print(). |
CVE-2017-13002 | Critical | 9.8 | 2017-09-14 | The AODV parser in tcpdump before 4.9.2 has a buffer over-read in print-aodv.c:aodv_extension(). |
CVE-2017-13001 | Critical | 9.8 | 2017-09-14 | The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:nfs_printfh(). |
CVE-2017-13000 | Critical | 9.8 | 2017-09-14 | The IEEE 802.15.4 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_15_4.c:ieee802_15_4_if_print(). |
CVE-2017-12999 | Critical | 9.8 | 2017-09-14 | The IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print(). |
CVE-2017-12998 | Critical | 9.8 | 2017-09-14 | The IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print_extd_ip_reach(). |
CVE-2017-12997 | Critical | 9.8 | 2017-09-14 | The LLDP parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in print-lldp.c:lldp_private_8021_print(). |
CVE-2017-12996 | Critical | 9.8 | 2017-09-14 | The PIMv2 parser in tcpdump before 4.9.2 has a buffer over-read in print-pim.c:pimv2_print(). |
CVE-2017-12995 | Critical | 9.8 | 2017-09-14 | The DNS parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in print-domain.c:ns_print(). |
CVE-2017-12994 | Critical | 9.8 | 2017-09-14 | The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:bgp_attr_print(). |
CVE-2017-12993 | Critical | 9.8 | 2017-09-14 | The Juniper protocols parser in tcpdump before 4.9.2 has a buffer over-read in print-juniper.c, several functions. |
CVE-2017-12992 | Critical | 9.8 | 2017-09-14 | The RIPng parser in tcpdump before 4.9.2 has a buffer over-read in print-ripng.c:ripng_print(). |
CVE-2017-12991 | Critical | 9.8 | 2017-09-14 | The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:bgp_attr_print(). |
CVE-2017-12990 | Critical | 9.8 | 2017-09-14 | The ISAKMP parser in tcpdump before 4.9.2 could enter an infinite loop due to bugs in print-isakmp.c, several functions. |
CVE-2017-12989 | High | 7.5 | 2017-09-14 | The RESP parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in print-resp.c:resp_get_length(). |
CVE-2017-12988 | Critical | 9.8 | 2017-09-14 | The telnet parser in tcpdump before 4.9.2 has a buffer over-read in print-telnet.c:telnet_parse(). |
CVE-2017-12987 | Critical | 9.8 | 2017-09-14 | The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_11.c:parse_elements(). |
CVE-2017-12986 | Critical | 9.8 | 2017-09-14 | The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print(). |
CVE-2017-12985 | Critical | 9.8 | 2017-09-14 | The IPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-ip6.c:ip6_print(). |
CVE-2017-12902 | Critical | 9.8 | 2017-09-14 | The Zephyr parser in tcpdump before 4.9.2 has a buffer over-read in print-zephyr.c, several functions. |
CVE-2017-12901 | Critical | 9.8 | 2017-09-14 | The EIGRP parser in tcpdump before 4.9.2 has a buffer over-read in print-eigrp.c:eigrp_print(). |
CVE-2017-12900 | Critical | 9.8 | 2017-09-14 | Several protocol parsers in tcpdump before 4.9.2 could cause a buffer over-read in util-print.c:tok2strbuf(). |
CVE-2017-12899 | Critical | 9.8 | 2017-09-14 | The DECnet parser in tcpdump before 4.9.2 has a buffer over-read in print-decnet.c:decnet_print(). |
CVE-2017-12898 | Critical | 9.8 | 2017-09-14 | The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:interp_reply(). |
CVE-2017-12897 | Critical | 9.8 | 2017-09-14 | The ISO CLNS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isoclns_print(). |
CVE-2017-12896 | Critical | 9.8 | 2017-09-14 | The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:isakmp_rfc3948_print(). |
CVE-2017-12895 | Critical | 9.8 | 2017-09-14 | The ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print(). |
CVE-2017-12894 | Critical | 9.8 | 2017-09-14 | Several protocol parsers in tcpdump before 4.9.2 could cause a buffer over-read in addrtoname.c:lookup_bytestring(). |
CVE-2017-12893 | Critical | 9.8 | 2017-09-14 | The SMB/CIFS parser in tcpdump before 4.9.2 has a buffer over-read in smbutil.c:name_len(). |
CVE-2017-14431 | Medium | 5.5 | 2017-09-13 | Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting, b… |
CVE-2017-12249 | Critical | 9.1 | 2017-09-13 | A vulnerability in the Traversal Using Relay NAT (TURN) server included with Cisco Meeting Server (CMS) could allow an authenticated, remote attacker to gain u… |
CVE-2017-2816 | High | 8.8 | 2017-09-13 | An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bo… |
CVE-2017-1556 | Medium | 6.5 | 2017-09-13 | IBM API Connect 5.0.7.0 through 5.0.7.2 is vulnerable to a regular expression attack that could allow an authenticated attacker to use a regex and cause the sy… |
CVE-2017-1508 | Medium | 6.7 | 2017-09-13 | IBM Informix Dynamic Server 12.1 could allow a local user logged in with database administrator user to gain root privileges. IBM X-Force ID: 129620. |
CVE-2017-7561 | High | 7.5 | 2017-09-13 | Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in… |
CVE-2017-7560 | Medium | 5.5 | 2017-09-13 | It was found that rhnsd PID files are created as world-writable that allows local attackers to fill the disks or to kill selected processes. |
CVE-2017-14430 | High | 7.5 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allow remote attackers to cause a de… |
CVE-2017-14429 | Critical | 9.8 | 2017-09-13 | The DHCP client on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allows unauthenti… |
CVE-2017-14428 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/run/hostapd* permissi… |
CVE-2017-14427 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/run/storage_account_r… |
CVE-2017-14426 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0644 /var/etc/shadow (aka the /… |
CVE-2017-14425 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/etc/hnapasswd permiss… |
CVE-2017-14424 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/passwd permissions. |
CVE-2017-14423 | High | 7.5 | 2017-09-13 | htdocs/parentalcontrols/bind.php on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices does not prevent unauthenticated nonce-guessin… |
CVE-2017-14422 | High | 7.5 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices use the same hardcoded /etc/stunnel… |
CVE-2017-14421 | Critical | 9.8 | 2017-09-13 | D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices have a hardcoded password of wrgac25_dlink.2013gui_dir850l for the Alphanetworks account upon… |
CVE-2017-14420 | Medium | 5.9 | 2017-09-13 | The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devic… |
CVE-2017-14419 | Medium | 5.9 | 2017-09-13 | The D-Link NPAPI extension, as used on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devic… |
CVE-2017-14418 | High | 8.1 | 2017-09-13 | The D-Link NPAPI extension, as used in conjunction with D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices, sends the cleartext admin password o… |
CVE-2017-14417 | Critical | 9.8 | 2017-09-13 | register_send.php on D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices does not require authentication, which can result in unintended enrollme… |
CVE-2017-14416 | Medium | 6.1 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs/web/wandetect.php. |
CVE-2017-14415 | Medium | 6.1 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs/web/sitesurvey.php. |
CVE-2017-14414 | Medium | 6.1 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs/web/shareport.php. |
CVE-2017-14413 | Medium | 6.1 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs/web/wpsacts.php. |
CVE-2017-3165 | Medium | 5.4 | 2017-09-13 | In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of… |
CVE-2017-14124 | Medium | 6.3 | 2017-09-13 | In eLux RP 5.x before 5.5.1000 LTSR and 5.6.x before 5.6.2 CR when classic desktop mode is used, it is possible to start applications other than defined, even… |
CVE-2017-12612 | High | 7.8 | 2017-09-13 | In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmat… |
CVE-2017-11462 | Critical | 9.8 | 2017-09-13 | Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security context… |
CVE-2017-6330 | Medium | 6.5 | 2017-09-13 | Symantec Encryption Desktop before SED 10.4.1MP2 can allow remote attackers to cause a denial of service (resource consumption) via crafted web requests." |
CVE-2017-7441 | High | 7.8 | 2017-09-13 | In Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean), a crafted IOCTL with code 0x22E1C0 might lea… |
CVE-2017-6008 | High | 7.8 | 2017-09-13 | A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos… |
CVE-2017-6007 | Medium | 5.5 | 2017-09-13 | A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos… |
CVE-2017-14398 | High | 7.8 | 2017-09-13 | rzpnk.sys in Razer Synapse 2.20.15.1104 allows local users to read and write to arbitrary memory locations, and consequently gain privileges, via a methodology… |
CVE-2017-13724 | Medium | 5.4 | 2017-09-13 | On the Axesstel MU553S MU55XS-V1.14, there is a Stored Cross Site Scripting vulnerability in the APN parameter under the "Basic Settings" page. |
CVE-2017-11351 | Critical | 9.8 | 2017-09-13 | Axesstel MU553S MU55XS-V1.14 devices have a default password of admin for the admin account. |
CVE-2017-11350 | High | 8.8 | 2017-09-13 | Cross-Site Request Forgery (CSRF) exists in cgi-bin/ConfigSet on Axesstel MU553S MU55XS-V1.14 devices. |
CVE-2017-14412 | High | 7.8 | 2017-09-13 | An invalid memory write was discovered in copy_mp in interface.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes a denial of service (… |
CVE-2017-14411 | High | 7.8 | 2017-09-13 | A stack-based buffer overflow was discovered in copy_mp in interface.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes an out-of-bound… |
CVE-2017-14410 | Medium | 5.5 | 2017-09-13 | A buffer over-read was discovered in III_i_stereo in layer3.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes an application crash, wh… |
CVE-2017-14409 | High | 7.8 | 2017-09-13 | A buffer overflow was discovered in III_dequantize_sample in layer3.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes an out-of-bounds… |
CVE-2017-14408 | Medium | 5.5 | 2017-09-13 | A stack-based buffer over-read was discovered in dct36 in layer3.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes an application cras… |
CVE-2017-14407 | Medium | 5.5 | 2017-09-13 | A stack-based buffer over-read was discovered in filterYule in gain_analysis.c in MP3Gain version 1.5.2. The vulnerability causes an application crash, which l… |
CVE-2017-14406 | Medium | 5.5 | 2017-09-13 | A NULL pointer dereference was discovered in sync_buffer in interface.c in mpglibDBL, as used in MP3Gain version 1.5.2. The vulnerability causes a segmentation… |
CVE-2017-14405 | High | 7.2 | 2017-09-13 | The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote command execution via shell metacharacters in a hosts_cacti array parameter to module/admin_de… |
CVE-2017-14404 | High | 7.5 | 2017-09-13 | The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows local file inclusion via the tool_list parameter (aka the url_tool variable) to module/tool_all/selec… |
CVE-2017-14403 | Critical | 9.8 | 2017-09-13 | The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the term parameter to module/admin_group/search.php. |
CVE-2017-14402 | Critical | 9.8 | 2017-09-13 | The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT CREAT… |
CVE-2017-14401 | Critical | 9.8 | 2017-09-13 | The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT UPDAT… |
CVE-2017-8759 | High | 7.8 | 2017-09-13 | Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application… |
CVE-2017-8758 | Medium | 6.1 | 2017-09-13 | Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web req… |
CVE-2017-8757 | High | 7.5 | 2017-09-13 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the curre… |
CVE-2017-8756 | High | 7.5 | 2017-09-13 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the curre… |
CVE-2017-8755 | High | 7.5 | 2017-09-13 | Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current use… |
CVE-2017-8754 | Medium | 4.2 | 2017-09-13 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page containing malici… |
CVE-2017-8753 | High | 7.5 | 2017-09-13 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the curre… |
CVE-2017-8752 | High | 7.5 | 2017-09-13 | Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current use… |
CVE-2017-8751 | High | 7.5 | 2017-09-13 | Microsoft Edge in Microsoft Windows 1703 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft Edge ac… |
CVE-2017-8750 | High | 7.5 | 2017-09-13 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Intern… |
CVE-2017-8749 | High | 7.5 | 2017-09-13 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold… |
CVE-2017-8748 | High | 7.5 | 2017-09-13 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Intern… |
CVE-2017-8747 | High | 7.5 | 2017-09-13 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 16… |
CVE-2017-8746 | Medium | 5.3 | 2017-09-13 | Windows Device Guard in Windows 10 1607, 1703, and Windows Server 2016 allows A security feature bypass vulnerability due to how PowerShell exposes functions a… |