2017 CVEs (page 8)
Page 8 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-18648 | Critical | 9.1 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4.x), L(5.x), M(6.x), and N(7.x) software. Arbitrary file read/write operations can occur in the lo… |
CVE-2017-18647 | High | 8.1 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6,x) and N(7.0) software. The TA Scrypto v1.0 implementation in Secure Driver has a race condition wit… |
CVE-2017-18696 | Critical | 9.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (Exynos7420, Exynos8890, or MSM8996 chipsets) software. RKP allows memory corruption… |
CVE-2017-18695 | Medium | 6.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software. Attackers (who control a certain subdomain) can discov… |
CVE-2017-18694 | Medium | 5.3 | 2020-04-07 | An issue was discovered on Samsung mobile devices with software through 2016-10-25 (Exynos5 chipsets). Attackers can read kernel addresses in the log because a… |
CVE-2017-18693 | Critical | 9.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software. There is a buffer overflow in the fps sysfs entry. The… |
CVE-2017-18692 | High | 8.1 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (MSM8939, MSM8996, MSM8998, Exynos7580, Exynos8890, or Exynos8895 chipsets) software… |
CVE-2017-12842 | High | 7.5 | 2020-03-16 | Bitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even if that payment did… |
CVE-2017-18350 | Medium | 5.9 | 2020-03-12 | bitcoind and Bitcoin-Qt prior to 0.15.1 have a stack-based buffer overflow if an attacker-controlled SOCKS proxy server is used. This results from an integer s… |
CVE-2017-10992 | Critical | 9.8 | 2020-03-10 | In HPE Storage Essentials 9.5.0.142, there is Unauthenticated Java Deserialization with remote code execution via OS commands in a request to invoker/JMXInvoke… |
CVE-2017-12580 | High | 7.8 | 2020-03-02 | An issue was discovered in IDM UltraEdit through 24.10.0.32. To exploit the vulnerability, on unpatched Windows systems, an attacker could include in the same… |
CVE-2017-16900 | Medium | 5.5 | 2020-02-27 | Incorrect Access Control in Hunesion i-oneNet 3.0.6042.1200 allows the local user to access other user's information which is unauthorized via brute force. |
CVE-2017-6371 | High | 7.5 | 2020-02-27 | Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string in the HTTP Referer header. |
CVE-2017-6363 | High | 8.1 | 2020-02-27 | In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion t… |
CVE-2017-18642 | Medium | 6.5 | 2020-02-10 | Syska Smart Bulb devices through 2017-08-06 receive RGB parameters over cleartext Bluetooth Low Energy (BLE), leading to sniffing, reverse engineering, and rep… |
CVE-2017-18641 | High | 8.1 | 2020-02-10 | In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap containers. |
CVE-2017-14807 | High | 8.1 | 2020-01-27 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in susestudio-ui-server of SUSE Studio onsite allows remo… |
CVE-2017-14806 | Low | 3.7 | 2020-01-27 | A Improper Certificate Validation vulnerability in susestudio-common of SUSE Studio onsite allows remote attackers to MITM connections to the repositories, whi… |
CVE-2017-3211 | Medium | 5.3 | 2020-01-15 | Yopify, an e-commerce notification plugin, up to April 06, 2017, leaks the first name, last initial, city, and recent purchase data of customers, all without u… |
CVE-2017-16778 | Medium | 4.6 | 2019-12-24 | An access control weakness in the DTMF tone receiver of Fermax Outdoor Panel allows physical attackers to inject a Dual-Tone-Multi-Frequency (DTMF) tone to inv… |
CVE-2017-18107 | Medium | 6.5 | 2019-12-17 | Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups… |
CVE-2017-18640 | High | 7.5 | 2019-12-12 | The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564. |
CVE-2017-12945 | High | 8.8 | 2019-11-27 | Insufficient validation of user-supplied input for the Solstice Pod before 2.8.4 networking configuration enables authenticated attackers to execute arbitrary… |
CVE-2017-7399 | High | 8.8 | 2019-11-26 | Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other u… |
CVE-2017-17224 | High | 8.8 | 2019-11-12 | Some Huawei smart phones with versions earlier than Harry-AL00C 9.1.0.206(C00E205R3P1) have a null pointer dereference vulnerability. An attacker crafts specif… |
CVE-2017-18639 | Medium | 6.1 | 2019-11-06 | Progress Sitefinity CMS before 10.1 allows XSS via /Pages Parameter : Page Title, /Content/News Parameter : News Title, /Content/List Parameter : List Title, /… |
CVE-2017-5333 | High | 7.8 | 2019-11-04 | Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of s… |
CVE-2017-5332 | High | 7.8 | 2019-11-04 | The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denia… |
CVE-2017-5331 | High | 7.8 | 2019-11-04 | Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash… |
CVE-2017-15725 | High | 7.5 | 2019-10-28 | An XML External Entity Injection vulnerability exists in Dzone AnswerHub. |
CVE-2017-5731 | High | 7.8 | 2019-10-28 | Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege via local access. |
CVE-2017-14742 | Critical | 9.8 | 2019-10-25 | Buffer overflow in LabF nfsAxe FTP client 3.7 allows an attacker to execute code remotely. |
CVE-2017-8087 | Low | 2.4 | 2019-10-22 | Information Leakage in PPPoE Packet Padding in AVM Fritz!Box 7490 with Firmware versions Fritz!OS 6.80 and 6.83 allows physically proximate attackers to view s… |
CVE-2017-1002201 | Medium | 6.1 | 2019-10-15 | In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this… |
CVE-2017-14948 | Critical | 9.8 | 2019-10-14 | Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code (remote)… |
CVE-2017-18638 | High | 7.5 | 2019-10-11 | send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an at… |
CVE-2017-18636 | High | 7.5 | 2019-09-30 | CDG through 2017-01-01 allows downloadDocument.jsp?command=download&pathAndName= directory traversal. |
CVE-2017-18635 | Medium | 6.1 | 2019-09-25 | An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages p… |
CVE-2017-18634 | Critical | 9.8 | 2019-09-16 | The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php. |
CVE-2017-18615 | Medium | 6.1 | 2019-09-13 | The kama-clic-counter plugin before 3.5.0 for WordPress has XSS. |
CVE-2017-18614 | High | 8.1 | 2019-09-13 | The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter. |
CVE-2017-18613 | Medium | 6.1 | 2019-09-13 | The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter. |
CVE-2017-18612 | Medium | 6.1 | 2019-09-13 | The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter. |
CVE-2017-18611 | Medium | 6.1 | 2019-09-10 | The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter. |
CVE-2017-18610 | Medium | 6.1 | 2019-09-10 | The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter. |
CVE-2017-18609 | Medium | 6.1 | 2019-09-10 | The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter. |
CVE-2017-18608 | Medium | 6.1 | 2019-09-10 | The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues. |
CVE-2017-18607 | High | 8.8 | 2019-09-10 | The avada theme before 5.1.5 for WordPress has CSRF. |
CVE-2017-18606 | Medium | 6.1 | 2019-09-10 | The avada theme before 5.1.5 for WordPress has stored XSS. |
CVE-2017-18605 | Critical | 9.8 | 2019-09-10 | The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection. |
CVE-2017-18604 | High | 7.5 | 2019-09-10 | The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request. |
CVE-2017-18603 | Medium | 6.1 | 2019-09-10 | The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter. |
CVE-2017-18602 | High | 8.8 | 2019-09-10 | The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter. |
CVE-2017-18601 | Medium | 5.4 | 2019-09-10 | The examapp plugin 1.0 for WordPress has XSS via exam input text fields. |
CVE-2017-18600 | Medium | 5.4 | 2019-09-10 | The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field. |
CVE-2017-18599 | Medium | 6.1 | 2019-09-10 | The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter. |
CVE-2017-18598 | Medium | 6.1 | 2019-09-10 | The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php. |
CVE-2017-18597 | High | 8.8 | 2019-09-10 | The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId parameter. |
CVE-2017-18596 | High | 8.8 | 2019-09-10 | The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions. |
CVE-2017-18595 | High | 7.8 | 2019-09-04 | An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c. |
CVE-2017-14202 | High | 7.8 | 2019-08-29 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user… |
CVE-2017-14201 | High | 7.8 | 2019-08-29 | Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution. This… |
CVE-2017-18594 | High | 7.5 | 2019-08-29 | nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \n char… |
CVE-2017-18593 | Medium | 6.1 | 2019-08-28 | The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file. |
CVE-2017-18592 | High | 7.5 | 2019-08-27 | The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads. |
CVE-2017-18591 | Medium | 6.1 | 2019-08-27 | The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php. |
CVE-2017-18590 | Medium | 6.1 | 2019-08-27 | The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues. |
CVE-2017-18589 | High | 7.5 | 2019-08-26 | An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic. |
CVE-2017-18588 | Medium | 5.3 | 2019-08-26 | An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses cus… |
CVE-2017-18587 | Medium | 5.3 | 2019-08-26 | An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers. |
CVE-2017-18585 | High | 8.1 | 2019-08-22 | The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal. |
CVE-2017-18579 | Medium | 6.1 | 2019-08-22 | The corner-ad plugin before 1.0.8 for WordPress has XSS. |
CVE-2017-18578 | Medium | 6.1 | 2019-08-22 | The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS. |
CVE-2017-18586 | Critical | 9.1 | 2019-08-22 | The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths. |
CVE-2017-18584 | High | 7.5 | 2019-08-22 | The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action. |
CVE-2017-18583 | Critical | 9.8 | 2019-08-22 | The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection. |
CVE-2017-18582 | Medium | 6.1 | 2019-08-22 | The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues. |
CVE-2017-18581 | Medium | 6.1 | 2019-08-22 | The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list. |
CVE-2017-18580 | Critical | 9.8 | 2019-08-22 | The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode. |
CVE-2017-18577 | Medium | 6.1 | 2019-08-22 | The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg. |
CVE-2017-18576 | Medium | 6.1 | 2019-08-22 | The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation. |
CVE-2017-18575 | Medium | 6.1 | 2019-08-22 | The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues. |
CVE-2017-18574 | Medium | 6.1 | 2019-08-22 | The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder. |
CVE-2017-18573 | Critical | 9.8 | 2019-08-22 | The simple-login-log plugin before 1.1.2 for WordPress has SQL injection. |
CVE-2017-18572 | Medium | 6.1 | 2019-08-22 | The gnucommerce plugin before 1.4.2 for WordPress has XSS. |
CVE-2017-18571 | Critical | 9.8 | 2019-08-22 | The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316. |
CVE-2017-18570 | Critical | 9.8 | 2019-08-22 | The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries. |
CVE-2017-18562 | Medium | 6.1 | 2019-08-21 | The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues. |
CVE-2017-18561 | Medium | 6.1 | 2019-08-21 | The embed-comment-images plugin before 0.6 for WordPress has XSS. |
CVE-2017-18559 | Medium | 6.1 | 2019-08-21 | The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues. |
CVE-2017-18535 | Medium | 6.1 | 2019-08-21 | The smokesignal plugin before 1.2.7 for WordPress has XSS. |
CVE-2017-18525 | Medium | 6.1 | 2019-08-21 | The megamenu plugin before 2.4 for WordPress has XSS. |
CVE-2017-18521 | High | 8.8 | 2019-08-21 | The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n. |
CVE-2017-18516 | Medium | 6.1 | 2019-08-21 | The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues. |
CVE-2017-18564 | Medium | 6.1 | 2019-08-21 | The sender plugin before 1.2.1 for WordPress has multiple XSS issues. |
CVE-2017-18563 | Medium | 6.1 | 2019-08-21 | The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen. |
CVE-2017-18565 | Medium | 6.1 | 2019-08-21 | The updater plugin before 1.35 for WordPress has multiple XSS issues. |
CVE-2017-18560 | Medium | 6.1 | 2019-08-21 | The content-audit plugin before 1.9.2 for WordPress has XSS. |
CVE-2017-18558 | Medium | 6.1 | 2019-08-21 | The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues. |
CVE-2017-18557 | Medium | 6.1 | 2019-08-21 | The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues. |