2017 CVEs (page 81)
Page 81 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-14325 | Medium | 6.5 | 2017-09-12 | In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function PersistPixelCache in magick/cache.c, which allows attackers to cause a denial… |
CVE-2017-14324 | Medium | 6.5 | 2017-09-12 | In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of ser… |
CVE-2017-14266 | High | 7.8 | 2017-09-12 | tcprewrite in Tcpreplay 3.4.4 has a Heap-Based Buffer Overflow vulnerability triggered by a crafted PCAP file, a related issue to CVE-2016-6160. |
CVE-2017-7735 | Medium | 5.4 | 2017-09-12 | A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.2.0 through 5.2.11 and 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or… |
CVE-2017-7734 | Medium | 5.4 | 2017-09-12 | A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via 'Comments'… |
CVE-2017-3133 | Medium | 6.1 | 2017-09-12 | A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replaceme… |
CVE-2017-3132 | Medium | 6.1 | 2017-09-12 | A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action in… |
CVE-2017-3131 | Medium | 5.4 | 2017-09-12 | A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via t… |
CVE-2017-14314 | Medium | 6.5 | 2017-09-12 | Off-by-one error in the DrawImage function in magick/render.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (DrawDashPolygon he… |
CVE-2017-14313 | Medium | 6.1 | 2017-09-12 | The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of… |
CVE-2017-14312 | High | 7.8 | 2017-09-11 | Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account (and… |
CVE-2017-1000249 | Medium | 5.5 | 2017-09-11 | An issue in file() was introduced in commit 9611f31313a93aa036389c5f3b15eea53510d4d1 (Oct 2016) lets an attacker overwrite a fixed 20 bytes stack buffer with a… |
CVE-2017-14310 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a "Read Access… |
CVE-2017-14309 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a "Read Access… |
CVE-2017-14308 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a "Read Access… |
CVE-2017-14307 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to "Data from Faul… |
CVE-2017-14306 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a "Read Access… |
CVE-2017-14305 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to "Data from Faul… |
CVE-2017-14304 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a "Read Access… |
CVE-2017-14303 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a "Read Access… |
CVE-2017-14302 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to "Data from Faul… |
CVE-2017-14301 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from Faulting Address con… |
CVE-2017-14300 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from Faulting Address con… |
CVE-2017-14299 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from Faulting Address con… |
CVE-2017-14298 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from Faulting Address con… |
CVE-2017-14297 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from Faulting Address con… |
CVE-2017-14296 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from Faulting Address con… |
CVE-2017-14295 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from Faulting Address con… |
CVE-2017-14294 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mode Write AV starting… |
CVE-2017-14293 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Heap Corruption starting at wo… |
CVE-2017-14292 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mode Write AV starting… |
CVE-2017-14291 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mode Write AV starting… |
CVE-2017-14290 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Heap Corruption starting at wo… |
CVE-2017-14289 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mode Write AV starting… |
CVE-2017-14288 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mode Write AV starting… |
CVE-2017-14287 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "Read Access Violation on Con… |
CVE-2017-14286 | High | 7.8 | 2017-09-11 | STDU Viewer 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mode Write AV starting… |
CVE-2017-14285 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, relate… |
CVE-2017-14284 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, relate… |
CVE-2017-14283 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, relate… |
CVE-2017-14282 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, relate… |
CVE-2017-14281 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, relate… |
CVE-2017-14280 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, relate… |
CVE-2017-14279 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, relate… |
CVE-2017-14278 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, relate… |
CVE-2017-14277 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, relate… |
CVE-2017-14276 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, relate… |
CVE-2017-14275 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mod… |
CVE-2017-14274 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to "Data from… |
CVE-2017-14273 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mod… |
CVE-2017-14272 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mod… |
CVE-2017-14271 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mod… |
CVE-2017-14270 | High | 7.8 | 2017-09-11 | XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file, related to a "User Mod… |
CVE-2017-14153 | High | 7.8 | 2017-09-11 | This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. An attacker must first obtain the ability to execute lo… |
CVE-2017-14075 | High | 7.8 | 2017-09-11 | This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. An attacker must first obtain the ability to execute lo… |
CVE-2017-7650 | Medium | 6.5 | 2017-09-11 | In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely conn… |
CVE-2017-7649 | Critical | 9.8 | 2017-09-11 | The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. S… |
CVE-2017-14269 | Critical | 9.8 | 2017-09-11 | EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices allow remote attackers to obtain sensitive information via a JSONP endpoint, as demonstrated by passwords an… |
CVE-2017-14268 | Medium | 6.1 | 2017-09-11 | EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices have XSS in the sms_content parameter in a getSMSlist request. |
CVE-2017-14267 | High | 8.8 | 2017-09-11 | EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices have CSRF, related to goform/AddNewProfile, goform/setWanDisconnect, goform/setSMSAutoRedirectSetting, gofor… |
CVE-2017-14265 | Critical | 9.8 | 2017-09-11 | A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3. It could allow a remote denial of serv… |
CVE-2017-14263 | High | 8.1 | 2017-09-11 | Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and th… |
CVE-2017-14262 | High | 8.1 | 2017-09-11 | On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login… |
CVE-2017-14261 | High | 7.8 | 2017-09-11 | In the SDK in Bento4 1.5.0-616, the AP4_StszAtom class in Ap4StszAtom.cpp file contains a Read Memory Access Violation vulnerability. It is possible to exploit… |
CVE-2017-14260 | High | 7.8 | 2017-09-11 | In the SDK in Bento4 1.5.0-616, the AP4_StssAtom class in Ap4StssAtom.cpp contains a Write Memory Access Violation vulnerability. It is possible to exploit thi… |
CVE-2017-14259 | High | 7.8 | 2017-09-11 | In the SDK in Bento4 1.5.0-616, the AP4_StscAtom class in Ap4StscAtom.cpp contains a Write Memory Access Violation vulnerability. It is possible to exploit thi… |
CVE-2017-14258 | High | 7.8 | 2017-09-11 | In the SDK in Bento4 1.5.0-616, SetItemCount in Core/Ap4StscAtom.h file contains a Write Memory Access Violation vulnerability. It is possible to exploit this… |
CVE-2017-14257 | High | 7.8 | 2017-09-11 | In the SDK in Bento4 1.5.0-616, AP4_AtomSampleTable::GetSample in Core/Ap4AtomSampleTable.cpp contains a Read Memory Access Violation vulnerability. It is poss… |
CVE-2017-14252 | Critical | 9.8 | 2017-09-11 | SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the group_id cookie to side.php. |
CVE-2017-14251 | High | 8.8 | 2017-09-11 | Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8… |
CVE-2017-14249 | Medium | 6.5 | 2017-09-11 | ImageMagick 7.0.6-8 Q16 mishandles EOF checks in ReadMPCImage in coders/mpc.c, leading to division by zero in GetPixelCacheTileSize in MagickCore/cache.c, allo… |
CVE-2017-14248 | Medium | 6.5 | 2017-09-11 | A heap-based buffer over-read in SampleImage() in MagickCore/resize.c in ImageMagick 7.0.6-8 Q16 allows remote attackers to cause a denial of service via a cra… |
CVE-2017-14247 | Critical | 9.8 | 2017-09-11 | SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the user_id cookie to header.php, a related issue to CVE-2017-1000060. |
CVE-2017-14242 | Critical | 9.8 | 2017-09-11 | SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter. |
CVE-2017-14241 | Medium | 5.4 | 2017-09-11 | Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the Title param… |
CVE-2017-14240 | High | 7.5 | 2017-09-11 | There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter. |
CVE-2017-14239 | Medium | 5.4 | 2017-09-11 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (… |
CVE-2017-14238 | Critical | 9.8 | 2017-09-11 | SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId… |
CVE-2017-14231 | Medium | 5.3 | 2017-09-10 | GeniXCMS before 1.1.0 allows remote attackers to cause a denial of service (account blockage) by leveraging the mishandling of certain username substring relat… |
CVE-2017-14230 | Critical | 9.1 | 2017-09-10 | In the mboxlist_do_find function in imap/mboxlist.c in Cyrus IMAP before 3.0.4, an off-by-one error in prefix calculation for the LIST command caused use of un… |
CVE-2017-14229 | High | 7.5 | 2017-09-09 | There is an infinite loop in the jpc_dec_tileinit function in jpc/jpc_dec.c of Jasper 2.0.13. It will lead to a remote denial of service attack. |
CVE-2017-14228 | Medium | 5.5 | 2017-09-09 | In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function paste_tokens() in preproc.c, aka a NULL pointer dereference. It will le… |
CVE-2017-14227 | High | 7.5 | 2017-09-09 | In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to… |
CVE-2017-14226 | High | 7.5 | 2017-09-09 | WP1StylesListener.cpp, WP5StylesListener.cpp, and WP42StylesListener.cpp in libwpd 0.10.1 mishandle iterators, which allows remote attackers to cause a denial… |
CVE-2017-14225 | High | 8.8 | 2017-09-09 | The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do… |
CVE-2017-8041 | Medium | 6.1 | 2017-09-09 | In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, a user can execute a XSS attack on certain S… |
CVE-2017-8040 | Medium | 6.5 | 2017-09-09 | In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was disc… |
CVE-2017-5147 | Medium | 5.3 | 2017-09-09 | An Uncontrolled Search Path Element issue was discovered in AzeoTech DAQFactory versions prior to 17.1. An uncontrolled search path element vulnerability has b… |
CVE-2017-14224 | High | 8.8 | 2017-09-09 | A heap-based buffer overflow in WritePCXImage in coders/pcx.c in ImageMagick 7.0.6-8 Q16 allows remote attackers to cause a denial of service or code execution… |
CVE-2017-14223 | Medium | 6.5 | 2017-09-09 | In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a… |
CVE-2017-14222 | Medium | 6.5 | 2017-09-09 | In libavformat/mov.c in FFmpeg 3.3.3, a DoS in read_tfra() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafte… |
CVE-2017-12733 | Critical | 9.8 | 2017-09-09 | A Missing Authentication for Critical Function issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and Site… |
CVE-2017-12731 | Critical | 9.8 | 2017-09-09 | A SQL Injection issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSite ATG consoles wit… |
CVE-2017-12699 | High | 7.1 | 2017-09-09 | An Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Local, non-administrative users may be able to replace or… |
CVE-2017-0804 | High | 7.8 | 2017-09-08 | A elevation of privilege vulnerability in the MediaTek mmc driver. Product: Android. Versions: Android kernel. Android ID: A-36274676. References: M-ALPS033614… |
CVE-2017-0803 | High | 7.8 | 2017-09-08 | A elevation of privilege vulnerability in the MediaTek accessory detector driver. Product: Android. Versions: Android kernel. Android ID: A-36136137. Reference… |
CVE-2017-0802 | High | 7.8 | 2017-09-08 | A elevation of privilege vulnerability in the MediaTek kernel. Product: Android. Versions: Android kernel. Android ID: A-36232120. References: M-ALPS03384818. |
CVE-2017-0801 | High | 7.8 | 2017-09-08 | A elevation of privilege vulnerability in the MediaTek libmtkomxvdec. Product: Android. Versions: Android kernel. Android ID: A-38447970. References: M-ALPS033… |
CVE-2017-0800 | High | 7.8 | 2017-09-08 | A elevation of privilege vulnerability in the MediaTek teei. Product: Android. Versions: Android kernel. Android ID: A-37683975. References: M-ALPS03302988. |
CVE-2017-0799 | High | 7.8 | 2017-09-08 | A elevation of privilege vulnerability in the MediaTek lastbus. Product: Android. Versions: Android kernel. Android ID: A-36731602. References: M-ALPS03342072. |