2017 CVEs (page 85)
Page 85 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-13744 | Medium | 6.5 | 2017-08-29 | There is an illegal address access in the function _lou_getALine() in compileTranslationTable.c:343 in Liblouis 3.2.0. |
CVE-2017-13743 | Medium | 6.5 | 2017-08-29 | There is a buffer overflow in Liblouis 3.2.0, triggered in the function _lou_showString() in utils.c, that will lead to a remote denial of service attack. |
CVE-2017-13742 | Medium | 6.5 | 2017-08-29 | There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function includeFile() in compileTranslationTable.c, that will lead to a remote deni… |
CVE-2017-13741 | Medium | 6.5 | 2017-08-29 | There is a use-after-free in the function compileBrailleIndicator() in compileTranslationTable.c in Liblouis 3.2.0 that will lead to a remote denial of service… |
CVE-2017-13740 | High | 8.8 | 2017-08-29 | There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function parseChars() in compileTranslationTable.c, that will lead to denial of serv… |
CVE-2017-13739 | High | 8.8 | 2017-08-29 | There is a heap-based buffer overflow that causes a more than two thousand bytes out-of-bounds write in Liblouis 3.2.0, triggered in the function resolveSubtab… |
CVE-2017-13738 | High | 8.8 | 2017-08-29 | There is an illegal address access in the _lou_getALine function in compileTranslationTable.c:346 in Liblouis 3.2.0. |
CVE-2017-13737 | Medium | 6.5 | 2017-08-29 | There is an invalid free in the MagickFree function in magick/memory.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack. |
CVE-2017-13736 | Medium | 6.5 | 2017-08-29 | There are lots of memory leaks in the GMCommand function in magick/command.c in GraphicsMagick 1.3.26 that will lead to a remote denial of service attack. |
CVE-2017-13735 | High | 7.5 | 2017-08-29 | There is a floating point exception in the kodak_radc_load_raw function in dcraw_common.cpp in LibRaw 0.18.2. It will lead to a remote denial of service attack. |
CVE-2017-13734 | Medium | 6.5 | 2017-08-29 | There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack. |
CVE-2017-13733 | Medium | 6.5 | 2017-08-29 | There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack. |
CVE-2017-13732 | Medium | 6.5 | 2017-08-29 | There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack. |
CVE-2017-13731 | Medium | 6.5 | 2017-08-29 | There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack. |
CVE-2017-13730 | Medium | 6.5 | 2017-08-29 | There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack. |
CVE-2017-13729 | Medium | 6.5 | 2017-08-29 | There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack. |
CVE-2017-13728 | High | 7.5 | 2017-08-29 | There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service a… |
CVE-2017-13727 | Medium | 6.5 | 2017-08-29 | There is a reachable assertion abort in the function TIFFWriteDirectoryTagSubifd() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted inpu… |
CVE-2017-13726 | Medium | 6.5 | 2017-08-29 | There is a reachable assertion abort in the function TIFFWriteDirectorySec() in LibTIFF 4.0.8, related to tif_dirwrite.c and a SubIFD tag. A crafted input will… |
CVE-2017-13685 | Medium | 5.5 | 2017-08-29 | The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted file. |
CVE-2017-3757 | High | 7.8 | 2017-08-29 | An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand notebooks (not Think… |
CVE-2017-3746 | High | 7.8 | 2017-08-29 | ThinkPad USB 3.0 Ethernet Adapter (part number 4X90E51405) driver, various versions, was found to contain a privilege escalation vulnerability that could allow… |
CVE-2017-2258 | Medium | 4.3 | 2017-08-29 | Directory traversal vulnerability in Cybozu Garoon 4.2.4 to 4.2.5 allows an attacker to read arbitrary files via Garoon SOAP API "WorkflowHandleApplications". |
CVE-2017-2257 | Medium | 6.1 | 2017-08-29 | Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via mail function. |
CVE-2017-2256 | Medium | 5.4 | 2017-08-29 | Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" function of the ap… |
CVE-2017-2255 | Medium | 5.4 | 2017-08-29 | Cross-site scripting vulnerability in Cybozu Garoon 3.7.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" function of the ap… |
CVE-2017-2254 | Medium | 4.9 | 2017-08-29 | Cybozu Garoon 3.5.0 to 4.2.5 allows an attacker to cause a denial of service in the application menu's edit function via specially crafted input |
CVE-2017-2242 | High | 7.8 | 2017-08-29 | Untrusted search path vulnerability in Flets Setsuzoku Tool for Windows all versions allows an attacker to gain privileges via a Trojan horse DLL in an unspeci… |
CVE-2017-1489 | Medium | 6.1 | 2017-08-29 | IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability. ECSSO Master Authentication can redi… |
CVE-2017-1376 | Critical | 9.8 | 2017-08-29 | A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873. |
CVE-2017-13715 | Critical | 9.8 | 2017-08-29 | The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto, ip_proto, and thoff are initialized… |
CVE-2017-1110 | Medium | 6.5 | 2017-08-29 | IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 contains an unspecified vulnerability that could allow an authenticated user to view the incidents o… |
CVE-2017-10844 | High | 8.8 | 2017-08-29 | baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors. |
CVE-2017-10843 | High | 7.5 | 2017-08-29 | baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified vectors when the "File" field is being… |
CVE-2017-10842 | Critical | 9.8 | 2017-08-29 | SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vec… |
CVE-2017-10841 | Medium | 4.9 | 2017-08-29 | Directory traversal vulnerability in WebCalendar 1.2.7 and earlier allows authenticated attackers to read arbitrary files via unspecified vectors. |
CVE-2017-10840 | Medium | 6.1 | 2017-08-29 | Cross-site scripting vulnerability in WebCalendar 1.2.7 and earlier allows an attacker to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2017-10839 | High | 8.8 | 2017-08-29 | SQL injection vulnerability in the SEO Panel prior to version 3.11.0 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors. |
CVE-2017-10838 | Medium | 6.1 | 2017-08-29 | Cross-site scripting vulnerability in SEO Panel prior to version 3.11.0 allows an attacker to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2017-10837 | Medium | 6.1 | 2017-08-29 | Cross-site scripting vulnerability in BackupGuard prior to version 1.1.47 allows an attacker to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2017-10836 | High | 7.8 | 2017-08-29 | Untrusted search path vulnerability in Optimal Guard 1.1.21 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified director… |
CVE-2017-10835 | High | 8.8 | 2017-08-29 | "Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows authenticated attackers to conduct code injection attacks via unspecified vectors. |
CVE-2017-10834 | Medium | 6.5 | 2017-08-29 | Directory traversal vulnerability in "Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows authenticated attackers to read arbitrary files via… |
CVE-2017-10833 | Critical | 9.1 | 2017-08-29 | "Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to bypass access restriction to view information or modify configuratio… |
CVE-2017-10832 | Critical | 9.8 | 2017-08-29 | "Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2017-10831 | High | 7.8 | 2017-08-29 | Untrusted search path vulnerability in The electronic authentication system based on the commercial registration system "The CRCA user's Software" Ver1.8 and e… |
CVE-2017-10830 | High | 7.8 | 2017-08-29 | Untrusted search path vulnerability in Security Setup Tool all versions allows an attacker to gain privileges via a Trojan horse DLL in an unspecified director… |
CVE-2017-10828 | High | 7.8 | 2017-08-29 | Untrusted search path vulnerability in Flets Install Tool all versions distributed through the website till 2017 August 8 allows an attacker to gain privileges… |
CVE-2017-10827 | High | 7.8 | 2017-08-29 | Untrusted search path vulnerability in Flets Azukeru for Windows Auto Backup Tool v1.0.3.0 and earlier allows an attacker to gain privileges via a Trojan horse… |
CVE-2017-10826 | High | 7.8 | 2017-08-29 | Untrusted search path vulnerability in Security Kinou Mihariban v1.0.21 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecif… |
CVE-2017-10812 | High | 7.8 | 2017-08-29 | Untrusted search path vulnerability in Photo Collection PC Software Ver.4.0.2 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an un… |
CVE-2017-13716 | Medium | 5.5 | 2017-08-28 | The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excess… |
CVE-2017-9979 | Medium | 6.1 | 2017-08-28 | On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method… |
CVE-2017-9978 | Medium | 5.3 | 2017-08-28 | On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, a flaw was found with the error message sent as a response for users that don't exist on the syste… |
CVE-2017-6594 | High | 7.5 | 2017-08-28 | The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging failure to add the… |
CVE-2017-3735 | Medium | 5.3 | 2017-08-28 | While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of… |
CVE-2017-13712 | High | 7.5 | 2017-08-28 | NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to perform Denial of Service by triggerin… |
CVE-2017-12954 | Medium | 6.5 | 2017-08-28 | The gig::Region::GetSampleFromWavePool function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid memory read and applic… |
CVE-2017-12953 | Medium | 6.5 | 2017-08-28 | The gig::Instrument::UpdateRegionKeyTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (invalid memory write and ap… |
CVE-2017-12952 | Medium | 6.5 | 2017-08-28 | The LoadString function in helper.h in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a… |
CVE-2017-12951 | Medium | 6.5 | 2017-08-28 | The gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (stack-based buffer over… |
CVE-2017-12950 | Medium | 6.5 | 2017-08-28 | The gig::Region::Region function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application cras… |
CVE-2017-12925 | Medium | 6.5 | 2017-08-28 | Double free vulnerability in DfFromLB in docfile.cxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service via a crafted fpx image. |
CVE-2017-12924 | Medium | 6.5 | 2017-08-28 | CDirVector::GetTable in dirfunc.hxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted fpx image. |
CVE-2017-12923 | Medium | 6.5 | 2017-08-28 | OLEStream::WriteVT_LPSTR in olestrm.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx im… |
CVE-2017-12922 | Medium | 6.5 | 2017-08-28 | wchar.c in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image. |
CVE-2017-12921 | Medium | 6.5 | 2017-08-28 | PFileFlashPixView::GetGlobalInfoProperty in f_fpxvw.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via… |
CVE-2017-12920 | Medium | 6.5 | 2017-08-28 | CDirectory::GetDirEntry in dir.cxx in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted fpx image. |
CVE-2017-12919 | Medium | 6.5 | 2017-08-28 | Heap-based buffer overflow in OLEStream::WriteVT_LPSTR in olestrm.cpp in libfpx 1.3.1_p6 allows remote attackers to cause a denial of service via a crafted fpx… |
CVE-2017-12877 | Medium | 6.5 | 2017-08-28 | Use-after-free vulnerability in the DestroyImage function in image.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a c… |
CVE-2017-12876 | Medium | 6.5 | 2017-08-28 | Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file. |
CVE-2017-12840 | High | 7.8 | 2017-08-28 | A kernel driver, namely DLMFENC.sys, bundled with the DESLock+ client application 4.8.16 and earlier contains a locally exploitable heap based buffer overflow… |
CVE-2017-12077 | Medium | 4.9 | 2017-08-28 | Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology Router Manager (SRM) before 1.1.4-6509 allows remote authenticate… |
CVE-2017-12076 | Medium | 4.9 | 2017-08-28 | Uncontrolled Resource Consumption vulnerability in SYNO.Core.PortForwarding.Rules in Synology DiskStation (DSM) before 6.1.1-15088 allows remote authenticated… |
CVE-2017-8380 | Critical | 9.8 | 2017-08-28 | Buffer overflow in the "megasas_mmio_write" function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors. |
CVE-2017-13710 | High | 7.5 | 2017-08-27 | The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cau… |
CVE-2017-13709 | High | 7.5 | 2017-08-27 | In FlightGear before version 2017.3.1, Main/logger.cxx in the FGLogger subsystem allows one to overwrite any file via a resource that affects the contents of t… |
CVE-2017-13707 | Critical | 9.8 | 2017-08-27 | Privilege escalation in Replibit Backup Manager earlier than version 2017.08.04 allows attackers to gain root privileges via sudo command execution. The vi pro… |
CVE-2017-12595 | High | 7.8 | 2017-08-27 | The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service (stack consumption… |
CVE-2017-7693 | Medium | 6.5 | 2017-08-26 | Directory traversal vulnerability in viewer_script.jsp in Riverbed OPNET App Response Xpert (ARX) version 9.6.1 allows remote authenticated users to inject arb… |
CVE-2017-12817 | High | 7.5 | 2017-08-25 | In Kaspersky Internet Security for Android 11.12.4.1622, some of the application trace files were not encrypted. |
CVE-2017-12816 | Critical | 9.8 | 2017-08-25 | In Kaspersky Internet Security for Android 11.12.4.1622, some of application exports activities have weak permissions, which might be used by a malware applica… |
CVE-2017-9650 | High | 7.8 | 2017-08-25 | An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC… |
CVE-2017-9644 | High | 7.0 | 2017-08-25 | An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteSc… |
CVE-2017-9640 | Medium | 6.3 | 2017-08-25 | A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5; ALC WebCTRL, SiteScan Web 6.1 and prio… |
CVE-2017-7934 | Medium | 5.9 | 2017-08-25 | An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017. PI Network Manager using older protocol versi… |
CVE-2017-7930 | High | 7.4 | 2017-08-25 | An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017. PI Data Archive has protocol flaws with the p… |
CVE-2017-7926 | High | 8.8 | 2017-08-25 | A Cross-Site Request Forgery issue was discovered in OSIsoft PI Web API versions prior to 2017 (1.9.0). The vulnerability allows cross-site request forgery (CS… |
CVE-2017-12857 | High | 8.8 | 2017-08-25 | Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vul… |
CVE-2017-12707 | Critical | 9.8 | 2017-08-25 | A Stack-based Buffer Overflow issue was discovered in SpiderControl SCADA MicroBrowser Versions 1.6.30.144 and prior. Opening a maliciously crafted html file m… |
CVE-2017-12694 | High | 7.5 | 2017-08-25 | A Directory Traversal issue was discovered in SpiderControl SCADA Web Server. An attacker may be able to use a simple GET request to perform a directory traver… |
CVE-2017-13697 | Medium | 6.1 | 2017-08-25 | controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable. |
CVE-2017-12709 | Medium | 5.3 | 2017-08-25 | A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The… |
CVE-2017-12703 | High | 8.8 | 2017-08-25 | A Cross-Site Request Forgery (CSRF) issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than… |
CVE-2017-13695 | Medium | 5.5 | 2017-08-25 | The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack d… |
CVE-2017-13694 | Medium | 5.5 | 2017-08-25 | The acpi_ps_complete_final_op() function in drivers/acpi/acpica/psobject.c in the Linux kernel through 4.12.9 does not flush the node and node_ext caches and c… |
CVE-2017-13693 | Medium | 5.5 | 2017-08-25 | The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel… |
CVE-2017-13692 | High | 7.5 | 2017-08-25 | In Tidy 5.5.31, the IsURLCodePoint function in attrs.c allows attackers to cause a denial of service (Segmentation Fault), as demonstrated by an invalid ISALNU… |
CVE-2017-13686 | High | 7.8 | 2017-08-24 | net/ipv4/route.c in the Linux kernel 4.13-rc1 through 4.13-rc6 is too late to check for a NULL fi field when RTM_F_FIB_MATCH is set, which allows local users t… |
CVE-2017-9555 | Medium | 5.4 | 2017-08-24 | Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web… |