2017 CVEs (page 87)
Page 87 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12960 | High | 7.5 | 2017-08-18 | There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to r… |
CVE-2017-12959 | High | 7.5 | 2017-08-18 | There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to a… |
CVE-2017-12958 | High | 7.5 | 2017-08-18 | There is an illegal address access in the function output_hex() in data/data-out.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote den… |
CVE-2017-12957 | Medium | 6.5 | 2017-08-18 | There is a heap-based buffer over-read in libexiv2 in Exiv2 0.26 that is triggered in the Exiv2::Image::io function in image.cpp. It will lead to remote denial… |
CVE-2017-12956 | Medium | 6.5 | 2017-08-18 | There is an illegal address access in Exiv2::FileIo::path[abi:cxx11]() in basicio.cpp of libexiv2 in Exiv2 0.26 that will lead to remote denial of service. |
CVE-2017-12955 | High | 8.8 | 2017-08-18 | There is a heap-based buffer overflow in basicio.cpp of Exiv2 0.26. The vulnerability causes an out-of-bounds write in Exiv2::Image::printIFDStructure(), which… |
CVE-2017-8446 | Medium | 5.3 | 2017-08-18 | The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability… |
CVE-2017-8445 | Medium | 5.5 | 2017-08-18 | An error was found in the X-Pack Security TLS trust manager for versions 5.0.0 to 5.5.1. If reloading the trust material fails the trust manager will be replac… |
CVE-2017-9685 | High | 8.1 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition in a WLAN driver can lead to a Use After Free condition. |
CVE-2017-9684 | High | 7.0 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition in a USB driver can lead to a Use After Free condition. |
CVE-2017-9682 | Medium | 4.7 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition in two KGSL driver functions can lead to a Use After Free cond… |
CVE-2017-9680 | High | 7.5 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, if a pointer argument coming from userspace is invalid, a driver may use an uni… |
CVE-2017-9679 | High | 7.5 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, if a userspace string is not NULL-terminated, kernel memory contents can leak t… |
CVE-2017-9678 | High | 7.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, in a video driver, memory corruption can potentially occur due to lack of bound… |
CVE-2017-7364 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, in function __mdss_fb_copy_destscaler_data(), variable ds_data[i].scale may sti… |
CVE-2017-3756 | High | 7.8 | 2017-08-18 | A privilege escalation vulnerability was identified in Lenovo Active Protection System for ThinkPad systems versions earlier than 1.82.0.17. An attacker with l… |
CVE-2017-11160 | High | 7.8 | 2017-08-18 | Multiple untrusted search path vulnerabilities in installer in Synology Assistant before 6.1-15163 on Windows allows local attackers to execute arbitrary code… |
CVE-2017-8272 | High | 7.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, in a driver function, a value from userspace is not properly validated potentia… |
CVE-2017-8270 | High | 7.0 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition exists in a driver potentially leading to a use-after-free con… |
CVE-2017-8268 | High | 7.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, the camera application can possibly request frame/command buffer processing wit… |
CVE-2017-8267 | High | 7.0 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition exists in an IOCTL handler potentially leading to an integer o… |
CVE-2017-8266 | High | 7.0 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition exists in a video driver potentially leading to a use-after-fr… |
CVE-2017-8265 | High | 7.0 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition exists in a video driver which can lead to a double free. |
CVE-2017-8263 | High | 7.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a kernel fault can occur when doing certain operations on a read-only virtual a… |
CVE-2017-8262 | High | 7.0 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, in some memory allocation and free functions, a race condition can potentially… |
CVE-2017-8261 | High | 7.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, in a camera driver ioctl, a kernel overwrite can potentially occur. |
CVE-2017-8260 | High | 7.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, due to a type downcast, a value may improperly pass validation and cause an out… |
CVE-2017-8257 | High | 7.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, when accessing the sde_rotator debug interface for register reading with multip… |
CVE-2017-8256 | High | 7.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, array out of bounds access can occur if userspace sends more than 16 multicast… |
CVE-2017-8255 | High | 7.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, an integer overflow vulnerability exists in boot. |
CVE-2017-8254 | Medium | 5.5 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, an audio client pointer is dereferenced before being checked if it is valid. |
CVE-2017-8253 | High | 7.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, kernel memory can potentially be overwritten if an invalid master is sent from… |
CVE-2017-12949 | High | 8.8 | 2017-08-18 | lib\modules\contributors\contributor_list_table.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby pa… |
CVE-2017-12948 | Medium | 6.1 | 2017-08-18 | Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php, related to PHP_SELF. |
CVE-2017-12947 | High | 7.2 | 2017-08-18 | classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, ids, or modal param… |
CVE-2017-12946 | High | 7.2 | 2017-08-18 | classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal paramet… |
CVE-2017-12882 | Medium | 5.4 | 2017-08-18 | Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via… |
CVE-2017-12881 | High | 8.8 | 2017-08-18 | Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified vict… |
CVE-2017-12776 | Critical | 9.8 | 2017-08-18 | SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport parameter. |
CVE-2017-12593 | High | 8.8 | 2017-08-18 | ASUS DSL-N10S V2.1.16_APAC devices allow CSRF. |
CVE-2017-12592 | High | 8.8 | 2017-08-18 | ASUS DSL-N10S V2.1.16_APAC devices have a privilege escalation vulnerability. A normal user can escalate its privilege and perform administrative actions. Ther… |
CVE-2017-12591 | Medium | 5.4 | 2017-08-18 | ASUS DSL-N10S V2.1.16_APAC devices have reflected and stored cross site scripting, as demonstrated by the snmpSysName parameter. |
CVE-2017-12589 | High | 8.8 | 2017-08-18 | ToMAX R60G R60GV2-V2.0-v.2.6.3-170330 devices do not have any protection against a CSRF attack. |
CVE-2017-12420 | High | 8.8 | 2017-08-18 | Heap-based buffer overflow in the SMB implementation in NetApp Clustered Data ONTAP before 8.3.2P8 and 9.0 before P2 allows remote authenticated users to cause… |
CVE-2017-11653 | High | 7.8 | 2017-08-18 | Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the Devices directory, which allows local users to gain privileges via a Trojan horse (1) Raze… |
CVE-2017-11652 | High | 8.4 | 2017-08-18 | Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, which allows local users to gain privileges via a Trojan horse db… |
CVE-2017-11185 | High | 7.5 | 2017-08-18 | The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted RSA si… |
CVE-2017-0687 | Medium | 5.5 | 2017-08-18 | A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35583675. |
CVE-2017-9816 | Medium | 6.1 | 2017-08-18 | Cross-site scripting (XSS) vulnerability in Paessler PRTG Network Monitor before 17.2.32.2279 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2017-9767 | Medium | 5.4 | 2017-08-18 | Multiple cross-site scripting (XSS) vulnerabilities in Quali CloudShell before 8 allow remote authenticated users to inject arbitrary web script or HTML via th… |
CVE-2017-12859 | Medium | 5.9 | 2017-08-18 | NetApp Data ONTAP before 8.2.5, when operating in 7-Mode in NFS environments, allows remote attackers to cause a denial of service via unspecified vectors. |
CVE-2017-12680 | Medium | 6.1 | 2017-08-18 | Cross-Site Scripting (XSS) exists in NexusPHP 1.5 via the type parameter to shoutbox.php. |
CVE-2017-12582 | Critical | 9.8 | 2017-08-18 | Unprivileged user can access all functions in the Surveillance Station component in QNAP TS212P devices with firmware 4.2.1 build 20160601. Unprivileged user c… |
CVE-2017-1501 | Medium | 5.9 | 2017-08-18 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 could provide weaker than expected security after using the Admin Console to update the web services securit… |
CVE-2017-1338 | Medium | 5.4 | 2017-08-18 | IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2017-12944 | High | 7.5 | 2017-08-18 | The TIFFReadDirEntryArray function in tif_read.c in LibTIFF 4.0.8 mishandles memory allocation for short files, which allows remote attackers to cause a denial… |
CVE-2017-12943 | Critical | 9.8 | 2017-08-18 | D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?REQUIRE_FILE= absolute path traversal att… |
CVE-2017-9454 | High | 7.5 | 2017-08-18 | Buffer overflow in the ares_parse_a_reply function in the embedded ares library in ReSIProcate before 1.12.0 allows remote attackers to cause a denial of servi… |
CVE-2017-7278 | Critical | 9.8 | 2017-08-18 | Unspecified vulnerability in ASSA ABLOY APTUS Styra Porttelefonkort 4400 before A2 has unknown impact and attack vectors. |
CVE-2017-12942 | Critical | 9.8 | 2017-08-18 | libunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ function. |
CVE-2017-12941 | Critical | 9.8 | 2017-08-18 | libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function. |
CVE-2017-12940 | Critical | 9.8 | 2017-08-18 | libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function. |
CVE-2017-12440 | High | 7.5 | 2017-08-18 | Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs be… |
CVE-2017-10665 | High | 7.8 | 2017-08-18 | Directory traversal vulnerability in ajaxfileupload.php in Kayson Group Ltd. phpGrid before 7.2.5 allows remote attackers to execute arbitrary code by uploadin… |
CVE-2017-2289 | High | 7.8 | 2017-08-18 | Untrusted search path vulnerability in Installer of Qua station connection tool for Windows version 1.00.03 allows an attacker to gain privileges via a Trojan… |
CVE-2017-2228 | High | 7.8 | 2017-08-18 | Untrusted search path vulnerability in Teikihoukokusho Sakuseishien Tool v4.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified di… |
CVE-2017-12939 | Critical | 9.8 | 2017-08-18 | A Remote Code Execution vulnerability was identified in all Windows versions of Unity Editor, e.g., before 5.3.8p2, 5.4.x before 5.4.5p5, 5.5.x before 5.5.4p3… |
CVE-2017-12938 | High | 7.5 | 2017-08-18 | UnRAR before 5.5.7 allows remote attackers to bypass a directory-traversal protection mechanism via vectors involving a symlink to the . directory, a symlink t… |
CVE-2017-10824 | High | 7.8 | 2017-08-18 | Untrusted search path vulnerability in TDB CA TypeA use software Version 5.2 and earlier, distributed until 10 August 2017 allows an attacker to gain privilege… |
CVE-2017-10823 | High | 7.8 | 2017-08-18 | Untrusted search path vulnerability in Installer for Shin Kinkyuji Houkoku Data Nyuryoku Program (program released on 2011 March 10) Distributed on the website… |
CVE-2017-10822 | High | 7.8 | 2017-08-18 | Untrusted search path vulnerability in Installer for Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program (program released on 2013 September 30) distributed… |
CVE-2017-10821 | High | 7.8 | 2017-08-18 | Untrusted search path vulnerability in Installer for Shin Kikan Toukei Houkoku Data Nyuryokuyou Program (program released on 2013 September 30) Distributed on… |
CVE-2017-10811 | Medium | 6.8 | 2017-08-18 | Buffalo WCR-1166DS devices with firmware 1.30 and earlier allow an attacker to execute arbitrary OS commands via unspecified vectors. |
CVE-2017-12937 | High | 8.8 | 2017-08-18 | The ReadSUNImage function in coders/sun.c in GraphicsMagick 1.3.26 has a colormap heap-based buffer over-read. |
CVE-2017-12936 | High | 8.8 | 2017-08-18 | The ReadWMFImage function in coders/wmf.c in GraphicsMagick 1.3.26 has a use-after-free issue for data associated with exception reporting. |
CVE-2017-12935 | High | 8.8 | 2017-08-18 | The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 mishandles large MNG images, leading to an invalid memory read in the SetImageColorCallBack… |
CVE-2017-12934 | High | 7.5 | 2017-08-18 | ext/standard/var_unserializer.re in PHP 7.0.x before 7.0.21 and 7.1.x before 7.1.7 is prone to a heap use after free while unserializing untrusted data, relate… |
CVE-2017-12933 | Critical | 9.8 | 2017-08-18 | The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over… |
CVE-2017-12932 | Critical | 9.8 | 2017-08-18 | ext/standard/var_unserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free while unserializing untrusted data, rela… |
CVE-2017-12927 | Medium | 6.1 | 2017-08-18 | A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php. |
CVE-2017-6790 | Medium | 6.8 | 2017-08-17 | A vulnerability in the Session Initiation Protocol (SIP) on the Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote atta… |
CVE-2017-6788 | Medium | 6.1 | 2017-08-17 | The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker t… |
CVE-2017-6786 | Medium | 6.3 | 2017-08-17 | A vulnerability in Cisco Elastic Services Controller could allow an authenticated, local, unprivileged attacker to access sensitive information, including cred… |
CVE-2017-6785 | Medium | 4.3 | 2017-08-17 | A vulnerability in configuration modification permissions validation for Cisco Unified Communications Manager could allow an authenticated, remote attacker to… |
CVE-2017-6784 | Medium | 5.3 | 2017-08-17 | A vulnerability in the web interface of the Cisco RV340, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to acce… |
CVE-2017-6783 | Medium | 4.3 | 2017-08-17 | A vulnerability in SNMP polling for the Cisco Web Security Appliance (WSA), Email Security Appliance (ESA), and Content Security Management Appliance (SMA) cou… |
CVE-2017-6782 | Medium | 5.4 | 2017-08-17 | A vulnerability in the administrative web interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to modify a page in the web int… |
CVE-2017-6781 | Medium | 5.3 | 2017-08-17 | A vulnerability in the management of shell user accounts for Cisco Policy Suite (CPS) Software for CPS appliances could allow an authenticated, local attacker… |
CVE-2017-6778 | Medium | 6.5 | 2017-08-17 | A vulnerability in the Elastic Services Controller (ESC) web interface of the Cisco Ultra Services Platform could allow an authenticated, remote attacker to ac… |
CVE-2017-6777 | Medium | 4.9 | 2017-08-17 | A vulnerability in the ConfD server of the Cisco Elastic Services Controller (ESC) could allow an authenticated, remote attacker to acquire sensitive system in… |
CVE-2017-6776 | Medium | 6.1 | 2017-08-17 | A vulnerability in the web framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to conduct a cross-site scripti… |
CVE-2017-6775 | Medium | 5.7 | 2017-08-17 | A vulnerability in the CLI of Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, local a… |
CVE-2017-6774 | Medium | 5.0 | 2017-08-17 | A vulnerability in Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, remote attacker to… |
CVE-2017-6773 | Medium | 6.7 | 2017-08-17 | A vulnerability in the CLI of Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, local a… |
CVE-2017-6772 | Medium | 4.3 | 2017-08-17 | A vulnerability in Cisco Elastic Services Controller (ESC) could allow an authenticated, remote attacker to view sensitive information. The vulnerability is du… |
CVE-2017-6771 | High | 7.5 | 2017-08-17 | A vulnerability in the AutoVNF automation tool of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to acquire sensitive infor… |
CVE-2017-6768 | High | 7.8 | 2017-08-17 | A vulnerability in the build procedure for certain executable system files installed at boot time on Cisco Application Policy Infrastructure Controller (APIC)… |
CVE-2017-6767 | High | 7.1 | 2017-08-17 | A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to gain higher privileges than the a… |
CVE-2017-6710 | High | 8.1 | 2017-08-17 | A vulnerability in the Cisco Virtual Network Function (VNF) Element Manager could allow an authenticated, remote attacker to elevate privileges and run command… |
CVE-2017-12910 | Critical | 9.8 | 2017-08-17 | SQL injection vulnerability in massmail.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the or parameter. |