2017 CVEs (page 9)
Page 9 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-18556 | Medium | 6.1 | 2019-08-21 | The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues. |
CVE-2017-18555 | Medium | 6.1 | 2019-08-21 | The booking-sms plugin before 1.1.0 for WordPress has XSS. |
CVE-2017-18554 | Medium | 6.1 | 2019-08-21 | The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event. |
CVE-2017-18553 | Medium | 6.1 | 2019-08-21 | The ad-buttons plugin before 2.3.2 for WordPress has XSS. |
CVE-2017-18540 | Medium | 6.1 | 2019-08-21 | The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes. |
CVE-2017-18539 | Medium | 6.1 | 2019-08-21 | The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes. |
CVE-2017-18538 | Medium | 6.1 | 2019-08-21 | The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes. |
CVE-2017-18537 | Medium | 6.1 | 2019-08-21 | The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues. |
CVE-2017-18536 | Medium | 6.1 | 2019-08-21 | The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS. |
CVE-2017-18534 | Medium | 6.1 | 2019-08-21 | The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters. |
CVE-2017-18566 | Medium | 6.1 | 2019-08-20 | The user-role plugin before 1.5.6 for WordPress has multiple XSS issues. |
CVE-2017-18533 | Medium | 6.1 | 2019-08-20 | The rimons-twitter-widget plugin before 1.3 for WordPress has XSS. |
CVE-2017-18532 | Medium | 6.1 | 2019-08-20 | The realty plugin before 1.1.0 for WordPress has multiple XSS issues. |
CVE-2017-18531 | Medium | 6.1 | 2019-08-20 | The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288. |
CVE-2017-18530 | Medium | 6.1 | 2019-08-20 | The rating-bws plugin before 0.2 for WordPress has multiple XSS issues. |
CVE-2017-18529 | Medium | 6.1 | 2019-08-20 | The promobar plugin before 1.1.1 for WordPress has multiple XSS issues. |
CVE-2017-18528 | Medium | 6.1 | 2019-08-20 | The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues. |
CVE-2017-18527 | Medium | 6.1 | 2019-08-20 | The pagination plugin before 1.0.7 for WordPress has multiple XSS issues. |
CVE-2017-18526 | Medium | 6.1 | 2019-08-20 | The moreads-se plugin before 1.4.7 for WordPress has XSS. |
CVE-2017-18524 | Medium | 6.1 | 2019-08-20 | The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues. |
CVE-2017-18523 | High | 8.8 | 2019-08-20 | The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book. |
CVE-2017-18522 | Medium | 6.1 | 2019-08-20 | The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book. |
CVE-2017-18519 | Medium | 6.1 | 2019-08-20 | The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages. |
CVE-2017-18518 | Medium | 6.1 | 2019-08-20 | The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues. |
CVE-2017-18569 | High | 8.8 | 2019-08-20 | The my-wp-translate plugin before 1.0.4 for WordPress has CSRF. |
CVE-2017-18568 | Medium | 6.1 | 2019-08-20 | The my-wp-translate plugin before 1.0.4 for WordPress has XSS. |
CVE-2017-18567 | Medium | 6.1 | 2019-08-20 | The wp-all-import plugin before 3.4.6 for WordPress has XSS. |
CVE-2017-18520 | Medium | 6.1 | 2019-08-20 | The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php. |
CVE-2017-18517 | Medium | 6.1 | 2019-08-20 | The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues. |
CVE-2017-18552 | High | 7.8 | 2019-08-19 | An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency. |
CVE-2017-18551 | Medium | 6.7 | 2019-08-19 | An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emul… |
CVE-2017-18550 | Medium | 5.5 | 2019-08-19 | An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_get_… |
CVE-2017-18549 | Medium | 5.5 | 2019-08-19 | An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_send… |
CVE-2017-18547 | High | 8.8 | 2019-08-16 | The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms. |
CVE-2017-18546 | High | 8.8 | 2019-08-16 | The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF. |
CVE-2017-18545 | High | 7.5 | 2019-08-16 | The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input. |
CVE-2017-18544 | High | 8.8 | 2019-08-16 | The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF. |
CVE-2017-18543 | Critical | 9.8 | 2019-08-16 | The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations. |
CVE-2017-18542 | Medium | 6.1 | 2019-08-16 | The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues. |
CVE-2017-18541 | Medium | 6.1 | 2019-08-16 | The xo-security plugin before 1.5.3 for WordPress has XSS. |
CVE-2017-18548 | Critical | 9.8 | 2019-08-16 | The note-press plugin before 0.1.2 for WordPress has SQL injection. |
CVE-2017-14232 | Medium | 5.5 | 2019-08-15 | The read_chunk function in flif-dec.cpp in Free Lossless Image Format (FLIF) 0.3 allows remote attackers to cause a denial of service (invalid memory read and… |
CVE-2017-18513 | High | 8.8 | 2019-08-14 | The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface. |
CVE-2017-18512 | High | 8.8 | 2019-08-14 | The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF. |
CVE-2017-18511 | High | 8.8 | 2019-08-14 | The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF. |
CVE-2017-18510 | High | 8.8 | 2019-08-14 | The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions. |
CVE-2017-18514 | Critical | 9.8 | 2019-08-14 | The simple-login-log plugin before 1.1.2 for WordPress has SQL injection. |
CVE-2017-18515 | Critical | 9.8 | 2019-08-14 | The wp-statistics plugin before 12.0.8 for WordPress has SQL injection. |
CVE-2017-18488 | Medium | 6.1 | 2019-08-13 | The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues. |
CVE-2017-18487 | Medium | 6.1 | 2019-08-13 | The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues. |
CVE-2017-18507 | Medium | 6.1 | 2019-08-13 | The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS. |
CVE-2017-18498 | Medium | 6.1 | 2019-08-13 | The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search. |
CVE-2017-18497 | Medium | 6.1 | 2019-08-13 | The liveforms plugin before 3.4.0 for WordPress has XSS. |
CVE-2017-18496 | Medium | 6.1 | 2019-08-13 | The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues. |
CVE-2017-18495 | Medium | 6.1 | 2019-08-13 | The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS. |
CVE-2017-18494 | Medium | 6.1 | 2019-08-13 | The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues. |
CVE-2017-18493 | Medium | 6.1 | 2019-08-13 | The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues. |
CVE-2017-18492 | Medium | 6.1 | 2019-08-13 | The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues. |
CVE-2017-18491 | Medium | 6.1 | 2019-08-13 | The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues. |
CVE-2017-18490 | Medium | 6.1 | 2019-08-13 | The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues. |
CVE-2017-18489 | Medium | 6.1 | 2019-08-13 | The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS. |
CVE-2017-18509 | High | 7.8 | 2019-08-13 | An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel l… |
CVE-2017-18505 | Medium | 6.1 | 2019-08-12 | The twitter-plugin plugin before 2.55 for WordPress has XSS. |
CVE-2017-18504 | High | 8.8 | 2019-08-12 | The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF. |
CVE-2017-18503 | Medium | 6.1 | 2019-08-12 | The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS. |
CVE-2017-18502 | Medium | 6.1 | 2019-08-12 | The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues. |
CVE-2017-18501 | Medium | 6.1 | 2019-08-12 | The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues. |
CVE-2017-18500 | Medium | 6.1 | 2019-08-12 | The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues. |
CVE-2017-18499 | Medium | 6.1 | 2019-08-12 | The simple-membership plugin before 3.5.7 for WordPress has XSS. |
CVE-2017-18508 | Medium | 6.1 | 2019-08-12 | The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS. |
CVE-2017-18506 | Medium | 6.1 | 2019-08-12 | The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens. |
CVE-2017-18486 | High | 7.2 | 2019-08-09 | Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the… |
CVE-2017-18485 | Medium | 5.4 | 2019-08-08 | Cognitoys Dino devices allow profiles_add.html CSRF. |
CVE-2017-18484 | Medium | 6.1 | 2019-08-08 | Cognitoys Dino devices allow XSS via the SSID. |
CVE-2017-18483 | Medium | 6.1 | 2019-08-07 | ANNKE SP1 HD wireless camera 3.4.1.1604071109 devices allow XSS via a crafted SSID. |
CVE-2017-18482 | Medium | 6.5 | 2019-08-05 | cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213). |
CVE-2017-18481 | Medium | 5.4 | 2019-08-05 | cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211). |
CVE-2017-18480 | Medium | 6.5 | 2019-08-05 | cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210). |
CVE-2017-18479 | Medium | 6.5 | 2019-08-05 | In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209). |
CVE-2017-18478 | Medium | 6.5 | 2019-08-05 | In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207). |
CVE-2017-18477 | Medium | 6.5 | 2019-08-05 | In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206). |
CVE-2017-18476 | High | 7.5 | 2019-08-05 | Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205). |
CVE-2017-18475 | High | 8.8 | 2019-08-05 | In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204). |
CVE-2017-18474 | Medium | 6.5 | 2019-08-05 | cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201). |
CVE-2017-18473 | Medium | 5.4 | 2019-08-05 | cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199). |
CVE-2017-18472 | Medium | 6.1 | 2019-08-05 | cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198). |
CVE-2017-18471 | Medium | 5.4 | 2019-08-05 | cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197). |
CVE-2017-18470 | High | 8.8 | 2019-08-05 | cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196). |
CVE-2017-18469 | Medium | 6.3 | 2019-08-05 | cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233). |
CVE-2017-18468 | Medium | 6.3 | 2019-08-05 | cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232). |
CVE-2017-18467 | Medium | 4.3 | 2019-08-05 | cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229). |
CVE-2017-18466 | Low | 2.7 | 2019-08-05 | cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228). |
CVE-2017-18465 | Medium | 4.4 | 2019-08-05 | cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227). |
CVE-2017-18464 | Medium | 4.9 | 2019-08-05 | cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226). |
CVE-2017-18462 | High | 7.5 | 2019-08-05 | cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224). |
CVE-2017-18463 | High | 7.8 | 2019-08-02 | cPanel before 62.0.17 allows code execution in the context of the root account via a long DocumentRoot path (SEC-225). |
CVE-2017-18461 | Medium | 4.3 | 2019-08-02 | cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223). |
CVE-2017-18460 | High | 7.8 | 2019-08-02 | cPanel before 62.0.17 allows arbitrary code execution during automatic SSL installation (SEC-221). |
CVE-2017-18459 | High | 7.8 | 2019-08-02 | cPanel before 62.0.17 allows arbitrary code execution during account modification (SEC-220). |
CVE-2017-18458 | Low | 3.3 | 2019-08-02 | cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219). |