2017 CVEs (page 93)
Page 93 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12678 | High | 8.8 | 2017-08-08 | In TagLib 1.11.1, the rebuildAggregateFrames function in id3v2framefactory.cpp has a pointer to cast vulnerability, which allows remote attackers to cause a de… |
CVE-2017-12677 | Medium | 6.1 | 2017-08-08 | IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obt… |
CVE-2017-9942 | High | 7.8 | 2017-08-08 | A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with local access to the SiPass integrated… |
CVE-2017-9941 | High | 7.4 | 2017-08-08 | A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker in a Man-in-the-Middle position between th… |
CVE-2017-9940 | High | 8.1 | 2017-08-08 | A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with access to a low-privileged user accou… |
CVE-2017-9939 | Critical | 9.8 | 2017-08-08 | A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with network access to the SiPass integrat… |
CVE-2017-9938 | High | 7.5 | 2017-08-08 | A vulnerability was discovered in Siemens SIMATIC Logon (All versions before V1.6) that could allow specially crafted packets sent to the SIMATIC Logon Remote… |
CVE-2017-6873 | High | 7.4 | 2017-08-08 | A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker to read and manipulate data in TLS sessi… |
CVE-2017-6872 | Medium | 6.5 | 2017-08-08 | A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker with access to port 21/tcp to access or… |
CVE-2017-6871 | Medium | 5.4 | 2017-08-08 | A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2) and SIMATIC WinCC Sm@rtClient for Android Lite (… |
CVE-2017-6870 | High | 7.4 | 2017-08-08 | A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions before V1.0.2.2). The existing TLS protocol implementation could… |
CVE-2017-6869 | Critical | 9.8 | 2017-08-08 | A vulnerability was discovered in Siemens ViewPort for Web Office Portal before revision number 1453 that could allow an unauthenticated remote user to upload… |
CVE-2017-6866 | Medium | 6.5 | 2017-08-07 | A vulnerability was discovered in Siemens XHQ server 4 and 5 (4 before V4.7.1.3 and 5 before V5.0.0.2) that could allow an authenticated low-privileged remote… |
CVE-2017-12676 | Medium | 6.5 | 2017-08-07 | In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c, which allows attackers to cause a denial of serv… |
CVE-2017-12675 | Medium | 6.5 | 2017-08-07 | In ImageMagick 7.0.6-3, a missing check for multidimensional data was found in coders/mat.c, leading to a memory leak in the function ReadImage in MagickCore/c… |
CVE-2017-12674 | Medium | 6.5 | 2017-08-07 | In ImageMagick 7.0.6-2, a CPU exhaustion vulnerability was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of serv… |
CVE-2017-12673 | Medium | 6.5 | 2017-08-07 | In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of serv… |
CVE-2017-12672 | Medium | 6.5 | 2017-08-07 | In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service. |
CVE-2017-12671 | Medium | 6.5 | 2017-08-07 | In ImageMagick 7.0.6-3, a missing NULL assignment was found in coders/png.c, leading to an invalid free in the function RelinquishMagickMemory in MagickCore/me… |
CVE-2017-12670 | Medium | 6.5 | 2017-08-07 | In ImageMagick 7.0.6-3, missing validation was found in coders/mat.c, leading to an assertion failure in the function DestroyImage in MagickCore/image.c, which… |
CVE-2017-12669 | High | 8.8 | 2017-08-07 | ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteCALSImage in coders/cals.c. |
CVE-2017-12668 | High | 8.8 | 2017-08-07 | ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePCXImage in coders/pcx.c. |
CVE-2017-12667 | High | 8.8 | 2017-08-07 | ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMATImage in coders\mat.c. |
CVE-2017-12666 | High | 8.8 | 2017-08-07 | ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteINLINEImage in coders/inline.c. |
CVE-2017-12665 | High | 8.8 | 2017-08-07 | ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePICTImage in coders/pict.c. |
CVE-2017-12664 | High | 8.8 | 2017-08-07 | ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePALMImage in coders/palm.c. |
CVE-2017-12663 | High | 8.8 | 2017-08-07 | ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteMAPImage in coders/map.c. |
CVE-2017-12662 | High | 8.8 | 2017-08-07 | ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePDFImage in coders/pdf.c. |
CVE-2017-12655 | Medium | 6.1 | 2017-08-07 | Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the query parameter to log.php in a dailylog action. |
CVE-2017-12637 | High | 7.5 | 2017-08-07 | Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers t… |
CVE-2017-12654 | Medium | 6.5 | 2017-08-07 | The ReadPICTImage function in coders/pict.c in ImageMagick 7.0.6-3 allows attackers to cause a denial of service (memory leak) via a crafted file. |
CVE-2017-12653 | High | 7.8 | 2017-08-07 | 360 Total Security 9.0.0.1202 before 2017-07-07 allows Privilege Escalation via a Trojan horse Shcore.dll file in any directory in the PATH, as demonstrated by… |
CVE-2017-12651 | High | 8.8 | 2017-08-07 | Cross Site Request Forgery (CSRF) exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordPress because the HT… |
CVE-2017-12650 | Critical | 9.8 | 2017-08-07 | SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header. |
CVE-2017-12649 | Medium | 6.1 | 2017-08-07 | XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display. |
CVE-2017-12648 | Medium | 6.1 | 2017-08-07 | XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL. |
CVE-2017-12647 | Medium | 6.1 | 2017-08-07 | XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title. |
CVE-2017-12646 | Medium | 6.1 | 2017-08-07 | XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address. |
CVE-2017-12645 | Medium | 6.1 | 2017-08-07 | XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId. |
CVE-2017-12567 | Critical | 9.8 | 2017-08-07 | SQL injection exists in Quest KACE Asset Management Appliance 6.4.120822 through 7.2, Systems Management Appliance 6.4.120822 through 7.2.101, and K1000 as a S… |
CVE-2017-9801 | High | 7.5 | 2017-08-07 | When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers. |
CVE-2017-12644 | High | 8.8 | 2017-08-07 | ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadDCMImage in coders\dcm.c. |
CVE-2017-12643 | Medium | 6.5 | 2017-08-07 | ImageMagick 7.0.6-1 has a memory exhaustion vulnerability in ReadOneJNGImage in coders\png.c. |
CVE-2017-12642 | High | 8.8 | 2017-08-07 | ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMPCImage in coders\mpc.c. |
CVE-2017-12641 | High | 8.8 | 2017-08-07 | ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadOneJNGImage in coders\png.c. |
CVE-2017-12640 | High | 8.8 | 2017-08-07 | ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c. |
CVE-2017-12479 | High | 8.8 | 2017-08-07 | It was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable during a web session… |
CVE-2017-12478 | Critical | 9.8 | 2017-08-07 | It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated… |
CVE-2017-12477 | Critical | 9.8 | 2017-08-07 | It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue in which its authenti… |
CVE-2017-9647 | Medium | 6.6 | 2017-08-07 | A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010… |
CVE-2017-9633 | High | 8.8 | 2017-08-07 | An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on B… |
CVE-2017-9632 | Critical | 9.8 | 2017-08-07 | A Missing Encryption of Sensitive Data issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWa… |
CVE-2017-9630 | Critical | 9.4 | 2017-08-07 | An Improper Authentication issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 3… |
CVE-2017-7936 | Medium | 6.3 | 2017-08-07 | A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX… |
CVE-2017-7932 | Medium | 6.0 | 2017-08-07 | An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6… |
CVE-2017-7928 | Critical | 10.0 | 2017-08-07 | An Improper Access Control issue was discovered in Schweitzer Engineering Laboratories (SEL) SEL-3620 and SEL-3622 Security Gateway Versions R202 and, R203, R2… |
CVE-2017-7920 | High | 7.5 | 2017-08-07 | An Improper Authentication issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for React versions 2.1.3… |
CVE-2017-7916 | Medium | 6.5 | 2017-08-07 | A Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for R… |
CVE-2017-6770 | Medium | 4.2 | 2017-08-07 | Cisco IOS 12.0 through 15.6, Adaptive Security Appliance (ASA) Software 7.0.1 through 9.7.1.2, NX-OS 4.0 through 12.0, and IOS XE 3.6 through 3.18 are affected… |
CVE-2017-6769 | Medium | 5.4 | 2017-08-07 | A vulnerability in the web-based management interface of the Cisco Secure Access Control System (ACS) could allow an authenticated, remote attacker to conduct… |
CVE-2017-6766 | High | 7.5 | 2017-08-07 | A vulnerability in the Secure Sockets Layer (SSL) Decryption and Inspection feature of Cisco Firepower System Software 5.4.0, 5.4.1, 6.0.0, 6.1.0, 6.2.0, 6.2.1… |
CVE-2017-6765 | Medium | 6.1 | 2017-08-07 | A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.1(6.11) and 9.4(1.2) could allow an unauthenticated, remote… |
CVE-2017-6764 | Medium | 5.4 | 2017-08-07 | A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) 9.5(1) could allow an authenticated, remote attacker to conduc… |
CVE-2017-6763 | High | 7.5 | 2017-08-07 | A vulnerability in the implementation of the H.264 protocol in Cisco Meeting Server (CMS) 2.1.4 could allow an unauthenticated, remote attacker to cause a deni… |
CVE-2017-6762 | Medium | 6.1 | 2017-08-07 | A vulnerability in the web-based management interface of Cisco Jabber Guest Server 10.6(9), 11.0(0), and 11.0(1) could allow an unauthenticated, remote attacke… |
CVE-2017-6761 | Medium | 6.1 | 2017-08-07 | A vulnerability in the web-based management interface of Cisco Finesse 10.6(1) and 11.5(1) could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2017-6759 | Medium | 6.5 | 2017-08-07 | A vulnerability in the UpgradeManager of the Cisco Prime Collaboration Provisioning Tool 12.1 could allow an authenticated, remote attacker to write arbitrary… |
CVE-2017-6758 | Medium | 6.5 | 2017-08-07 | A vulnerability in the web framework of Cisco Unified Communications Manager 11.5(1.10000.6) could allow an authenticated, remote attacker to access arbitrary… |
CVE-2017-6757 | High | 8.8 | 2017-08-07 | A vulnerability in Cisco Unified Communications Manager 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6) could allow an authenticated, remote attacker to… |
CVE-2017-6756 | High | 8.8 | 2017-08-07 | A vulnerability in the Web UI Application of the Cisco Prime Collaboration Provisioning Tool through 12.2 could allow an unauthenticated, remote attacker to ex… |
CVE-2017-6754 | Medium | 6.5 | 2017-08-07 | A vulnerability in the web-based management interface of the Cisco Smart Net Total Care (SNTC) Software Collector Appliance 3.11 could allow an authenticated… |
CVE-2017-6752 | High | 7.5 | 2017-08-07 | A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) 9.3(3) and 9.6(2) could allow an unauthenticated, remote attacker to determ… |
CVE-2017-6747 | Critical | 9.8 | 2017-08-07 | A vulnerability in the authentication module of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass local authentica… |
CVE-2017-6745 | High | 7.5 | 2017-08-07 | A vulnerability in the cache server within Cisco Videoscape Distribution Suite (VDS) for Television 3.2(5)ES1 could allow an unauthenticated, remote attacker t… |
CVE-2017-6665 | Medium | 6.5 | 2017-08-07 | A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to reset… |
CVE-2017-6664 | High | 7.5 | 2017-08-07 | A vulnerability in the Autonomic Networking feature of Cisco IOS XE Software could allow an unauthenticated, remote, autonomic node to access the Autonomic Net… |
CVE-2017-6663 | Medium | 6.5 | 2017-08-07 | A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause… |
CVE-2017-6420 | Medium | 5.5 | 2017-08-07 | The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (use-after-free) via a crafted PE file with… |
CVE-2017-6419 | High | 7.8 | 2017-08-07 | mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overflow and application… |
CVE-2017-6418 | Medium | 5.5 | 2017-08-07 | libclamav/message.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message. |
CVE-2017-12606 | High | 8.8 | 2017-08-07 | OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the function FillColorRow4 in utils.cpp when reading an image file… |
CVE-2017-12605 | High | 8.8 | 2017-08-07 | OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the FillColorRow8 function in utils.cpp when reading an image file… |
CVE-2017-12604 | High | 8.8 | 2017-08-07 | OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the FillUniColor function in utils.cpp when reading an image file… |
CVE-2017-12603 | High | 8.8 | 2017-08-07 | OpenCV (Open Source Computer Vision Library) through 3.3 has an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecs/src/bitstrm.cpp w… |
CVE-2017-12602 | High | 7.5 | 2017-08-07 | OpenCV (Open Source Computer Vision Library) through 3.3 has a denial of service (memory consumption) issue, as demonstrated by the 10-opencv-dos-memory-exhaus… |
CVE-2017-12601 | High | 8.8 | 2017-08-07 | OpenCV (Open Source Computer Vision Library) through 3.3 has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmt_bmp.cpp… |
CVE-2017-12600 | High | 7.5 | 2017-08-07 | OpenCV (Open Source Computer Vision Library) through 3.3 has a denial of service (CPU consumption) issue, as demonstrated by the 11-opencv-dos-cpu-exhaust test… |
CVE-2017-12599 | High | 8.8 | 2017-08-07 | OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R when reading an image file by… |
CVE-2017-12598 | High | 8.8 | 2017-08-07 | OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modules/imgcodecs/src/bi… |
CVE-2017-12597 | High | 8.8 | 2017-08-07 | OpenCV (Open Source Computer Vision Library) through 3.3 has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file… |
CVE-2017-12596 | High | 7.8 | 2017-08-07 | In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp during exrmaketiled execution; it may res… |
CVE-2017-10677 | High | 8.8 | 2017-08-06 | Cross-Site Request Forgery (CSRF) exists on Linksys EA4500 devices with Firmware Version before 2.1.41.164606, as demonstrated by a request to apply.cgi to dis… |
CVE-2017-12588 | Critical | 9.8 | 2017-08-06 | The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a format string attack with unsp… |
CVE-2017-12587 | High | 8.8 | 2017-08-06 | ImageMagick 7.0.6-1 has a large loop vulnerability in the ReadPWPImage function in coders\pwp.c. |
CVE-2017-12480 | High | 7.8 | 2017-08-06 | Sandboxie installer 5071703 has a DLL Hijacking or Unsafe DLL Loading Vulnerability via a Trojan horse dwmapi.dll or profapi.dll file in an AppData\Local\Temp… |
CVE-2017-12586 | Medium | 6.5 | 2017-08-06 | SLiMS 8 Akasia through 8.3.1 has an arbitrary file reading issue because of directory traversal in the url parameter to admin/help.php. It can be exploited by… |
CVE-2017-12585 | High | 8.8 | 2017-08-06 | SLiMS 8 Akasia through 8.3.1 has SQL injection in admin/AJAX_lookup_handler.php (tableName and tableFields parameters), admin/AJAX_check_id.php, and admin/AJAX… |
CVE-2017-12584 | High | 8.8 | 2017-08-06 | There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile (including the password) can be updated without sending the current p… |
CVE-2017-12583 | Medium | 6.1 | 2017-08-06 | DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php. |
CVE-2017-12581 | High | 8.1 | 2017-08-06 | GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle… |