2017 CVEs (page 94)
Page 94 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-12568 | High | 7.5 | 2017-08-06 | Denial of Service vulnerability in Debut embedded httpd 1.20 in Brother DCP-J132W (and probably other DCP models) allows remote attackers to hang the printer (… |
CVE-2017-12572 | Medium | 4.8 | 2017-08-05 | Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2… |
CVE-2017-12566 | Medium | 6.5 | 2017-08-05 | In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadMVGImage in coders/mvg.c, which allows attackers to cause a denial of service… |
CVE-2017-12565 | Medium | 6.5 | 2017-08-05 | In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c, which allows attackers to cause a denial of serv… |
CVE-2017-12564 | Medium | 6.5 | 2017-08-05 | In ImageMagick 7.0.6-2, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service. |
CVE-2017-12563 | Medium | 6.5 | 2017-08-05 | In ImageMagick 7.0.6-2, a memory exhaustion vulnerability was found in the function ReadPSDImage in coders/psd.c, which allows attackers to cause a denial of s… |
CVE-2017-9864 | High | 7.5 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. An attacker can change the plant time even when not authenticated in any way. This changes the system… |
CVE-2017-9863 | High | 8.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. If a user simultaneously has Sunny Explorer running and visits a malicious host, cross-site request f… |
CVE-2017-9862 | High | 7.5 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. When signed into Sunny Explorer with a wrong password, it is possible to create a debug report, discl… |
CVE-2017-9861 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. The SIP implementation does not properly use authentication with encryption: it is vulnerable to repl… |
CVE-2017-9860 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. An attacker can use Sunny Explorer or the SMAdata2+ network protocol to update the device firmware wi… |
CVE-2017-9859 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. The inverters make use of a weak hashing algorithm to encrypt the password for REGISTER requests. Thi… |
CVE-2017-9858 | High | 7.5 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. By sending crafted packets to an inverter and observing the response, active and inactive user accoun… |
CVE-2017-9857 | High | 8.1 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. The SMAdata2+ communication protocol does not properly use authentication with encryption: it is vuln… |
CVE-2017-9856 | Low | 3.4 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. Sniffed passwords from SMAdata2+ communication can be decrypted very easily. The passwords are "encry… |
CVE-2017-9855 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. A secondary authentication system is available for Installers called the Grid Guard system. This syst… |
CVE-2017-9854 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. By sniffing for specific packets on the localhost, plaintext passwords can be obtained as they are ty… |
CVE-2017-9853 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity req… |
CVE-2017-9852 | Critical | 9.8 | 2017-08-05 | An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will al… |
CVE-2017-9851 | High | 7.5 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. By sending nonsense data or setting up a TELNET session to the database port of Sunny Explorer, the a… |
CVE-2017-12562 | Critical | 9.8 | 2017-08-05 | Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28 allows remote attackers to cause a denial of service (… |
CVE-2017-7533 | High | 7.0 | 2017-08-05 | Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges or cause a denial of service (memory cor… |
CVE-2017-12439 | High | 7.5 | 2017-08-05 | SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xml_path HTTP parameter that trusts user-supplied in… |
CVE-2017-12419 | Medium | 4.9 | 2017-08-05 | If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the 'admin' directory (as recommended in the "P… |
CVE-2017-12482 | High | 7.8 | 2017-08-04 | The ledger::parse_date_mask_routine function in times.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and… |
CVE-2017-12481 | High | 7.8 | 2017-08-04 | The find_option function in option.cc in Ledger 3.1.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash)… |
CVE-2017-2221 | High | 7.8 | 2017-08-04 | Untrusted search path vulnerability in Installer of Baidu IME Ver3.6.1.6 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspeci… |
CVE-2017-1331 | Medium | 5.4 | 2017-08-04 | IBM Content Navigator 2.0.3 and 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI t… |
CVE-2017-10820 | High | 7.8 | 2017-08-04 | Untrusted search path vulnerability in Installer of IP Messenger for Win 4.60 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an un… |
CVE-2017-10819 | Medium | 5.9 | 2017-08-04 | MaLion for Mac 4.3.0 to 5.2.1 does not properly validate certificates, which may allow an attacker to eavesdrop on an encrypted communication. |
CVE-2017-10818 | Critical | 9.8 | 2017-08-04 | MaLion for Windows and Mac versions 3.2.1 to 5.2.1 uses a hardcoded cryptographic key which may allow an attacker to alter the connection settings of Terminal… |
CVE-2017-10817 | Critical | 9.8 | 2017-08-04 | MaLion for Windows and Mac 5.0.0 to 5.2.1 allows remote attackers to bypass authentication to alter settings in Relay Service Server. |
CVE-2017-10816 | Critical | 9.8 | 2017-08-04 | SQL injection vulnerability in the MaLion for Windows and Mac 5.0.0 to 5.2.1 allows remote attackers to execute arbitrary SQL commands via Relay Service Server. |
CVE-2017-10815 | High | 8.1 | 2017-08-04 | MaLion for Windows 5.2.1 and earlier (only when "Remote Control" is installed) and MaLion for Mac 4.0.1 to 5.2.1 (only when "Remote Control" is installed) allo… |
CVE-2017-12459 | High | 7.8 | 2017-08-04 | The bfd_mach_o_read_symtab_strtab function in bfd/mach-o.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and ea… |
CVE-2017-12458 | High | 7.8 | 2017-08-04 | The nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and e… |
CVE-2017-12457 | High | 7.8 | 2017-08-04 | The bfd_make_section_with_flags function in section.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier… |
CVE-2017-12456 | High | 7.8 | 2017-08-04 | The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a cra… |
CVE-2017-12455 | High | 7.8 | 2017-08-04 | The evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allow… |
CVE-2017-12454 | High | 7.8 | 2017-08-04 | The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier… |
CVE-2017-12453 | High | 7.8 | 2017-08-04 | The _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows… |
CVE-2017-12452 | High | 7.8 | 2017-08-04 | The bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binuti… |
CVE-2017-12451 | High | 7.8 | 2017-08-04 | The _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GN… |
CVE-2017-12450 | High | 7.8 | 2017-08-04 | The alpha_vms_object_p function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, a… |
CVE-2017-12449 | High | 7.8 | 2017-08-04 | The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier… |
CVE-2017-12448 | High | 7.8 | 2017-08-04 | The bfd_cache_close function in bfd/cache.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows r… |
CVE-2017-10949 | High | 7.5 | 2017-08-04 | Directory Traversal in Dell Storage Manager 2016 R2.1 causes Information Disclosure when the doGet method of the EmWebsiteServlet class doesn't properly valida… |
CVE-2017-11657 | High | 7.3 | 2017-08-04 | Dashlane might allow local users to gain privileges by placing a Trojan horse WINHTTP.dll in the %APPDATA%\Dashlane directory. |
CVE-2017-12413 | Medium | 6.1 | 2017-08-04 | AXIS 2100 devices 2.43 have XSS via the URI, possibly related to admin/admin.shtml. |
CVE-2017-12435 | High | 7.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of s… |
CVE-2017-12434 | Medium | 6.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a missing NULL check vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of… |
CVE-2017-12433 | Medium | 6.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadPESImage in coders/pes.c, which allows attackers to cause a denial of service… |
CVE-2017-12432 | Medium | 6.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadPCXImage in coders/pcx.c, which allows attackers to cause a denial of s… |
CVE-2017-12431 | Medium | 6.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a use-after-free vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of serv… |
CVE-2017-12430 | High | 7.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of s… |
CVE-2017-12429 | High | 7.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of… |
CVE-2017-12428 | High | 7.5 | 2017-08-04 | In ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service… |
CVE-2017-12427 | Medium | 6.5 | 2017-08-04 | The ProcessMSLScript function in coders/msl.c in ImageMagick before 6.9.9-5 and 7.x before 7.0.6-5 allows remote attackers to cause a denial of service (memory… |
CVE-2017-12425 | High | 7.5 | 2017-08-04 | An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd so… |
CVE-2017-12424 | Critical | 9.8 | 2017-08-04 | In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to cra… |
CVE-2017-12418 | High | 7.5 | 2017-08-04 | ImageMagick 7.0.6-5 has memory leaks in the parse8BIMW and format8BIM functions in coders/meta.c, related to the WriteImage function in MagickCore/constitute.c. |
CVE-2017-1504 | Medium | 6.5 | 2017-08-03 | IBM WebSphere Application Server version 9.0.0.4 could provide weaker than expected security after using the PasswordUtil command to enable AES password encryp… |
CVE-2017-1327 | Medium | 6.1 | 2017-08-03 | IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering th… |
CVE-2017-12414 | Critical | 9.8 | 2017-08-03 | Format Factory 4.1.0 has a DLL Hijacking Vulnerability because an untrusted search path is used for msimg32.dll, WindowsCodecs.dll, and dwmapi.dll. |
CVE-2017-1199 | Medium | 5.4 | 2017-08-03 | IBM InfoSphere Master Data Management Server 10.0, 11.0, 11.3, 11.4, 11.5, and 11.6 is vulnerable to cross-site scripting. This vulnerability allows users to e… |
CVE-2017-11394 | Critical | 9.8 | 2017-08-03 | Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. T… |
CVE-2017-11393 | Critical | 9.8 | 2017-08-03 | Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. T… |
CVE-2017-11392 | High | 8.8 | 2017-08-03 | Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vul… |
CVE-2017-11391 | High | 8.8 | 2017-08-03 | Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vul… |
CVE-2017-11382 | High | 7.5 | 2017-08-03 | Denial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote attackers to delete arbitrary files on vulnerable installatio… |
CVE-2017-7442 | High | 8.8 | 2017-08-03 | Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences. |
CVE-2017-11721 | Critical | 9.8 | 2017-08-03 | Buffer overflow in ioquake3 before 2017-08-02 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impac… |
CVE-2017-11320 | Medium | 6.1 | 2017-08-03 | Persistent XSS through the SSID of nearby Wi-Fi devices on Technicolor TC7337 routers 08.89.17.20.00 allows an attacker to cause DNS Poisoning and steal creden… |
CVE-2017-11105 | Critical | 9.8 | 2017-08-03 | The OnePlus 2 Primary Bootloader (PBL) does not validate the SBL1 partition before executing it, although it contains a certificate. This allows attackers with… |
CVE-2017-11390 | High | 7.5 | 2017-08-02 | XML external entity (XXE) processing vulnerability in Trend Micro Control Manager 6.0, if exploited, could lead to information disclosure. Formerly ZDI-CAN-470… |
CVE-2017-11389 | Critical | 9.8 | 2017-08-02 | Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing dir… |
CVE-2017-11388 | High | 8.8 | 2017-08-02 | SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate user provided string… |
CVE-2017-11387 | High | 7.5 | 2017-08-02 | Authentication Bypass in Trend Micro Control Manager 6.0 causes Information Disclosure when authentication validation is not done for functionality that can ch… |
CVE-2017-11386 | Critical | 9.8 | 2017-08-02 | SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input validation in cmdHa… |
CVE-2017-11385 | Critical | 9.8 | 2017-08-02 | SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x6b1b due to lack of proper user input validation in cmdHa… |
CVE-2017-11384 | Critical | 9.8 | 2017-08-02 | SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due to lack of proper user input validation in mdHan… |
CVE-2017-11383 | Critical | 9.8 | 2017-08-02 | SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x1b07 due to lack of proper user input validation in cmdHa… |
CVE-2017-9770 | Medium | 5.5 | 2017-08-02 | A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse that can cause an out of bounds read operation to occur due to a field within… |
CVE-2017-9769 | Critical | 9.8 | 2017-08-02 | A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a handle to be opened… |
CVE-2017-9467 | Medium | 6.1 | 2017-08-02 | Cross-site scripting (XSS) vulnerability in the GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7… |
CVE-2017-9459 | Medium | 6.1 | 2017-08-02 | Cross-site scripting (XSS) vulnerability in the management web interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, an… |
CVE-2017-9247 | High | 7.8 | 2017-08-02 | Multiple unquoted service path vulnerabilities in Sierra Wireless Windows Mobile Broadband Driver Package (MBDP) with build ID < 4657 allows local users to lau… |
CVE-2017-9244 | Medium | 6.1 | 2017-08-02 | Cross-site scripting (XSS) vulnerability in the Trello app before 4.0.8 for iOS might allow remote attackers to inject arbitrary web script or HTML by uploadin… |
CVE-2017-8390 | Critical | 9.8 | 2017-08-02 | The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to execute arbit… |
CVE-2017-7890 | Medium | 6.5 | 2017-08-02 | The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, doe… |
CVE-2017-7642 | High | 7.8 | 2017-08-02 | The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local users to gain root privileges by leveragin… |
CVE-2017-11438 | Medium | 6.3 | 2017-08-02 | GitLab Community Edition (CE) and Enterprise Edition (EE) before 9.0.11, 9.1.8, 9.2.8 allow an authenticated user with the ability to create a group to add the… |
CVE-2017-11437 | Medium | 6.5 | 2017-08-02 | GitLab Enterprise Edition (EE) before 8.17.7, 9.0.11, 9.1.8, 9.2.8, and 9.3.8 allows an authenticated user with the ability to create a project to use the mirr… |
CVE-2017-11356 | Medium | 6.5 | 2017-08-02 | The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privileges to obtain sens… |
CVE-2017-11355 | Medium | 6.1 | 2017-08-02 | Multiple cross-site scripting (XSS) vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web script or HTML via the… |
CVE-2017-11334 | Medium | 4.4 | 2017-08-02 | The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bo… |
CVE-2017-10806 | Medium | 5.5 | 2017-08-02 | Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU process crash) via… |
CVE-2017-10664 | High | 7.5 | 2017-08-02 | qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting durin… |
CVE-2017-1495 | Medium | 4.9 | 2017-08-02 | IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a privileged user to cause a memory dump that could contain highly sensitive information incl… |
CVE-2017-1468 | High | 7.8 | 2017-08-02 | IBM InfoSphere Information Server 9.1, 11.3, and 11.5 could allow a local user to gain elevated privileges by placing arbitrary files in installation directori… |