2017 CVEs (page 97)
Page 97 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-9727 | High | 7.8 | 2017-07-26 | The gx_ttfReader__Read function in base/gxttfb.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer o… |
CVE-2017-9726 | High | 7.8 | 2017-07-26 | The Ins_MDRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read… |
CVE-2017-9620 | High | 7.8 | 2017-07-26 | The xps_select_font_encoding function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based bu… |
CVE-2017-9619 | High | 7.8 | 2017-07-26 | The xps_true_callback_glyph_name function in xps/xpsttf.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (Segmentati… |
CVE-2017-9618 | High | 7.8 | 2017-07-26 | The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (buffer overflow and… |
CVE-2017-9612 | High | 7.8 | 2017-07-26 | The Ins_IP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (use-after-free and applicatio… |
CVE-2017-9611 | High | 7.8 | 2017-07-26 | The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read… |
CVE-2017-9610 | High | 7.8 | 2017-07-26 | The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer o… |
CVE-2017-11666 | Medium | 6.1 | 2017-07-26 | Cross-site scripting (XSS) vulnerability in js/ViewerPanel.js in the file previewer plugin in Kopano WebApp versions 3.3.0 and earlier allows remote attackers… |
CVE-2017-5691 | Critical | 9.0 | 2017-07-26 | Incorrect check in Intel processors from 6th and 7th Generation Intel Core Processor Families, Intel Xeon E3-1500M v5 and v6 Product Families, and Intel Xeon E… |
CVE-2017-11658 | High | 7.5 | 2017-07-26 | In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficien… |
CVE-2017-11615 | High | 8.6 | 2017-07-26 | A sandbox escape in the Lua interface in Wube Factorio before 0.15.31 allows remote game servers or user-assisted attackers to execute arbitrary C code by incl… |
CVE-2017-11612 | Medium | 6.1 | 2017-07-26 | In Joomla! before 3.7.4, inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components. |
CVE-2017-11655 | High | 7.5 | 2017-07-26 | A memory leak was found in the way SIPcrack 0.2 handled processing of SIP traffic, because a lines array was mismanaged. A remote attacker could potentially us… |
CVE-2017-11654 | Medium | 5.9 | 2017-07-26 | An out-of-bounds read and write flaw was found in the way SIPcrack 0.2 processed SIP traffic, because 0x00 termination of a payload array was mishandled. A rem… |
CVE-2017-6005 | High | 7.0 | 2017-07-26 | Waves MaxxAudio, as installed on Dell laptops, adds a "WavesSysSvc" Windows service with File Version 1.1.6.0. This service has a vulnerability known as Unquot… |
CVE-2017-11651 | Medium | 6.1 | 2017-07-26 | NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag. |
CVE-2017-11644 | Medium | 6.5 | 2017-07-26 | When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the ReadMATImage() function in coders/mat.c. |
CVE-2017-11643 | Critical | 9.8 | 2017-07-26 | GraphicsMagick 1.3.26 has a heap overflow in the WriteCMYKImage() function in coders/cmyk.c when processing multiple frames that have non-identical widths. |
CVE-2017-11642 | High | 8.8 | 2017-07-26 | GraphicsMagick 1.3.26 has a NULL pointer dereference in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image, a different vulne… |
CVE-2017-11641 | Critical | 9.8 | 2017-07-26 | GraphicsMagick 1.3.26 has a Memory Leak in the PersistCache function in magick/pixel_cache.c during writing of Magick Persistent Cache (MPC) files. |
CVE-2017-11640 | Medium | 6.5 | 2017-07-26 | When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to an address access exception in the WritePTIFImage() function in coders/tiff.c. |
CVE-2017-11639 | Medium | 6.5 | 2017-07-26 | When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteCIPImage() function in coders/cip.c, rel… |
CVE-2017-11638 | High | 8.8 | 2017-07-26 | GraphicsMagick 1.3.26 has a segmentation violation in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image, a different vulnera… |
CVE-2017-11637 | Critical | 9.8 | 2017-07-26 | GraphicsMagick 1.3.26 has a NULL pointer dereference in the WritePCLImage() function in coders/pcl.c during writes of monochrome images. |
CVE-2017-11636 | Critical | 9.8 | 2017-07-26 | GraphicsMagick 1.3.26 has a heap overflow in the WriteRGBImage() function in coders/rgb.c when processing multiple frames that have non-identical widths. |
CVE-2017-11631 | Critical | 9.8 | 2017-07-26 | dapur/app/app_user/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter. |
CVE-2017-11630 | High | 7.5 | 2017-07-26 | dapur\apps\app_config\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file… |
CVE-2017-11629 | Medium | 6.1 | 2017-07-26 | dayrui FineCms through 5.0.10 has Cross Site Scripting (XSS) in controllers/api.php via the function parameter in a c=api&m=data2 request. |
CVE-2017-11613 | Medium | 6.5 | 2017-07-26 | In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFF… |
CVE-2017-11628 | High | 7.8 | 2017-07-25 | In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could… |
CVE-2017-11627 | Medium | 5.5 | 2017-07-25 | A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the Po… |
CVE-2017-11626 | Medium | 5.5 | 2017-07-25 | A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QP… |
CVE-2017-11625 | Medium | 5.5 | 2017-07-25 | A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QP… |
CVE-2017-11624 | Medium | 5.5 | 2017-07-25 | A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QP… |
CVE-2017-9233 | High | 7.5 | 2017-07-25 | XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malfo… |
CVE-2017-6755 | Medium | 6.1 | 2017-07-25 | A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning (PCP) Tool could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2017-6753 | High | 8.8 | 2017-07-25 | A vulnerability in Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated, remote attacker to execute arbitrary co… |
CVE-2017-6751 | High | 7.5 | 2017-07-25 | A vulnerability in the web proxy functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to forward traffic fro… |
CVE-2017-6750 | High | 7.5 | 2017-07-25 | A vulnerability in AsyncOS for the Cisco Web Security Appliance (WSA) could allow an unauthenticated, local attacker to log in to the device with the privilege… |
CVE-2017-6749 | Medium | 5.4 | 2017-07-25 | A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a stored c… |
CVE-2017-6748 | Medium | 6.7 | 2017-07-25 | A vulnerability in the CLI parser of the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to perform command injection and eleva… |
CVE-2017-6746 | High | 7.2 | 2017-07-25 | A vulnerability in the web interface of the Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection and e… |
CVE-2017-6672 | High | 7.5 | 2017-07-25 | A vulnerability in certain filtering mechanisms of access control lists (ACLs) for Cisco ASR 5000 Series Aggregation Services Routers through 21.x could allow… |
CVE-2017-6612 | High | 8.6 | 2017-07-25 | A vulnerability in the gateway GPRS support node (GGSN) of Cisco ASR 5000 Series Aggregation Services Routers 17.3.9.62033 through 21.1.2 could allow an unauth… |
CVE-2017-9413 | High | 8.8 | 2017-07-25 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of user… |
CVE-2017-8919 | Medium | 6.5 | 2017-07-25 | NetApp OnCommand API Services before 1.2P3 logs the LDAP BIND password when a user attempts to log in using the REST API, which allows remote authenticated use… |
CVE-2017-11460 | Medium | 6.1 | 2017-07-25 | Cross-site scripting (XSS) vulnerability in the DataArchivingService servlet in SAP NetWeaver Portal 7.4 allows remote attackers to inject arbitrary web script… |
CVE-2017-11459 | Critical | 9.8 | 2017-07-25 | SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files and consequently execute arbitrary code v… |
CVE-2017-11458 | Medium | 6.1 | 2017-07-25 | Cross-site scripting (XSS) vulnerability in the ctcprotocol/Protocol servlet in SAP NetWeaver AS JAVA 7.3 allows remote attackers to inject arbitrary web scrip… |
CVE-2017-11457 | Medium | 6.5 | 2017-07-25 | XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct… |
CVE-2017-11434 | Medium | 5.5 | 2017-07-25 | The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU pr… |
CVE-2017-11617 | Medium | 6.1 | 2017-07-25 | Cross-site scripting (XSS) vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML within the body of a… |
CVE-2017-11614 | Critical | 9.8 | 2017-07-25 | MEDHOST Connex contains hard-coded credentials that are used for customer database access. An attacker with knowledge of the hard-coded credentials and the abi… |
CVE-2017-11566 | High | 7.8 | 2017-07-25 | AppUse 4.0 allows shell command injection via a proxy field. |
CVE-2017-9457 | Medium | 6.7 | 2017-07-25 | Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature valida… |
CVE-2017-7980 | High | 7.8 | 2017-07-25 | Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or c… |
CVE-2017-11499 | High | 7.5 | 2017-07-25 | Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote… |
CVE-2017-8035 | High | 7.5 | 2017-07-25 | An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and cf-release versions… |
CVE-2017-8033 | High | 7.8 | 2017-07-25 | An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268. A… |
CVE-2017-7541 | High | 7.8 | 2017-07-25 | The brcmf_cfg80211_mgmt_tx function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.12.3 allows local users to caus… |
CVE-2017-1382 | High | 7.1 | 2017-07-24 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 might create files using the default permissions instead of the customized permissions when custom star… |
CVE-2017-1380 | Medium | 5.4 | 2017-07-24 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript co… |
CVE-2017-1287 | Medium | 5.4 | 2017-07-24 | IBM Rhapsody DM 5.0 and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a special… |
CVE-2017-1249 | Medium | 5.4 | 2017-07-24 | IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2017-1245 | Medium | 5.4 | 2017-07-24 | IBM Rational Software Architect Design Manager 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2017-9554 | Medium | 5.3 | 2017-07-24 | An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid… |
CVE-2017-9553 | High | 7.5 | 2017-07-24 | A design flaw in SYNO.API.Encryption in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to bypass the encryption protection mecha… |
CVE-2017-8036 | High | 7.8 | 2017-07-24 | An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 (only). The original fix for CVE-2017-8033 included… |
CVE-2017-11327 | Medium | 6.5 | 2017-07-24 | An issue was discovered in Tilde CMS 1.0.1. It is possible to retrieve sensitive data by using direct references. A low-privileged user can load PHP resources… |
CVE-2017-11326 | High | 7.5 | 2017-07-24 | An issue was discovered in Tilde CMS 1.0.1. It is possible to bypass the implemented restrictions on arbitrary file upload via a filename.+php manipulation. |
CVE-2017-11325 | High | 7.5 | 2017-07-24 | An issue was discovered in Tilde CMS 1.0.1. Arbitrary files can be read via a file=../ attack on actionphp/download.File.php. |
CVE-2017-11324 | Critical | 9.8 | 2017-07-24 | An issue was discovered in Tilde CMS 1.0.1. Due to missing escaping of the backtick character, a SELECT query in class.SystemAction.php is vulnerable to SQL In… |
CVE-2017-10711 | Medium | 6.1 | 2017-07-24 | In SimpleRisk 20170614-001, a CSRF attack on reset.php (aka the Send Password Reset Email form) can insert XSS sequences via the user parameter. |
CVE-2017-11608 | Medium | 6.5 | 2017-07-24 | There is a heap-based buffer over-read in the Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial… |
CVE-2017-11422 | High | 8.8 | 2017-07-24 | Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include r… |
CVE-2017-11605 | Medium | 6.5 | 2017-07-24 | There is a heap based buffer over-read in LibSass 3.4.5, related to address 0xb4803ea1. A crafted input will lead to a remote denial of service attack. |
CVE-2017-11600 | High | 7.0 | 2017-07-24 | net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFR… |
CVE-2017-11594 | Medium | 5.4 | 2017-07-24 | Cross-site scripting (XSS) vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web script or HTML via non-s… |
CVE-2017-11593 | Medium | 6.1 | 2017-07-24 | Cross-site scripting (XSS) vulnerability in the Markdown Preview Plus extension before 0.5.7 for Chrome allows remote attackers to inject arbitrary web script… |
CVE-2017-11592 | High | 7.5 | 2017-07-24 | There is a Mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote denial of service a… |
CVE-2017-11591 | High | 7.5 | 2017-07-24 | There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input. |
CVE-2017-11590 | High | 7.5 | 2017-07-24 | There is a NULL pointer dereference in the caseless_hash function in gxps-archive.c in libgxps 0.2.5. A crafted input will lead to a remote denial of service a… |
CVE-2017-11589 | Critical | 9.8 | 2017-07-24 | On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.2… |
CVE-2017-11588 | Critical | 9.8 | 2017-07-24 | On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.2… |
CVE-2017-11587 | High | 7.5 | 2017-07-24 | On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.2… |
CVE-2017-11586 | Medium | 6.1 | 2017-07-24 | dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php. |
CVE-2017-11585 | Critical | 9.8 | 2017-07-24 | dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval Injection. |
CVE-2017-11584 | Critical | 9.8 | 2017-07-24 | dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template… |
CVE-2017-11583 | Critical | 9.8 | 2017-07-24 | dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php. |
CVE-2017-11582 | Critical | 9.8 | 2017-07-24 | dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php. |
CVE-2017-11581 | Medium | 6.1 | 2017-07-24 | dayrui FineCms 5.0.9 has Cross Site Scripting (XSS) in admin/Login.php via a payload in the username field that does not begin with a '<' character. |
CVE-2017-11577 | High | 7.8 | 2017-07-23 | FontForge 20161012 is vulnerable to a buffer over-read in getsid (parsettf.c) resulting in DoS or code execution via a crafted otf file. |
CVE-2017-11576 | Medium | 5.5 | 2017-07-23 | FontForge 20161012 does not ensure a positive size in a weight vector memcpy call in readcfftopdict (parsettf.c) resulting in DoS via a crafted otf file. |
CVE-2017-11575 | High | 7.8 | 2017-07-23 | FontForge 20161012 is vulnerable to a buffer over-read in strnmatch (char.c) resulting in DoS or code execution via a crafted otf file, related to a call from… |
CVE-2017-11574 | High | 7.8 | 2017-07-23 | FontForge 20161012 is vulnerable to a heap-based buffer overflow in readcffset (parsettf.c) resulting in DoS or code execution via a crafted otf file. |
CVE-2017-11573 | High | 7.8 | 2017-07-23 | FontForge 20161012 is vulnerable to a buffer over-read in ValidatePostScriptFontName (parsettf.c) resulting in DoS or code execution via a crafted otf file. |
CVE-2017-11572 | High | 7.8 | 2017-07-23 | FontForge 20161012 is vulnerable to a heap-based buffer over-read in readcfftopdicts (parsettf.c) resulting in DoS or code execution via a crafted otf file. |
CVE-2017-11571 | High | 7.8 | 2017-07-23 | FontForge 20161012 is vulnerable to a stack-based buffer overflow in addnibble (parsettf.c) resulting in DoS or code execution via a crafted otf file. |
CVE-2017-11570 | High | 7.8 | 2017-07-23 | FontForge 20161012 is vulnerable to a buffer over-read in umodenc (parsettf.c) resulting in DoS or code execution via a crafted otf file. |