2017 CVEs (page 99)
Page 99 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-7032 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "kext tools" component. It allows attackers to exec… |
CVE-2017-7031 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "Foundation" component. It allows remote attackers… |
CVE-2017-7030 | High | 8.8 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected… |
CVE-2017-7029 | Medium | 5.5 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS bef… |
CVE-2017-7028 | Medium | 5.5 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS bef… |
CVE-2017-7027 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS bef… |
CVE-2017-7026 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS bef… |
CVE-2017-7025 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS bef… |
CVE-2017-7024 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS bef… |
CVE-2017-7023 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS bef… |
CVE-2017-7022 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS bef… |
CVE-2017-7021 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "AppleGraphicsPowerManagement" component. It allows… |
CVE-2017-7020 | High | 8.8 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected… |
CVE-2017-7019 | High | 8.8 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected… |
CVE-2017-7018 | High | 8.8 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected… |
CVE-2017-7017 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "Intel Graphics Driver" component. It allows attack… |
CVE-2017-7016 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "afclip" component. It allows remote attackers to e… |
CVE-2017-7015 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "Audio" component. It allows remote attackers to ob… |
CVE-2017-7014 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. macOS before 10.12.6 is affected. The issue involves the "Intel Graphics Driver" component. It allows attack… |
CVE-2017-7013 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. iCloud before 6.2.2 on Windows is affected… |
CVE-2017-7012 | High | 8.8 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected… |
CVE-2017-7011 | Medium | 6.5 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. The issue involves the "WebKit" component… |
CVE-2017-7010 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. iCloud before 6.2.2 on Windows is affected… |
CVE-2017-7009 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS bef… |
CVE-2017-7008 | High | 7.8 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. The issue i… |
CVE-2017-7007 | High | 7.5 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the "EventKitUI" component. It allows remote attackers to… |
CVE-2017-7006 | Medium | 5.3 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue i… |
CVE-2017-2517 | Medium | 6.5 | 2017-07-20 | An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. The issue involves the "Safari" component. It allows remote attackers to spoo… |
CVE-2017-11478 | Medium | 6.5 | 2017-07-20 | The ReadOneDJVUImage function in coders/djvu.c in ImageMagick through 6.9.9-0 and 7.x through 7.0.6-1 allows remote attackers to cause a denial of service (inf… |
CVE-2017-6532 | Critical | 9.8 | 2017-07-20 | Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgw_v1.02.0014 4.20 have cleartext credentials in /mib.db. |
CVE-2017-6531 | Critical | 9.8 | 2017-07-20 | On Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgw_v1.02.0014 4.20, the backup/restore feature lacks access control, related to ReadFile.cgi and LoadCfgFil… |
CVE-2017-6530 | Critical | 9.8 | 2017-07-20 | Televes COAXDATA GATEWAY 1Gbps devices doc-wifi-hgw_v1.02.0014 4.20 do not check password.shtml authorization, leading to Arbitrary password change. |
CVE-2017-9822 | High | 8.8 | 2017-07-20 | DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites." |
CVE-2017-9785 | Critical | 9.8 | 2017-07-20 | Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie. |
CVE-2017-6316 | Critical | 9.8 | 2017-07-20 | Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBri… |
CVE-2017-11475 | High | 8.8 | 2017-07-20 | GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php. |
CVE-2017-11474 | Critical | 9.8 | 2017-07-20 | GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computer_softwareversion.class.php, exploitable via ajax/common.tabs.php. |
CVE-2017-11473 | High | 7.8 | 2017-07-20 | Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel through 3.2 allows local users to gain privileges v… |
CVE-2017-11472 | High | 7.1 | 2017-07-20 | The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not flush the operand cache and causes a kernel stack du… |
CVE-2017-11471 | Critical | 9.8 | 2017-07-20 | IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatIfGadget/getmetrics.php via the element parameter. |
CVE-2017-11470 | Critical | 9.8 | 2017-07-20 | IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatifGadget/getxenmetrics.php via the element parameter. |
CVE-2017-11469 | High | 7.5 | 2017-07-20 | get2post.php in IDERA Uptime Monitor 7.8 has directory traversal in the file_name parameter. |
CVE-2017-10676 | Medium | 6.1 | 2017-07-20 | On D-Link DIR-600M devices before C1_v3.05ENB01_beta_20170306, XSS was found in the form2userconfig.cgi username parameter. |
CVE-2017-9765 | High | 8.1 | 2017-07-20 | Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to… |
CVE-2017-11467 | Critical | 9.8 | 2017-07-20 | OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbit… |
CVE-2017-11466 | High | 7.2 | 2017-07-20 | Arbitrary file upload vulnerability in com/dotmarketing/servlets/AjaxFileUploadServlet.class in dotCMS 4.1.1 allows remote authenticated administrators to uplo… |
CVE-2017-11465 | Critical | 9.8 | 2017-07-19 | The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possibly have unspecifie… |
CVE-2017-11464 | High | 7.8 | 2017-07-19 | A SIGFPE is raised in the function box_blur_line of rsvg-filter.c in GNOME librsvg 2.40.17 during an attempted parse of a crafted SVG file, because of incorrec… |
CVE-2017-1309 | High | 7.8 | 2017-07-19 | IBM InfoSphere Master Data Management Server 11.0 - 11.6 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 1254… |
CVE-2017-1224 | High | 7.5 | 2017-07-19 | IBM Tivoli Endpoint Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Forc… |
CVE-2017-1223 | Medium | 6.1 | 2017-07-19 | IBM Tivoli Endpoint Manager could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a special… |
CVE-2017-1219 | Medium | 6.5 | 2017-07-19 | IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulner… |
CVE-2017-1218 | High | 8.8 | 2017-07-19 | IBM Tivoli Endpoint Manager is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2017-1203 | Medium | 6.1 | 2017-07-19 | IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications is vulnerable to cross-site scripting. This vulnerability allows users to emb… |
CVE-2017-7977 | Critical | 9.8 | 2017-07-19 | The Screensavercc component in eLux RP before 5.5.0 allows attackers to bypass intended configuration restrictions and execute arbitrary commands with root pri… |
CVE-2017-9764 | Medium | 6.1 | 2017-07-19 | Cross-site scripting (XSS) vulnerability in MetInfo 5.3.17 allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For… |
CVE-2017-11456 | High | 7.5 | 2017-07-19 | Geneko GWR routers allow directory traversal sequences starting with a /../ substring, as demonstrated by unauthenticated read access to the configuration file. |
CVE-2017-11450 | High | 8.8 | 2017-07-19 | coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact… |
CVE-2017-11449 | High | 8.8 | 2017-07-19 | coders/mpc.c in ImageMagick before 7.0.6-1 does not enable seekable streams and thus cannot validate blob sizes, which allows remote attackers to cause a denia… |
CVE-2017-11448 | Medium | 6.5 | 2017-07-19 | The ReadJPEGImage function in coders/jpeg.c in ImageMagick before 7.0.6-1 allows remote attackers to obtain sensitive information from uninitialized memory loc… |
CVE-2017-11447 | Medium | 6.5 | 2017-07-19 | The ReadSCREENSHOTImage function in coders/screenshot.c in ImageMagick before 7.0.6-1 has memory leaks, causing denial of service. |
CVE-2017-11446 | Medium | 6.5 | 2017-07-19 | The ReadPESImage function in coders\pes.c in ImageMagick 7.0.6-1 has an infinite loop vulnerability that can cause CPU exhaustion via a crafted PES file. |
CVE-2017-11445 | Critical | 9.8 | 2017-07-19 | Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array. |
CVE-2017-11444 | Critical | 9.8 | 2017-07-19 | Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array. |
CVE-2017-11441 | Medium | 5.4 | 2017-07-19 | The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33, and 66.x before 6… |
CVE-2017-11440 | Medium | 4.9 | 2017-07-19 | In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference paramete… |
CVE-2017-11439 | Medium | 5.4 | 2017-07-19 | In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter. |
CVE-2017-11436 | Critical | 9.8 | 2017-07-19 | D-Link DIR-615 before v20.12PTb04 has a second admin account with a 0x1 BACKDOOR value, which might allow remote attackers to obtain access via a TELNET connec… |
CVE-2017-11435 | Critical | 9.8 | 2017-07-19 | The Humax Wi-Fi Router model HG100R-* 2.0.6 is prone to an authentication bypass vulnerability via specially crafted requests to the management console. The bu… |
CVE-2017-10801 | Medium | 6.1 | 2017-07-19 | phpSocial (formerly phpDolphin) before 3.0.1 has XSS in the PATH_INFO to the search/tag/ URI. |
CVE-2017-9245 | High | 7.5 | 2017-07-19 | The Google News and Weather application before 3.3.1 for Android allows remote attackers to read OAuth tokens by sniffing the network and leveraging the lack o… |
CVE-2017-11411 | High | 7.5 | 2017-07-18 | In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the openSAFETY dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packe… |
CVE-2017-11410 | High | 7.5 | 2017-07-18 | In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture f… |
CVE-2017-11409 | High | 7.5 | 2017-07-18 | In Wireshark 2.0.0 to 2.0.13, the GPRS LLC dissector could go into a large loop. This was addressed in epan/dissectors/packet-gprs-llc.c by using a different i… |
CVE-2017-11408 | High | 7.5 | 2017-07-18 | In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed in epan/dissectors/packet-amqp.c by checking for successful… |
CVE-2017-11407 | High | 7.5 | 2017-07-18 | In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the MQ dissector could crash. This was addressed in epan/dissectors/packet-mq.c by validating the fragment len… |
CVE-2017-11406 | High | 7.5 | 2017-07-18 | In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by r… |
CVE-2017-11423 | Medium | 5.5 | 2017-07-18 | The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers to cause a denial of… |
CVE-2017-10708 | High | 7.8 | 2017-07-18 | An issue was discovered in Apport through 2.20.x. In apport/report.py, Apport sets the ExecutablePath field and it then uses the path to run package specific h… |
CVE-2017-11421 | High | 7.8 | 2017-07-18 | gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the "Bad Taste" issue. There is a local attac… |
CVE-2017-5247 | Medium | 5.4 | 2017-07-18 | Biscom Secure File Transfer is vulnerable to cross-site scripting in the File Name field. An authenticated user with permissions to upload or send files can po… |
CVE-2017-5246 | Medium | 4.3 | 2017-07-18 | Biscom Secure File Transfer is vulnerable to AngularJS expression injection in the Display Name field. An authenticated user can populate this field with a val… |
CVE-2017-7506 | High | 8.8 | 2017-07-18 | spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages from authenticated attacker to the spice se… |
CVE-2017-6320 | High | 8.8 | 2017-07-18 | A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19)… |
CVE-2017-10962 | Medium | 6.1 | 2017-07-18 | REDCap before 7.5.1 has XSS via the query string. |
CVE-2017-10961 | High | 8.8 | 2017-07-18 | REDCap before 7.5.1 has CSRF in the deletion feature of the File Repository and File Upload components. |
CVE-2017-1318 | High | 8.8 | 2017-07-18 | IBM MQ Appliance 8.0 and 9.0 could allow an authenticated messaging administrator to execute arbitrary commands on the system, caused by command execution. IBM… |
CVE-2017-11420 | Critical | 9.8 | 2017-07-18 | Stack-based buffer overflow in ASUS_Discovery.c in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for ASUS RT-AC5300, RT_AC1900P, RT-… |
CVE-2017-11419 | Critical | 9.8 | 2017-07-18 | Fiyo CMS 2.0.7 has SQL injection in /apps/app_article/controller/editor.php via $_POST['id'] and $_POST['art_title']. |
CVE-2017-11418 | Critical | 9.8 | 2017-07-18 | Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_list.php via $_GET['cat'], $_GET['user'], $_GET['level'], and $_GET['iSortCol_'.$… |
CVE-2017-11417 | Critical | 9.8 | 2017-07-18 | Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/article_status.php via $_GET['id']. |
CVE-2017-11416 | Critical | 9.8 | 2017-07-18 | Fiyo CMS 2.0.7 has SQL injection in /apps/app_comment/controller/insert.php via the name parameter. |
CVE-2017-11415 | Critical | 9.8 | 2017-07-18 | Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/sys_article.php via $_POST['parent_id'], $_POST['desc'], $_POST['keys'], and $_POST['level']. |
CVE-2017-11414 | Critical | 9.8 | 2017-07-18 | Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/sys_comment.php via $_POST['comment'], $_POST['name'], $_POST['web'], $_POST['email'], $_POST['statu… |
CVE-2017-11413 | Critical | 9.8 | 2017-07-18 | Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_article/controller/comment_status.php via $_GET['id']. |
CVE-2017-11412 | Critical | 9.8 | 2017-07-18 | Fiyo CMS 2.0.7 has SQL injection in dapur/apps/app_comment/controller/comment_status.php via $_GET['id']. |
CVE-2017-11405 | Medium | 4.9 | 2017-07-18 | In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, follo… |
CVE-2017-11404 | Medium | 4.9 | 2017-07-18 | In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php. |
CVE-2017-11403 | High | 8.8 | 2017-07-18 | The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 has an out-of-order CloseBlob call, resulting in a use-after-free via a crafted file. |
CVE-2017-9934 | Medium | 6.1 | 2017-07-17 | Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability. |