CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In February 2017

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-6350 190 Overflow 2017-02-27 2018-08-13
7.5
 None Remote Low Not required Partial Partial Partial
An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.
2 CVE-2017-6349 190 Overflow 2017-02-27 2018-08-13
7.5
 None Remote Low Not required Partial Partial Partial
An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.
3 CVE-2017-6344 611 2017-02-27 2017-03-02
4.3
 None Remote Medium Not required Partial None None
XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document.
4 CVE-2017-6343 287 2017-02-27 2019-10-03
9.3
 None Remote Medium Not required Complete Complete Complete
The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 allows remote attackers to obtain login access by leveraging knowledge of the MD5 Admin Hash without knowledge of the corresponding password, a different vulnerability than CVE-2013-6117.
5 CVE-2017-6342 269 2017-02-27 2019-10-03
10.0
 None Remote Low Not required Complete Complete Complete
An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19. When SmartPSS Software is launched, while on the login screen, the software in the background automatically logs in as admin. This allows sniffing sensitive information identified in CVE-2017-6341 without prior knowledge of the password. This is a different vulnerability than CVE-2013-6117.
6 CVE-2017-6341 319 +Info 2017-02-27 2019-10-03
4.3
 None Remote Medium Not required Partial None None
Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software 1.16.1 2017-01-19 send cleartext passwords in response to requests from the Web Page, Mobile Application, and Desktop Application interfaces, which allows remote attackers to obtain sensitive information by sniffing the network, a different vulnerability than CVE-2013-6117.
7 CVE-2017-6310 125 2017-02-24 2019-03-13
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in tnef before 1.4.13. Four type confusions have been identified in the file_add_mapi_attrs() function. These might lead to invalid read and write operations, controlled by an attacker.
8 CVE-2017-6309 125 2017-02-24 2019-03-13
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker.
9 CVE-2017-6308 190 Overflow 2017-02-24 2019-03-13
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been identified in the functions that wrap memory allocation.
10 CVE-2017-6307 787 2017-02-24 2019-03-13
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.
11 CVE-2017-6306 22 Dir. Trav. 2017-02-24 2019-05-18
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "9 of 9. Directory Traversal using the filename; SanitizeFilename function in settings.c."
12 CVE-2017-6305 125 2017-02-24 2019-05-18
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "8 of 9. Out of Bounds read and write."
13 CVE-2017-6304 125 2017-02-24 2019-05-18
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "7 of 9. Out of Bounds read."
14 CVE-2017-6303 190 Overflow 2017-02-24 2019-05-18
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "6 of 9. Invalid Write and Integer Overflow."
15 CVE-2017-6302 190 Overflow 2017-02-24 2019-05-18
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "5 of 9. Integer Overflow."
16 CVE-2017-6301 125 2017-02-24 2019-05-18
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "4 of 9. Out of Bounds Reads."
17 CVE-2017-6300 119 Overflow 2017-02-24 2019-05-18
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "3 of 9. Buffer Overflow in version field in lib/tnef-types.h."
18 CVE-2017-6299 835 2017-02-24 2019-10-03
4.3
 None Remote Medium Not required None None Partial
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "2 of 9. Infinite Loop / DoS in the TNEFFillMapi function in lib/ytnef.c."
19 CVE-2017-6298 476 2017-02-24 2019-05-18
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "1 of 9. Null Pointer Deref / calloc return value not checked."
20 CVE-2017-6297 311 2017-02-27 2019-10-03
4.3
 None Remote Medium Not required Partial None None
The L2TP Client in MikroTik RouterOS versions 6.83.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server by monitoring the packets for the transmitted data and obtaining the L2TP secret.
21 CVE-2017-6214 835 DoS 2017-02-23 2019-10-03
5.0
 None Remote Low Not required None None Partial
The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11 allows remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag.
22 CVE-2017-6206 200 +Info 2017-02-23 2017-08-16
5.0
 None Remote Low Not required Partial None None
D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28, and DGS-1510-20 Websmart devices with firmware before 1.31.B003 allow attackers to conduct Unauthenticated Information Disclosure attacks via unspecified vectors.
23 CVE-2017-6205 Bypass 2017-02-23 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28, and DGS-1510-20 Websmart devices with firmware before 1.31.B003 allow attackers to conduct Unauthenticated Command Bypass attacks via unspecified vectors.
24 CVE-2017-6197 476 DoS 2017-02-24 2017-03-02
4.3
 None Remote Medium Not required None None Partial
The r_read_* functions in libr/include/r_endian.h in radare2 1.2.1 allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by the r_read_le32 function.
25 CVE-2017-6196 416 DoS 2017-02-24 2017-08-22
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple use-after-free vulnerabilities in the gx_image_enum_begin function in base/gxipixel.c in Ghostscript before ecceafe3abba2714ef9b432035fe0739d9b1a283 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document.
26 CVE-2017-6188 20 2017-02-22 2020-05-27
1.9
 None Local Medium Not required None Partial None
Munin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled. Setting multiple upper_limit GET parameters allows overwriting any file accessible to the www-data user.
27 CVE-2017-6187 119 Exec Code Overflow 2017-02-22 2019-03-13
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the built-in web server in DiskSavvy Enterprise 9.4.18 allows remote attackers to execute arbitrary code via a long URI in a GET request.
28 CVE-2017-6127 352 CSRF 2017-02-21 2017-03-02
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in the access portal on the DIGISOL DG-HR1400 Wireless Router with firmware 1.00.02 allow remote attackers to hijack the authentication of administrators for requests that (1) change the SSID, (2) change the Wi-Fi password, or (3) possibly have unspecified other impact via crafted requests to form2WlanBasicSetup.cgi.
29 CVE-2017-6100 668 2017-02-23 2019-10-03
5.0
 None Remote Low Not required Partial None None
tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP.
30 CVE-2017-6099 79 XSS 2017-02-24 2019-03-13
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.
31 CVE-2017-6098 89 Sql 2017-02-21 2019-03-13
6.5
 None Remote Low ??? Partial Partial Partial
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign_save.php (Requires authentication to Wordpress admin) with the POST Parameter: list_id.
32 CVE-2017-6097 89 Sql 2017-02-21 2019-03-13
6.5
 None Remote Low ??? Partial Partial Partial
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign/count_of_send.php (Requires authentication to Wordpress admin) with the POST Parameter: camp_id.
33 CVE-2017-6096 89 Sql 2017-02-21 2019-03-13
6.5
 None Remote Low ??? Partial Partial Partial
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/view-list.php (Requires authentication to Wordpress admin) with the GET Parameter: filter_list.
34 CVE-2017-6095 89 Sql 2017-02-21 2019-03-13
7.5
 None Remote Low Not required Partial Partial Partial
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/lists/csvexport.php (Unauthenticated) with the GET Parameter: list_id.
35 CVE-2017-6078 20 DoS 2017-02-21 2017-02-23
4.3
 None Remote Medium Not required None None Partial
FastStone MaxView 3.0 and 3.1 allows user-assisted attackers to cause a denial of service (application crash) via a malformed BMP image with a crafted biSize field in the BITMAPINFOHEADER section.
36 CVE-2017-6077 78 Exec Code 2017-02-22 2017-03-02
10.0
 None Remote Low Not required Complete Complete Complete
ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request.
37 CVE-2017-6076 200 +Info 2017-02-24 2019-03-13
2.1
 None Local Low Not required Partial None None
In versions of wolfSSL before 3.10.2 the function fp_mul_comba makes it easier to extract RSA key information for a malicious user who has access to view cache on a machine.
38 CVE-2017-6074 415 DoS 2017-02-18 2018-07-19
7.2
 None Local Low Not required Complete Complete Complete
The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allows local users to obtain root privileges or cause a denial of service (double free) via an application that makes an IPV6_RECVPKTINFO setsockopt system call.
39 CVE-2017-6072 200 +Info 2017-02-21 2017-02-23
5.0
 None Remote Low Not required Partial None None
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin.
40 CVE-2017-6071 200 +Info 2017-02-21 2020-05-05
5.0
 None Remote Low Not required Partial None None
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml.
41 CVE-2017-6070 200 Exec Code +Info 2017-02-21 2017-02-23
7.5
 None Remote Low Not required Partial Partial Partial
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form.
42 CVE-2017-6065 89 Exec Code Sql 2017-02-17 2017-02-23
6.5
 None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS through 1.0.2 allows remote authenticated users to execute arbitrary SQL commands via the order parameter.
43 CVE-2017-6056 835 DoS 2017-02-17 2019-10-03
5.0
 None Remote Low Not required None None Partial
It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. The denial of service is easily achievable as a consequence of backporting a CVE-2016-6816 fix but not backporting the fix for Tomcat bug 57544. Distributions affected by this backporting issue include Debian (before 7.0.56-3+deb8u8 and 8.0.14-1+deb8u7 in jessie) and Ubuntu.
44 CVE-2017-6055 611 2017-02-17 2017-03-16
6.8
 None Remote Medium Not required Partial Partial Partial
XML external entity (XXE) vulnerability in eParakstitajs 3 before 1.3.9 and eParaksts Java lib before 2.5.13 allows remote attackers to read arbitrary files or possibly have unspecified other impact via a crafted edoc file.
45 CVE-2017-6014 835 2017-02-17 2019-10-03
7.8
 None Remote Low Not required None None Complete
In Wireshark 2.2.4 and earlier, a crafted or malformed STANAG 4607 capture file will cause an infinite loop and memory exhaustion. If the packet size field in a packet header is null, the offset to read from will not advance, causing continuous attempts to read the same zero length packet. This will quickly exhaust all system memory.
46 CVE-2017-6011 125 Overflow 2017-02-16 2019-03-12
4.3
 None Remote Medium Not required None None Partial
An issue was discovered in icoutils 0.31.1. An out-of-bounds read leading to a buffer overflow was observed in the "simple_vec" function in the "extract.c" source file. This affects icotool.
47 CVE-2017-6010 119 Overflow 2017-02-16 2019-03-12
4.3
 None Remote Medium Not required None None Partial
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be triggered by processing a corrupted ico file and will result in an icotool crash.
48 CVE-2017-6009 119 Overflow 2017-02-16 2019-03-12
4.3
 None Remote Medium Not required None None Partial
An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "decode_ne_resource_id" function in the "restable.c" source file. This is happening because the "len" parameter for memcpy is not checked for size and thus becomes a negative integer in the process, resulting in a failed memcpy. This affects wrestool.
49 CVE-2017-6004 125 DoS 2017-02-16 2021-06-29
5.0
 None Remote Low Not required None None Partial
The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.
50 CVE-2017-6001 362 +Priv 2017-02-18 2018-06-20
7.6
 None Remote High Not required Complete Complete Complete
Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent perf_event_open system calls for moving a software group into a hardware context. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6786.
Total number of vulnerabilities : 1041   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.