CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2017

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-14076 89 Sql 2017-08-31 2017-09-05
7.5
 None Remote Low Not required Partial Partial Partial
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.
2 CVE-2017-14070 79 XSS 2017-08-31 2017-09-05
4.3
 None Remote Medium Not required None Partial None
Cross Site Scripting (XSS) exists in NexusPHP 1.5.beta5.20120707 via the PATH_INFO to ipsearch.php, related to PHP_SELF.
3 CVE-2017-14069 89 Sql 2017-08-31 2017-09-07
7.5
 None Remote Low Not required Partial Partial Partial
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.
4 CVE-2017-14064 119 Overflow 2017-08-31 2019-05-13
7.5
 None Remote Low Not required Partial Partial Partial
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.
5 CVE-2017-14063 20 2017-08-31 2020-12-16
5.0
 None Remote Low Not required None Partial None
Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
6 CVE-2017-14062 190 DoS Overflow 2017-08-31 2020-12-07
7.5
 None Remote Low Not required Partial Partial Partial
Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
7 CVE-2017-14061 190 DoS Overflow 2017-08-31 2019-10-21
7.5
 None Remote Low Not required Partial Partial Partial
Integer overflow in the _isBidi function in bidi.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
8 CVE-2017-14060 476 DoS 2017-08-31 2020-09-08
4.3
 None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-10, a NULL Pointer Dereference issue is present in the ReadCUTImage function in coders/cut.c that could allow an attacker to cause a Denial of Service (in the QueueAuthenticPixelCacheNexus function within the MagickCore/cache.c file) by submitting a malformed image file.
9 CVE-2017-14059 834 2017-08-31 2019-10-03
7.1
 None Remote Medium Not required None None Complete
In FFmpeg 3.3.3, a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption. When a crafted CINE file, which claims a large "duration" field in the header but does not contain sufficient backing data, is provided, the image-offset parsing loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
10 CVE-2017-14058 835 DoS 2017-08-31 2020-12-29
4.3
 None Remote Medium Not required None None Partial
In FFmpeg 2.4 and 3.3.3, the read_data function in libavformat/hls.c does not restrict reload attempts for an insufficient list, which allows remote attackers to cause a denial of service (infinite loop).
11 CVE-2017-14057 834 2017-08-31 2019-10-03
7.1
 None Remote Medium Not required None None Complete
In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large "name_len" or "count" field in the header but does not contain sufficient backing data, is provided, the loops over the name and markers would consume huge CPU and memory resources, since there is no EOF check inside these loops.
12 CVE-2017-14056 834 2017-08-31 2019-10-03
7.1
 None Remote Medium Not required None None Complete
In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted RL2 file, which claims a large "frame_count" field in the header but does not contain sufficient backing data, is provided, the loops (for offset and size tables) would consume huge CPU and memory resources, since there is no EOF check inside these loops.
13 CVE-2017-14055 834 2017-08-31 2019-10-03
7.1
 None Remote Medium Not required None None Complete
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
14 CVE-2017-14054 834 2017-08-31 2019-10-03
7.1
 None Remote Medium Not required None None Complete
In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted IVR file, which claims a large "len" field in the header but does not contain sufficient backing data, is provided, the first type==4 loop would consume huge CPU resources, since there is no EOF check inside the loop.
15 CVE-2017-14051 190 DoS Overflow Mem. Corr. 2017-08-31 2018-03-16
4.9
 None Local Low Not required None None Complete
An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel through 4.12.10 allows local users to cause a denial of service (memory corruption and system crash) by leveraging root access.
16 CVE-2017-14050 434 Exec Code 2017-08-31 2017-09-01
6.5
 None Remote Low ??? Partial Partial Partial
In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file.
17 CVE-2017-14049 79 XSS 2017-08-31 2017-09-01
3.5
 None Remote Medium ??? None Partial None
In BlackCat CMS 1.2, backend/settings/ajax_save_settings.php allows remote authenticated users to conduct XSS attacks via the Website header or Website footer field.
18 CVE-2017-14048 352 CSRF 2017-08-31 2017-09-01
6.5
 None Remote Low ??? Partial Partial Partial
BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php. NOTE: this can be exploited via CSRF.
19 CVE-2017-14042 119 DoS Overflow 2017-08-30 2019-12-03
4.3
 None Remote Medium Not required None None Partial
A memory allocation failure was discovered in the ReadPNMImage function in coders/pnm.c in GraphicsMagick 1.3.26. The vulnerability causes a big memory allocation, which may lead to remote denial of service in the MagickRealloc function in magick/memory.c.
20 CVE-2017-14041 787 DoS Exec Code Overflow 2017-08-30 2021-02-02
6.8
 None Remote Medium Not required Partial Partial Partial
A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
21 CVE-2017-14040 787 DoS 2017-08-30 2021-02-02
6.8
 None Remote Medium Not required Partial Partial Partial
An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. The vulnerability may lead to remote denial of service or possibly unspecified other impact.
22 CVE-2017-14039 787 DoS Overflow 2017-08-30 2021-02-02
6.8
 None Remote Medium Not required Partial Partial Partial
A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in lib/openjp2/t2.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.
23 CVE-2017-14038 601 2017-08-30 2017-09-01
5.8
 None Remote Medium Not required Partial Partial None
CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability.
24 CVE-2017-14037 93 2017-08-30 2017-09-02
4.3
 None Remote Medium Not required None Partial None
CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability.
25 CVE-2017-14036 79 XSS 2017-08-30 2017-09-01
4.3
 None Remote Medium Not required None Partial None
CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS.
26 CVE-2017-14035 502 2017-08-30 2017-09-01
7.5
 None Remote Low Not required Partial Partial Partial
CrushFTP 8.x before 8.2.0 has a serialization vulnerability.
27 CVE-2017-14032 287 Bypass 2017-08-30 2017-11-08
6.8
 None Remote Medium Not required Partial Partial Partial
ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.
28 CVE-2017-13780 22 Dir. Trav. 2017-08-30 2021-02-23
5.0
 None Remote Low Not required Partial None None
The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows directory traversal attacks for reading arbitrary files via the module/admin_conf/download.php file parameter.
29 CVE-2017-13778 79 XSS 2017-08-30 2017-08-31
4.3
 None Remote Medium Not required None Partial None
Fiyo CMS 2.0.7 has XSS in dapur\apps\app_config\sys_config.php via the site_name parameter.
30 CVE-2017-13777 834 DoS 2017-08-30 2019-12-16
7.1
 None Remote Medium Not required None None Complete
GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version==10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it.
31 CVE-2017-13776 834 DoS 2017-08-30 2019-12-16
7.1
 None Remote Medium Not required None None Complete
GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version!=10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it.
32 CVE-2017-13775 DoS 2017-08-30 2019-10-03
7.1
 None Remote Medium Not required None None Complete
GraphicsMagick 1.3.26 has a denial of service issue in ReadJNXImage() in coders/jnx.c whereby large amounts of CPU and memory resources may be consumed although the file itself does not support the requests.
33 CVE-2017-13774 200 +Info 2017-08-30 2017-09-12
2.1
 None Local Low Not required Partial None None
Hikvision iVMS-4200 devices before v2.6.2.7 allow local users to generate password-recovery codes via unspecified vectors.
34 CVE-2017-13769 125 DoS 2017-08-30 2021-04-28
4.3
 None Remote Medium Not required None None Partial
The WriteTHUMBNAILImage function in coders/thumbnail.c in ImageMagick through 7.0.6-10 allows an attacker to cause a denial of service (buffer over-read) by sending a crafted JPEG file.
35 CVE-2017-13768 476 DoS 2017-08-30 2021-04-28
4.3
 None Remote Medium Not required None None Partial
Null Pointer Dereference in the IdentifyImage function in MagickCore/identify.c in ImageMagick through 7.0.6-10 allows an attacker to perform denial of service by sending a crafted image file.
36 CVE-2017-13767 20 2017-08-30 2019-10-03
7.8
 None Remote Low Not required None None Complete
In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSDP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-msdp.c by adding length validation.
37 CVE-2017-13766 787 2017-08-30 2017-12-11
5.0
 None Remote Low Not required None None Partial
In Wireshark 2.4.0 and 2.2.0 to 2.2.8, the Profinet I/O dissector could crash with an out-of-bounds write. This was addressed in plugins/profinet/packet-dcerpc-pn-io.c by adding string validation.
38 CVE-2017-13765 125 2017-08-30 2019-10-03
5.0
 None Remote Low Not required None None Partial
In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the IrCOMM dissector has a buffer over-read and application crash. This was addressed in plugins/irda/packet-ircomm.c by adding length validation.
39 CVE-2017-13764 476 2017-08-30 2017-09-03
5.0
 None Remote Low Not required None None Partial
In Wireshark 2.4.0, the Modbus dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/packet-mbtcp.c by adding length validation.
40 CVE-2017-13763 770 2017-08-30 2019-10-03
5.0
 None Remote Low Not required None None Partial
ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited.
41 CVE-2017-13762 79 XSS 2017-08-30 2017-09-01
4.3
 None Remote Medium Not required None Partial None
ONOS versions 1.8.0, 1.9.0, and 1.10.0 are vulnerable to XSS.
42 CVE-2017-13760 119 Overflow 2017-08-29 2022-06-20
2.1
 None Local Low Not required None None Partial
In The Sleuth Kit (TSK) 4.4.2, fls hangs on a corrupt exfat image in tsk_img_read() in tsk/img/img_io.c in libtskimg.a.
43 CVE-2017-13758 119 Overflow 2017-08-29 2018-06-14
4.3
 None Remote Medium Not required None None Partial
In ImageMagick 7.0.6-10, there is a heap-based buffer overflow in the TracePoint() function in MagickCore/draw.c.
44 CVE-2017-13757 125 DoS 2017-08-29 2019-10-03
4.3
 None Remote Medium Not required None None Partial
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the PLT section size, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to elf_i386_get_synthetic_symtab in elf32-i386.c and elf_x86_64_get_synthetic_symtab in elf64-x86-64.c.
45 CVE-2017-13756 835 2017-08-29 2022-06-20
2.1
 None Local Low Not required None None Partial
In The Sleuth Kit (TSK) 4.4.2, opening a crafted disk image triggers infinite recursion in dos_load_ext_table() in tsk/vs/dos.c in libtskvs.a, as demonstrated by mmls.
46 CVE-2017-13755 119 Overflow 2017-08-29 2022-06-20
2.1
 None Local Low Not required None None Partial
In The Sleuth Kit (TSK) 4.4.2, opening a crafted ISO 9660 image triggers an out-of-bounds read in iso9660_proc_dir() in tsk/fs/iso9660_dent.c in libtskfs.a, as demonstrated by fls.
47 CVE-2017-13753 20 DoS 2017-08-29 2017-08-29
5.0
 None Remote Low Not required None None Partial
There is a reachable assertion abort in the function JPC_NOMINALGAIN() in jpc/jpc_t1cod.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
48 CVE-2017-13752 617 DoS 2017-08-29 2021-02-05
5.0
 None Remote Low Not required None None Partial
There is a reachable assertion abort in the function jpc_dequantize() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
49 CVE-2017-13751 617 DoS 2017-08-29 2021-02-05
5.0
 None Remote Low Not required None None Partial
There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
50 CVE-2017-13750 617 DoS 2017-08-29 2021-02-05
5.0
 None Remote Low Not required None None Partial
There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1296 in JasPer 2.0.12 that will lead to a remote denial of service attack.
Total number of vulnerabilities : 1542   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.