CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2017 (CVSS score >= 4)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-9307 918 2017-05-31 2017-06-09
4.0
 None Remote Low ??? Partial None None
SSRF vulnerability in remotedownload.php in Allen Disk 1.6 allows remote authenticated users to conduct port scans and access intranet servers via a crafted file parameter.
2 CVE-2017-9306 79 XSS Bypass 2017-05-31 2017-06-09
4.3
 None Remote Medium Not required None Partial None
inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of an "<svg/onload=" substring instead of an "<svg onload=" substring.
3 CVE-2017-9305 79 XSS Bypass 2017-05-31 2017-06-08
4.3
 None Remote Medium Not required None Partial None
lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batch_send_newsletter.php.
4 CVE-2017-9304 674 DoS 2017-05-31 2019-10-03
5.0
 None Remote Low Not required None None Partial
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled in the _yr_re_emit function.
5 CVE-2017-9303 20 2017-05-29 2017-06-08
5.8
 None Remote Medium Not required Partial Partial None
Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.
6 CVE-2017-9302 369 DoS 2017-05-29 2017-06-08
4.3
 None Remote Medium Not required None None Partial
RealPlayer 16.0.2.32 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted mp4 file.
7 CVE-2017-9301 125 DoS 2017-05-29 2017-06-06
6.8
 None Remote Medium Not required Partial Partial Partial
plugins\audio_filter\libmpgatofixed32_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (invalid read and application crash) or possibly have unspecified other impact via a crafted file.
8 CVE-2017-9300 119 DoS Overflow 2017-05-29 2017-11-23
6.8
 None Remote Medium Not required Partial Partial Partial
plugins\codec\libflac_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted FLAC file.
9 CVE-2017-9299 79 XSS 2017-05-29 2017-11-24
4.3
 None Remote Medium Not required None Partial None
Open Ticket Request System (OTRS) 3.3.9 has XSS in index.pl?Action=AgentStats requests, as demonstrated by OrderBy=[XSS] and Direction=[XSS] attacks. NOTE: this CVE may have limited relevance because it represents a 2017 discovery of an issue in software from 2014. The 3.3.20 release, for example, is not affected.
10 CVE-2017-9297 601 2017-05-29 2017-06-08
5.8
 None Remote Medium Not required Partial Partial None
Open Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 allows remote attackers to redirect users to arbitrary web sites.
11 CVE-2017-9296 601 2017-05-29 2017-06-08
5.8
 None Remote Medium Not required Partial Partial None
Open Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Tuning Manager before 8.5.2-00 allows remote attackers to redirect authenticated users to arbitrary web sites.
12 CVE-2017-9295 611 2017-05-29 2017-06-08
4.0
 None Remote Low ??? Partial None None
XXE vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Replication Manager before 8.5.2-00 allows authenticated remote users to read arbitrary files.
13 CVE-2017-9294 Exec Code 2017-05-29 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
RMI vulnerability in Hitachi Device Manager before 8.5.2-01 allows remote attackers to execute internal commands without authentication via RMI ports.
14 CVE-2017-9292 79 XSS 2017-05-29 2017-10-05
4.3
 None Remote Medium Not required None Partial None
Lansweeper before 6.0.0.65 has XSS in an image retrieval URI, aka Bug 542782.
15 CVE-2017-9289 79 XSS 2017-05-29 2017-06-08
4.3
 None Remote Medium Not required None Partial None
Bram Korsten Note through 1.2.0 is vulnerable to a reflected XSS in note-source\ui\editor.php (edit parameter).
16 CVE-2017-9288 79 XSS 2017-05-29 2017-07-17
4.3
 None Remote Medium Not required None Partial None
The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter).
17 CVE-2017-9287 415 2017-05-29 2022-06-13
4.0
 None Remote Low ??? None None Partial
servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged Results control with a page size of 0.
18 CVE-2017-9265 125 2017-05-29 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
In Open vSwitch (OvS) v2.7.0, there is a buffer over-read while parsing the group mod OpenFlow message sent from the controller in `lib/ofp-util.c` in the function `ofputil_pull_ofp15_group_mod`.
19 CVE-2017-9264 125 2017-05-29 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp` that can be triggered remotely.
20 CVE-2017-9262 772 DoS 2017-05-29 2019-10-03
4.3
 None Remote Medium Not required None None Partial
In ImageMagick 7.0.5-6 Q16, the ReadJNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a crafted file.
21 CVE-2017-9261 772 DoS 2017-05-29 2019-10-03
4.3
 None Remote Medium Not required None None Partial
In ImageMagick 7.0.5-6 Q16, the ReadMNGImage function in coders/png.c allows attackers to cause a denial of service (memory leak) via a crafted file.
22 CVE-2017-9252 79 XSS 2017-05-28 2017-06-08
4.3
 None Remote Medium Not required None Partial None
andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action.
23 CVE-2017-9251 79 XSS 2017-05-28 2017-06-08
4.3
 None Remote Medium Not required None Partial None
andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter to admin.php.
24 CVE-2017-9250 476 DoS 2017-05-28 2020-10-28
5.0
 None Remote Low Not required None None Partial
The lexer_process_char_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty strings, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed JavaScript source code, related to the jmem_heap_free_block function.
25 CVE-2017-9243 79 XSS 2017-05-28 2017-06-08
4.3
 None Remote Medium Not required None Partial None
Aries QWR-1104 Wireless-N Router with Firmware Version WRC.253.2.0913 has XSS on the Wireless Site Survey page, exploitable with the name of an access point.
26 CVE-2017-9242 20 DoS 2017-05-27 2018-01-05
4.9
 None Local Low Not required None None Complete
The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel through 4.11.3 is too late in checking whether an overwrite of an skb data structure may occur, which allows local users to cause a denial of service (system crash) via crafted system calls.
27 CVE-2017-9239 369 2017-05-26 2020-04-09
4.3
 None Remote Medium Not required None None Partial
An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value of pValue() to cause a segmentation fault. To exploit this vulnerability, someone must open a crafted tiff file.
28 CVE-2017-9232 862 2017-05-28 2019-10-03
10.0
 None Remote Low Not required Complete Complete Complete
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.
29 CVE-2017-9230 338 2017-05-24 2018-06-14
5.0
 None Remote Low Not required Partial None None
** DISPUTED ** The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology related to 80-byte block headers with a variety of initial 64-byte chunks followed by the same 16-byte chunk, multiple candidate root values ending with the same 4 bytes, and calculations involving sqrt numbers. This violates the security assumptions of (1) the choice of input, outside of the dedicated nonce area, fed into the Proof-of-Work function should not change its difficulty to evaluate and (2) every Proof-of-Work function execution should be independent. NOTE: a number of persons feel that this methodology is a benign mining optimization, not a vulnerability.
30 CVE-2017-9229 476 2017-05-24 2018-05-04
5.0
 None Remote Low Not required None None Partial
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition.
31 CVE-2017-9228 787 Mem. Corr. 2017-05-24 2022-07-20
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption.
32 CVE-2017-9227 125 2017-05-24 2022-07-20
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.
33 CVE-2017-9226 787 Mem. Corr. 2017-05-24 2022-07-20
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.
34 CVE-2017-9225 787 Overflow 2017-05-24 2017-06-02
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicode_unfold_key(). A malformed regular expression could result in 4 bytes being written off the end of a stack buffer of expand_case_fold_string() during the call to onigenc_unicode_get_case_fold_codes_by_str(), a typical stack buffer overflow.
35 CVE-2017-9224 125 2017-05-24 2022-07-20
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.
36 CVE-2017-9217 476 DoS 2017-05-24 2022-01-31
5.0
 None Remote Low Not required None None Partial
systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS response with an empty question section.
37 CVE-2017-9216 476 2017-05-24 2021-11-02
4.3
 None Remote Medium Not required None None Partial
libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example, the jbig2dec utility will crash (segmentation fault) when parsing an invalid file.
38 CVE-2017-9214 191 2017-05-23 2021-08-04
7.5
 None Remote Low Not required Partial Partial Partial
In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integer underflow in the function `ofputil_pull_queue_get_config_reply10` in `lib/ofp-util.c`.
39 CVE-2017-9212 134 2017-05-23 2019-10-03
7.8
 None Remote Low Not required None None Complete
The Bluetooth stack on the BMW 330i 2011 allows a remote crash of the CD/Multimedia software via %x or %c format string specifiers in a device name.
40 CVE-2017-9211 476 DoS 2017-05-23 2017-06-08
4.9
 None Local Low Not required None None Complete
The crypto_skcipher_init_tfm function in crypto/skcipher.c in the Linux kernel through 4.11.2 relies on a setkey function that lacks a key-size check, which allows local users to cause a denial of service (NULL pointer dereference) via a crafted application.
41 CVE-2017-9210 835 DoS 2017-05-23 2019-10-03
4.3
 None Remote Medium Not required None None Partial
libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to unparse functions, aka qpdf-infiniteloop3.
42 CVE-2017-9209 835 DoS 2017-05-23 2019-10-03
4.3
 None Remote Medium Not required None None Partial
libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to QPDFObjectHandle::parseInternal, aka qpdf-infiniteloop2.
43 CVE-2017-9208 835 DoS 2017-05-23 2019-10-03
4.3
 None Remote Medium Not required None None Partial
libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to releaseResolved functions, aka qpdf-infiniteloop1.
44 CVE-2017-9207 125 DoS 2017-05-23 2019-10-03
4.3
 None Remote Medium Not required None None Partial
The iw_get_ui16be function in imagew-util.c:422:24 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image, related to imagew-jpeg.c.
45 CVE-2017-9206 125 DoS 2017-05-23 2019-10-03
4.3
 None Remote Medium Not required None None Partial
The iw_get_ui16le function in imagew-util.c:405:23 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image, related to imagew-jpeg.c.
46 CVE-2017-9205 125 DoS 2017-05-23 2019-09-16
4.3
 None Remote Medium Not required None None Partial
The iw_get_ui16be function in imagew-util.c:422:24 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (invalid read and SEGV) via a crafted image, related to imagew-jpeg.c.
47 CVE-2017-9204 125 DoS 2017-05-23 2019-09-16
4.3
 None Remote Medium Not required None None Partial
The iw_get_ui16le function in imagew-util.c:405:23 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (invalid read and SEGV) via a crafted image, related to imagew-jpeg.c.
48 CVE-2017-9203 787 DoS 2017-05-23 2019-10-03
4.3
 None Remote Medium Not required None None Partial
imagew-main.c:960:12 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (buffer underflow) via a crafted image, related to imagew-bmp.c.
49 CVE-2017-9202 369 DoS 2017-05-23 2019-09-16
4.3
 None Remote Medium Not required None None Partial
imagew-cmd.c:854:45 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted image, related to imagew-api.c.
50 CVE-2017-9201 369 DoS 2017-05-23 2019-09-16
4.3
 None Remote Medium Not required None None Partial
imagew-cmd.c:850:46 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted image, related to imagew-api.c.
Total number of vulnerabilities : 932   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.