CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2017 (CVSS score >= 5)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-9304 674 DoS 2017-05-31 2019-10-03
5.0
 None Remote Low Not required None None Partial
libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled in the _yr_re_emit function.
2 CVE-2017-9303 20 2017-05-29 2017-06-08
5.8
 None Remote Medium Not required Partial Partial None
Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.
3 CVE-2017-9301 125 DoS 2017-05-29 2017-06-06
6.8
 None Remote Medium Not required Partial Partial Partial
plugins\audio_filter\libmpgatofixed32_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (invalid read and application crash) or possibly have unspecified other impact via a crafted file.
4 CVE-2017-9300 119 DoS Overflow 2017-05-29 2017-11-23
6.8
 None Remote Medium Not required Partial Partial Partial
plugins\codec\libflac_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have unspecified other impact via a crafted FLAC file.
5 CVE-2017-9297 601 2017-05-29 2017-06-08
5.8
 None Remote Medium Not required Partial Partial None
Open Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 allows remote attackers to redirect users to arbitrary web sites.
6 CVE-2017-9296 601 2017-05-29 2017-06-08
5.8
 None Remote Medium Not required Partial Partial None
Open Redirect vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Tuning Manager before 8.5.2-00 allows remote attackers to redirect authenticated users to arbitrary web sites.
7 CVE-2017-9294 Exec Code 2017-05-29 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
RMI vulnerability in Hitachi Device Manager before 8.5.2-01 allows remote attackers to execute internal commands without authentication via RMI ports.
8 CVE-2017-9265 125 2017-05-29 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
In Open vSwitch (OvS) v2.7.0, there is a buffer over-read while parsing the group mod OpenFlow message sent from the controller in `lib/ofp-util.c` in the function `ofputil_pull_ofp15_group_mod`.
9 CVE-2017-9264 125 2017-05-29 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp` that can be triggered remotely.
10 CVE-2017-9250 476 DoS 2017-05-28 2020-10-28
5.0
 None Remote Low Not required None None Partial
The lexer_process_char_literal function in jerry-core/parser/js/js-lexer.c in JerryScript 1.0 does not skip memory allocation for empty strings, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed JavaScript source code, related to the jmem_heap_free_block function.
11 CVE-2017-9232 862 2017-05-28 2019-10-03
10.0
 None Remote Low Not required Complete Complete Complete
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.
12 CVE-2017-9230 338 2017-05-24 2018-06-14
5.0
 None Remote Low Not required Partial None None
** DISPUTED ** The Bitcoin Proof-of-Work algorithm does not consider a certain attack methodology related to 80-byte block headers with a variety of initial 64-byte chunks followed by the same 16-byte chunk, multiple candidate root values ending with the same 4 bytes, and calculations involving sqrt numbers. This violates the security assumptions of (1) the choice of input, outside of the dedicated nonce area, fed into the Proof-of-Work function should not change its difficulty to evaluate and (2) every Proof-of-Work function execution should be independent. NOTE: a number of persons feel that this methodology is a benign mining optimization, not a vulnerability.
13 CVE-2017-9229 476 2017-05-24 2018-05-04
5.0
 None Remote Low Not required None None Partial
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition.
14 CVE-2017-9228 787 Mem. Corr. 2017-05-24 2018-05-04
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption.
15 CVE-2017-9227 125 2017-05-24 2018-05-04
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer.
16 CVE-2017-9226 787 Mem. Corr. 2017-05-24 2018-10-31
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.
17 CVE-2017-9225 787 Overflow 2017-05-24 2017-06-02
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds write in onigenc_unicode_get_case_fold_codes_by_str() occurs during regular expression compilation. Code point 0xFFFFFFFF is not properly handled in unicode_unfold_key(). A malformed regular expression could result in 4 bytes being written off the end of a stack buffer of expand_case_fold_string() during the call to onigenc_unicode_get_case_fold_codes_by_str(), a typical stack buffer overflow.
18 CVE-2017-9224 125 2017-05-24 2018-10-31
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.
19 CVE-2017-9217 476 DoS 2017-05-24 2022-01-31
5.0
 None Remote Low Not required None None Partial
systemd-resolved through 233 allows remote attackers to cause a denial of service (daemon crash) via a crafted DNS response with an empty question section.
20 CVE-2017-9214 191 2017-05-23 2021-08-04
7.5
 None Remote Low Not required Partial Partial Partial
In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integer underflow in the function `ofputil_pull_queue_get_config_reply10` in `lib/ofp-util.c`.
21 CVE-2017-9212 134 2017-05-23 2019-10-03
7.8
 None Remote Low Not required None None Complete
The Bluetooth stack on the BMW 330i 2011 allows a remote crash of the CD/Multimedia software via %x or %c format string specifiers in a device name.
22 CVE-2017-9200 190 2017-05-23 2017-05-28
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:528:63.
23 CVE-2017-9199 190 2017-05-23 2017-05-28
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:192:19.
24 CVE-2017-9198 190 2017-05-23 2017-05-28
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:508:18.
25 CVE-2017-9197 190 2017-05-23 2017-05-28
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:498:55.
26 CVE-2017-9196 190 2017-05-23 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a "negative-size-param" issue in the ReadImage function in input-tga.c:528:7.
27 CVE-2017-9195 125 2017-05-23 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:620:27.
28 CVE-2017-9194 125 2017-05-23 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:559:29.
29 CVE-2017-9193 125 2017-05-23 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:538:33.
30 CVE-2017-9192 119 Overflow 2017-05-23 2017-05-28
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-tga.c:528:7.
31 CVE-2017-9191 119 Overflow 2017-05-23 2017-05-28
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the rle_fread function in input-tga.c:252:15.
32 CVE-2017-9190 416 DoS 2017-05-23 2017-05-28
5.0
 None Remote Low Not required None None Partial
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid free), related to the free_bitmap function in bitmap.c:24:5.
33 CVE-2017-9189 125 DoS 2017-05-23 2017-05-28
5.0
 None Remote Low Not required None None Partial
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and application crash), related to the GET_COLOR function in color.c:16:11.
34 CVE-2017-9188 20 2017-05-23 2017-05-28
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a "left shift ... cannot be represented in type int" issue in input-bmp.c:516:63.
35 CVE-2017-9187 190 2017-05-23 2017-05-28
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:486:7.
36 CVE-2017-9186 190 2017-05-23 2017-05-28
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:326:17.
37 CVE-2017-9185 190 2017-05-23 2017-05-28
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:319:7.
38 CVE-2017-9184 190 2017-05-23 2017-05-28
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:314:7.
39 CVE-2017-9183 704 2017-05-23 2017-05-28
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:309:7.
40 CVE-2017-9182 416 DoS 2017-05-23 2019-03-19
5.0
 None Remote Low Not required None None Partial
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (use-after-free and invalid heap read), related to the GET_COLOR function in color.c:16:11.
41 CVE-2017-9181 787 DoS 2017-05-23 2017-05-28
5.0
 None Remote Low Not required None None Partial
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c.
42 CVE-2017-9180 125 DoS 2017-05-23 2019-03-19
5.0
 None Remote Low Not required None None Partial
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:440:14.
43 CVE-2017-9179 125 DoS 2017-05-23 2017-05-28
5.0
 None Remote Low Not required None None Partial
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:425:14.
44 CVE-2017-9178 787 DoS 2017-05-23 2017-05-28
5.0
 None Remote Low Not required None None Partial
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c:421:11.
45 CVE-2017-9177 125 DoS 2017-05-23 2017-05-28
5.0
 None Remote Low Not required None None Partial
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:390:12.
46 CVE-2017-9176 787 DoS 2017-05-23 2017-05-28
5.0
 None Remote Low Not required None None Partial
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c:370:25.
47 CVE-2017-9175 787 DoS 2017-05-23 2017-05-28
5.0
 None Remote Low Not required None None Partial
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c:353:25.
48 CVE-2017-9174 125 DoS 2017-05-23 2017-05-28
5.0
 None Remote Low Not required None None Partial
libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the GET_COLOR function in color.c:21:23.
49 CVE-2017-9173 119 Overflow 2017-05-23 2017-05-28
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:497:29.
50 CVE-2017-9172 119 Overflow 2017-05-23 2017-05-28
7.5
 None Remote Low Not required Partial Partial Partial
libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:496:29.
Total number of vulnerabilities : 664   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.