CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2017 (CVSS score >= 7)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-14076 89 Sql 2017-08-31 2017-09-05
7.5
 None Remote Low Not required Partial Partial Partial
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.
2 CVE-2017-14069 89 Sql 2017-08-31 2017-09-07
7.5
 None Remote Low Not required Partial Partial Partial
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.
3 CVE-2017-14064 119 Overflow 2017-08-31 2019-05-13
7.5
 None Remote Low Not required Partial Partial Partial
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.
4 CVE-2017-14062 190 DoS Overflow 2017-08-31 2020-12-07
7.5
 None Remote Low Not required Partial Partial Partial
Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
5 CVE-2017-14061 190 DoS Overflow 2017-08-31 2019-10-21
7.5
 None Remote Low Not required Partial Partial Partial
Integer overflow in the _isBidi function in bidi.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
6 CVE-2017-14059 834 2017-08-31 2019-10-03
7.1
 None Remote Medium Not required None None Complete
In FFmpeg 3.3.3, a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption. When a crafted CINE file, which claims a large "duration" field in the header but does not contain sufficient backing data, is provided, the image-offset parsing loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
7 CVE-2017-14057 834 2017-08-31 2019-10-03
7.1
 None Remote Medium Not required None None Complete
In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large "name_len" or "count" field in the header but does not contain sufficient backing data, is provided, the loops over the name and markers would consume huge CPU and memory resources, since there is no EOF check inside these loops.
8 CVE-2017-14056 834 2017-08-31 2019-10-03
7.1
 None Remote Medium Not required None None Complete
In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted RL2 file, which claims a large "frame_count" field in the header but does not contain sufficient backing data, is provided, the loops (for offset and size tables) would consume huge CPU and memory resources, since there is no EOF check inside these loops.
9 CVE-2017-14055 834 2017-08-31 2019-10-03
7.1
 None Remote Medium Not required None None Complete
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
10 CVE-2017-14054 834 2017-08-31 2019-10-03
7.1
 None Remote Medium Not required None None Complete
In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted IVR file, which claims a large "len" field in the header but does not contain sufficient backing data, is provided, the first type==4 loop would consume huge CPU resources, since there is no EOF check inside the loop.
11 CVE-2017-14035 502 2017-08-30 2017-09-01
7.5
 None Remote Low Not required Partial Partial Partial
CrushFTP 8.x before 8.2.0 has a serialization vulnerability.
12 CVE-2017-13777 834 DoS 2017-08-30 2019-12-16
7.1
 None Remote Medium Not required None None Complete
GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version==10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it.
13 CVE-2017-13776 834 DoS 2017-08-30 2019-12-16
7.1
 None Remote Medium Not required None None Complete
GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version!=10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it.
14 CVE-2017-13775 DoS 2017-08-30 2019-10-03
7.1
 None Remote Medium Not required None None Complete
GraphicsMagick 1.3.26 has a denial of service issue in ReadJNXImage() in coders/jnx.c whereby large amounts of CPU and memory resources may be consumed although the file itself does not support the requests.
15 CVE-2017-13767 20 2017-08-30 2019-10-03
7.8
 None Remote Low Not required None None Complete
In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSDP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-msdp.c by adding length validation.
16 CVE-2017-13716 770 DoS 2017-08-28 2019-10-03
7.1
 None Remote Medium Not required None None Complete
The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).
17 CVE-2017-13715 665 DoS Exec Code 2017-08-29 2022-01-31
10.0
 None Remote Low Not required Complete Complete Complete
The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto, ip_proto, and thoff are initialized, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a single crafted MPLS packet.
18 CVE-2017-13708 119 Exec Code Overflow 2017-08-31 2017-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the web server service in VX Search Enterprise 10.0.14 allows remote attackers to execute arbitrary code via a crafted GET request.
19 CVE-2017-13707 269 Exec Code +Priv 2017-08-27 2020-05-28
10.0
 None Remote Low Not required Complete Complete Complete
Privilege escalation in Replibit Backup Manager earlier than version 2017.08.04 allows attackers to gain root privileges via sudo command execution. The vi program can be accessed through sudo, in order to navigate the filesystem and modify a critical file such as /etc/passwd.
20 CVE-2017-13686 476 DoS 2017-08-24 2017-08-30
7.2
 None Local Low Not required Complete Complete Complete
net/ipv4/route.c in the Linux kernel 4.13-rc1 through 4.13-rc6 is too late to check for a NULL fi field when RTM_F_FIB_MATCH is set, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via crafted system calls. NOTE: this does not affect any stable release.
21 CVE-2017-13669 89 Sql 2017-08-24 2017-08-28
7.5
 None Remote Low Not required Partial Partial Partial
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
22 CVE-2017-13139 125 2017-08-23 2020-10-14
7.5
 None Remote Low Not required Partial Partial Partial
In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an out-of-bounds read with the MNG CLIP chunk.
23 CVE-2017-13137 89 Sql 2017-08-23 2021-09-10
7.5
 None Remote Low Not required Partial Partial Partial
The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php.
24 CVE-2017-13133 770 DoS 2017-08-23 2020-09-08
7.1
 None Remote Medium Not required None None Complete
In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file.
25 CVE-2017-13130 427 +Priv 2017-08-23 2019-10-03
7.2
 None Local Low Not required Complete Complete Complete
mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the RPATH variable begins with the .: substring.
26 CVE-2017-12981 89 Sql 2017-08-21 2017-08-25
7.5
 None Remote Low Not required Partial Partial Partial
NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an addforum action.
27 CVE-2017-12965 384 2017-08-23 2019-05-06
7.5
 None Remote Low Not required Partial Partial Partial
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
28 CVE-2017-12964 674 DoS 2017-08-18 2019-10-03
7.8
 None Remote Low Not required None None Complete
There is a stack consumption issue in LibSass 3.4.5 that is triggered in the function Sass::Eval::operator() in eval.cpp. It will lead to a remote denial of service attack.
29 CVE-2017-12942 119 Overflow 2017-08-18 2018-06-16
7.5
 None Remote Low Not required Partial Partial Partial
libunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ function.
30 CVE-2017-12941 125 2017-08-18 2018-06-16
7.5
 None Remote Low Not required Partial Partial Partial
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function.
31 CVE-2017-12940 125 2017-08-18 2018-06-16
7.5
 None Remote Low Not required Partial Partial Partial
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the Archive::ReadHeader15 function.
32 CVE-2017-12939 20 Exec Code 2017-08-18 2017-09-13
7.5
 None Remote Low Not required Partial Partial Partial
A Remote Code Execution vulnerability was identified in all Windows versions of Unity Editor, e.g., before 5.3.8p2, 5.4.x before 5.4.5p5, 5.5.x before 5.5.4p3, 5.6.x before 5.6.3p1, and 2017.x before 2017.1.0p4.
33 CVE-2017-12933 125 2017-08-18 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
34 CVE-2017-12932 416 2017-08-18 2018-05-04
7.5
 None Remote Low Not required Partial Partial Partial
ext/standard/var_unserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free while unserializing untrusted data, related to improper use of the hash API for key deletion in a situation with an invalid array size. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
35 CVE-2017-12910 89 Exec Code Sql 2017-08-17 2017-08-20
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in massmail.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the or parameter.
36 CVE-2017-12909 89 Exec Code Sql 2017-08-17 2017-08-20
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter.
37 CVE-2017-12908 89 Exec Code Sql 2017-08-17 2017-08-20
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the conusr parameter.
38 CVE-2017-12904 943 Exec Code 2017-08-23 2020-10-21
9.3
 None Remote Medium Not required Complete Complete Complete
Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.
39 CVE-2017-12875 770 DoS 2017-08-29 2020-09-08
7.1
 None Remote Medium Not required None None Complete
The WritePixelCachePixels function in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (CPU consumption) via a crafted file.
40 CVE-2017-12865 119 DoS Exec Code Overflow 2017-08-29 2020-03-05
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the "name" variable.
41 CVE-2017-12858 415 2017-08-23 2022-05-25
7.5
 None Remote Low Not required Partial Partial Partial
Double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to have unspecified impact via unknown vectors.
42 CVE-2017-12840 119 Overflow 2017-08-28 2017-09-08
7.2
 None Local Low Not required Complete Complete Complete
A kernel driver, namely DLMFENC.sys, bundled with the DESLock+ client application 4.8.16 and earlier contains a locally exploitable heap based buffer overflow in the handling of an IOCTL message of type 0x0FA4204. The vulnerability is present due to the kernel driver failing to allocate sufficient memory on the kernel heap to contain a user supplied string as such the string is copied into a buffer of constant size (0x1000-bytes) and thus an overflow condition results. Access to the kernel driver is permitted through an obfuscated interface whereby bytes of user supplied message are "authenticated" via an obfuscation routine employing a linear equation.
43 CVE-2017-12816 732 2017-08-25 2021-06-17
7.5
 None Remote Low Not required Partial Partial Partial
In Kaspersky Internet Security for Android 11.12.4.1622, some of application exports activities have weak permissions, which might be used by a malware application to get unauthorized access to the product functionality by using Android IPC.
44 CVE-2017-12791 22 Dir. Trav. 2017-08-23 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.
45 CVE-2017-12787 119 Exec Code Overflow +Priv 2017-08-22 2017-08-29
10.0
 None Remote Low Not required Complete Complete Complete
A network interface of the novi_process_manager_daemon service, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, can be inadvertently exposed if an operator attempts to modify ACLs, because of a bug when ACL modifications are applied. This could be leveraged by remote, unauthenticated attackers to gain resultant privileged (root) code execution on the switch, because incoming packet data can contain embedded OS commands, and can also trigger a stack-based buffer overflow.
46 CVE-2017-12786 119 Exec Code Overflow +Priv 2017-08-22 2017-08-29
10.0
 None Remote Low Not required Complete Complete Complete
Network interfaces of the cliengine and noviengine services, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, can be inadvertently exposed if an operator attempts to modify ACLs, because of a bug when ACL modifications are applied. This could be leveraged by remote, unauthenticated attackers to gain resultant privileged (root) code execution on the switch, because there is a stack-based buffer overflow during unserialization of packet data.
47 CVE-2017-12785 119 Exec Code Overflow +Priv 2017-08-22 2017-08-29
10.0
 None Remote Low Not required Complete Complete Complete
The novish command-line interface, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, is prone to a buffer overflow in the "show log cli" command. This could be used by a read-only user (monitor role) to gain privileged (root) code execution on the switch via command injection.
48 CVE-2017-12776 89 Exec Code Sql 2017-08-18 2017-09-19
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport parameter.
49 CVE-2017-12774 89 Sql 2017-08-09 2017-08-24
7.5
 None Remote Low Not required Partial Partial Partial
finecms in 1.9.5\controllers\member\ContentController.php allows remote attackers to operate website database
50 CVE-2017-12763 276 +Priv 2017-08-29 2019-10-03
9.0
 None Remote Low ??? Complete Complete Complete
An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files.
Total number of vulnerabilities : 429   Page : 1 (This Page)2 3 4 5 6 7 8 9
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.