CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In March 2017

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
451 CVE-2017-5580 119 DoS Overflow 2017-03-15 2017-07-11
2.1
 None Local Low Not required None None Partial
The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (out-of-bounds array access and process crash) via a crafted texture instruction.
452 CVE-2017-5579 401 DoS 2017-03-15 2020-11-10
4.9
 None Local Low Not required None None Complete
Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
453 CVE-2017-5578 401 DoS 2017-03-15 2020-11-10
4.9
 None Local Low Not required None None Complete
Memory leak in the virtio_gpu_resource_attach_backing function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
454 CVE-2017-5571 601 2017-03-03 2018-05-30
5.8
 None Remote Medium Not required Partial Partial None
Open redirect vulnerability in the lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) 11.14.1 and earlier, as used in Citrix License Server for Windows and the Citrix License Server VPX, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
455 CVE-2017-5567 427 Exec Code Bypass 2017-03-21 2019-10-03
7.2
 None Local Low Not required Complete Complete Complete
Code injection vulnerability in Avast Premier 12.3 (and earlier), Internet Security 12.3 (and earlier), Pro Antivirus 12.3 (and earlier), and Free Antivirus 12.3 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Avast process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.
456 CVE-2017-5566 427 Exec Code Bypass 2017-03-21 2019-10-03
7.2
 None Local Low Not required Complete Complete Complete
Code injection vulnerability in AVG Ultimate 17.1 (and earlier), AVG Internet Security 17.1 (and earlier), and AVG AntiVirus FREE 17.1 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any AVG process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.
457 CVE-2017-5565 427 Exec Code Bypass 2017-03-21 2019-10-03
7.2
 None Local Low Not required Complete Complete Complete
Code injection vulnerability in Trend Micro Maximum Security 11.0 (and earlier), Internet Security 11.0 (and earlier), and Antivirus+ Security 11.0 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Trend Micro process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.
458 CVE-2017-5552 401 DoS 2017-03-15 2020-11-10
4.9
 None Local Low Not required None None Complete
Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
459 CVE-2017-5538 125 2017-03-23 2017-03-28
10.0
 None Remote Low Not required Complete Complete Complete
The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core_linux.c in the GPU driver on Samsung devices with M(6.0) and N(7.0) software and Exynos AP chipsets allows attackers to have unspecified impact via unknown vectors, which trigger an out-of-bounds read, aka SVE-2016-6362.
460 CVE-2017-5537 200 +Info 2017-03-15 2017-03-21
5.0
 None Remote Low Not required Partial None None
The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.
461 CVE-2017-5526 401 DoS 2017-03-15 2020-11-10
4.9
 None Local Low Not required None None Complete
Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
462 CVE-2017-5525 401 DoS 2017-03-15 2020-11-10
4.9
 None Local Low Not required None None Complete
Memory leak in hw/audio/ac97.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
463 CVE-2017-5524 134 Bypass +Info 2017-03-23 2019-10-03
4.0
 None Remote Low ??? Partial None None
Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.
464 CVE-2017-5522 119 DoS Exec Code Overflow 2017-03-15 2021-06-07
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
465 CVE-2017-5511 119 Overflow 2017-03-24 2017-11-04
7.5
 None Remote Low Not required Partial Partial Partial
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact by leveraging an improper cast, which triggers a heap-based buffer overflow.
466 CVE-2017-5510 787 2017-03-24 2020-10-28
6.8
 None Remote Medium Not required Partial Partial Partial
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.
467 CVE-2017-5509 787 2017-03-24 2020-10-28
6.8
 None Remote Medium Not required Partial Partial Partial
coders/psd.c in ImageMagick allows remote attackers to have unspecified impact via a crafted PSD file, which triggers an out-of-bounds write.
468 CVE-2017-5508 119 DoS Overflow 2017-03-24 2017-11-04
4.3
 None Remote Medium Not required None None Partial
Heap-based buffer overflow in the PushQuantumPixel function in ImageMagick before 6.9.7-3 and 7.x before 7.0.4-3 allows remote attackers to cause a denial of service (application crash) via a crafted TIFF file.
469 CVE-2017-5507 772 DoS 2017-03-24 2020-10-15
7.8
 None Remote Low Not required None None Complete
Memory leak in coders/mpc.c in ImageMagick before 6.9.7-4 and 7.x before 7.0.4-4 allows remote attackers to cause a denial of service (memory consumption) via vectors involving a pixel cache.
470 CVE-2017-5506 415 2017-03-24 2020-10-15
6.8
 None Remote Medium Not required Partial Partial Partial
Double free vulnerability in magick/profile.c in ImageMagick allows remote attackers to have unspecified impact via a crafted file.
471 CVE-2017-5505 119 DoS Overflow 2017-03-16 2020-09-25
4.3
 None Remote Medium Not required None None Partial
The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
472 CVE-2017-5504 125 DoS 2017-03-01 2020-09-25
4.3
 None Remote Medium Not required None None Partial
The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
473 CVE-2017-5503 787 DoS 2017-03-01 2020-09-25
4.3
 None Remote Medium Not required None None Partial
The dec_clnpass function in libjasper/jpc/jpc_t1dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via a crafted image.
474 CVE-2017-5502 DoS 2017-03-01 2019-10-03
4.3
 None Remote Medium Not required None None Partial
libjasper/jp2/jp2_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
475 CVE-2017-5501 190 DoS Overflow 2017-03-01 2017-03-03
4.3
 None Remote Medium Not required None None Partial
Integer overflow in libjasper/jpc/jpc_tsfb.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted file.
476 CVE-2017-5500 DoS 2017-03-01 2019-10-03
4.3
 None Remote Medium Not required None None Partial
libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
477 CVE-2017-5499 190 DoS Overflow 2017-03-01 2020-09-25
4.3
 None Remote Medium Not required None None Partial
Integer overflow in libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted file.
478 CVE-2017-5498 DoS 2017-03-01 2019-10-03
4.3
 None Remote Medium Not required None None Partial
libjasper/include/jasper/jas_math.h in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
479 CVE-2017-5496 200 +Info 2017-03-15 2017-09-01
5.0
 None Remote Low Not required Partial None None
Sawmill Enterprise 8.7.9 allows remote attackers to gain login access by leveraging knowledge of a password hash.
480 CVE-2017-5359 20 DoS 2017-03-15 2018-10-09
5.0
 None Remote Low Not required None None Partial
EasyCom SQL iPlug allows remote attackers to cause a denial of service via the D$EVAL parameter to the default URI.
481 CVE-2017-5358 119 Exec Code Overflow 2017-03-15 2017-03-21
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflows in php_Easycom5_3_0.dll in EasyCom for PHP 4.0.0.29 allows remote attackers to execute arbitrary code via the server argument to the (1) i5_connect, (2) i5_pconnect, or (3) i5_private_connect API function.
482 CVE-2017-5356 125 DoS 2017-03-03 2019-03-15
5.0
 None Remote Low Not required None None Partial
Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).
483 CVE-2017-5337 119 Overflow 2017-03-24 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.
484 CVE-2017-5336 119 Overflow 2017-03-24 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.
485 CVE-2017-5335 125 DoS 2017-03-24 2018-10-30
5.0
 None Remote Low Not required None None Partial
The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.
486 CVE-2017-5334 415 2017-03-24 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.
487 CVE-2017-5330 78 Exec Code 2017-03-27 2017-03-31
6.8
 None Remote Medium Not required Partial Partial Partial
ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications.
488 CVE-2017-5239 326 2017-03-27 2017-03-31
5.0
 None Remote Low Not required Partial None None
Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS Tracker discloses personally identifying information, such as GPS data and IMEI numbers, to any man-in-the-middle (MitM) listener.
489 CVE-2017-5238 119 Overflow 2017-03-27 2017-03-31
5.0
 None Remote Low Not required None Partial None
Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variable to another, overwriting the data of another field.
490 CVE-2017-5237 287 2017-03-27 2017-03-31
7.8
 None Remote Low Not required None None Complete
Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a factory default configuration with an SMS command, "RESET!"
491 CVE-2017-5235 426 2017-03-02 2017-03-07
6.8
 None Remote Medium Not required Partial Partial Partial
Rapid7 Metasploit Pro installers prior to version 4.13.0-2017022101 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer.
492 CVE-2017-5234 426 2017-03-02 2017-03-07
6.8
 None Remote Medium Not required Partial Partial Partial
Rapid7 Insight Collector installers prior to version 1.0.16 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer.
493 CVE-2017-5233 426 2017-03-02 2021-01-08
6.8
 None Remote Medium Not required Partial Partial Partial
Rapid7 AppSpider Pro installers prior to version 6.14.053 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer.
494 CVE-2017-5232 426 2017-03-02 2017-03-21
6.8
 None Remote Medium Not required Partial Partial Partial
All editions of Rapid7 Nexpose installers prior to version 6.4.24 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer.
495 CVE-2017-5231 22 Dir. Trav. 2017-03-02 2017-03-21
5.1
 None Remote High Not required Partial Partial Partial
All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cmd_download() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance.
496 CVE-2017-5230 798 2017-03-02 2017-08-15
6.5
 None Remote Low ??? Partial Partial Partial
The Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is encrypted with a static password of 'r@p1d7k3y5t0r3' which is not modifiable by the user. The keystore provides storage for saved scan credentials in an otherwise secure location on disk.
497 CVE-2017-5229 22 Dir. Trav. 2017-03-02 2017-03-21
5.1
 None Remote High Not required Partial Partial Partial
All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi Clipboard.parse_dump() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance.
498 CVE-2017-5228 22 Dir. Trav. 2017-03-02 2017-03-21
5.1
 None Remote High Not required Partial Partial Partial
All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download() function. By using a specially-crafted build of Meterpreter, it is possible to write to an arbitrary directory on the Metasploit console with the permissions of the running Metasploit instance.
499 CVE-2017-5227 200 +Info 2017-03-23 2017-08-16
5.0
 None Remote Low Not required Partial None None
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file.
500 CVE-2017-5226 20 2017-03-29 2020-07-10
7.5
 None Remote Low Not required Partial Partial Partial
When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
Total number of vulnerabilities : 1305   Page : 1 2 3 4 5 6 7 8 9 10 (This Page)11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.