CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In July 2017

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
751 CVE-2017-8502 119 Exec Code Overflow Mem. Corr. 2017-07-11 2017-07-14
9.3
 None Remote Medium Not required Complete Complete Complete
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8501.
752 CVE-2017-8501 119 Exec Code Overflow Mem. Corr. 2017-07-11 2017-07-14
9.3
 None Remote Medium Not required Complete Complete Complete
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8502.
753 CVE-2017-8495 287 Bypass 2017-07-11 2017-07-17
6.0
 None Remote Medium ??? Partial Partial Partial
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to bypass Extended Protection for Authentication when Kerberos fails to prevent tampering with the SNAME field during ticket exchange, aka "Kerberos SNAME Security Feature Bypass Vulnerability" or Orpheus' Lyre.
754 CVE-2017-8486 200 +Info 2017-07-11 2017-07-17
1.9
 None Local Medium Not required Partial None None
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure due to the way it handles objects in memory, aka "Win32k Information Disclosure Vulnerability".
755 CVE-2017-8467 281 2017-07-11 2019-10-03
6.9
 None Local Medium Not required Complete Complete Complete
Graphics in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an elevation of privilege vulnerability due to the way it handles objects in memory, aka "Win32k Elevation of Privilege Vulnerability".
756 CVE-2017-8463 Exec Code 2017-07-11 2019-10-03
9.3
 None Remote Medium Not required Complete Complete Complete
Windows Shell in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability due to the way it improperly handles executable files and shares during rename operations, aka "Windows Explorer Remote Code Execution Vulnerability".
757 CVE-2017-8442 200 +Info 2017-07-07 2019-10-09
4.0
 None Remote Low ??? Partial None None
Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and passphrases of SSL keys that were configured as part of an authentication realm. This could allow an authenticated Elasticsearch user to improperly view these details.
758 CVE-2017-8420 119 Overflow 2017-07-05 2017-07-13
4.3
 None Remote Medium Not required None None Partial
SWFTools 2013-04-09-1007 on Windows has a "Data from Faulting Address controls Branch Selection starting at image00000000_00400000+0x0000000000003e71" issue. This issue can be triggered by a malformed TTF file that is mishandled by font2swf. Attackers could exploit this issue for DoS (Access Violation).
759 CVE-2017-8387 119 Exec Code Overflow 2017-07-05 2017-07-14
4.3
 None Remote Medium Not required None None Partial
STDU Viewer version 1.6.375 might allow user-assisted attackers to execute code via a crafted file. One threat model is a victim who obtains an untrusted crafted file from a remote location and issues several user-defined commands including Ctrl-+ commands.
760 CVE-2017-8381 119 Exec Code Overflow 2017-07-05 2017-07-10
6.8
 None Remote Medium Not required Partial Partial Partial
XnView Classic for Windows Version 2.40 allows user-assisted remote attackers to execute code via a crafted .mkv file that is mishandled during the opening of a directory in "Browser" mode, because of a "User Mode Write AV near NULL" in XnView.exe.
761 CVE-2017-8370 119 DoS Exec Code Overflow 2017-07-05 2017-07-13
6.8
 None Remote Medium Not required Partial Partial Partial
IrfanView version 4.44 (32bit) with FPX Plugin 4.45 allows remote attackers to execute arbitrary code or cause a denial of service (Heap Corruption and application crash) in processing a FlashPix (.FPX) file, a different vulnerability than CVE-2017-7721.
762 CVE-2017-8369 119 Exec Code Overflow 2017-07-05 2017-07-13
6.8
 None Remote Medium Not required Partial Partial Partial
IrfanView version 4.44 (32bit) has a "Data from Faulting Address controls Branch Selection starting at USER32!wvsprintfA+0x00000000000002f3" issue, which might allow attackers to execute arbitrary code via a crafted file.
763 CVE-2017-8368 119 DoS Overflow 2017-07-05 2017-12-05
6.8
 None Remote Medium Not required Partial Partial Partial
Sublime Text 3 Build 3126 allows user-assisted attackers to cause a denial of service or possibly have unspecified other impact via a crafted .mkv file. One threat model is a victim who obtains an untrusted crafted file from a remote location and issues several user-defined commands, as demonstrated by Ctrl-A, Delete, and Ctrl-Z.
764 CVE-2017-8290 119 Overflow 2017-07-06 2017-07-12
5.0
 None Remote Low Not required None None Partial
A potential Buffer Overflow Vulnerability (from a BB Code handling issue) has been identified in TeamSpeak Server version 3.0.13.6 (08/11/2016 09:48:33), it enables the users to Crash any WINDOWS Client that clicked into a Vulnerable Channel of a TeamSpeak Server.
765 CVE-2017-8282 119 Exec Code Overflow 2017-07-05 2017-07-10
6.8
 None Remote Medium Not required Partial Partial Partial
XnView Classic for Windows Version 2.40 allows user-assisted remote attackers to execute code via a crafted .mov file that is mishandled during the opening of a directory in "Browser" mode, because of a "User Mode Write AV near NULL" in XnView.exe.
766 CVE-2017-8116 78 Exec Code 2017-07-03 2019-10-03
10.0
 None Remote Low Not required Complete Complete Complete
The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands with root privileges via shell metacharacters in the username parameter in a login request.
767 CVE-2017-8036 Exec Code 2017-07-24 2022-02-09
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release version 1.33.0 (only). The original fix for CVE-2017-8033 included in CAPI-release 1.33.0 introduces a regression that allows a space developer to execute arbitrary code on the Cloud Controller VM by pushing a specially crafted application.
768 CVE-2017-8035 200 +Info 2017-07-25 2022-02-09
5.0
 None Remote Low Not required Partial None None
An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and cf-release versions after v244 and prior to v268. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation.
769 CVE-2017-8034 565 2017-07-17 2019-10-03
6.0
 None Remote Medium ??? Partial Partial Partial
The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens (JWTs) from UAA. With certain multi-zone UAA configurations, zone administrators are able to escalate their privileges.
770 CVE-2017-8033 22 Dir. Trav. 2017-07-25 2022-02-09
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268. A filesystem traversal vulnerability exists in the Cloud Controller that allows a space developer to escalate privileges by pushing a specially crafted application that can write arbitrary files to the Cloud Controller VM.
771 CVE-2017-8032 269 2017-07-10 2021-08-06
6.0
 None Remote Medium ??? Partial Partial Partial
In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to v4.4.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.17, 24.x versions prior to v24.12. 30.x versions prior to 30.5, and other versions prior to v41, zone administrators are allowed to escalate their privileges when mapping permissions for an external provider.
772 CVE-2017-8011 798 2017-07-17 2021-09-13
10.0
 None Remote Low Not required Complete Complete Complete
EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R (Watch4Net) for SAS Solution Packs all versions) contain undocumented accounts with default passwords for Webservice Gateway and RMI JMX components. A remote attacker with the knowledge of the default password may potentially use these accounts to run arbitrary web service and remote procedure calls on the affected system.
773 CVE-2017-8006 287 2017-07-17 2017-08-10
4.3
 None Remote Medium Not required None None Partial
In EMC RSA Authentication Manager 8.2 SP1 Patch 1 and earlier, a malicious user logged into the Self-Service Console of RSA Authentication Manager as a target user can use a brute force attack to attempt to identify that user's PIN. The malicious user could potentially reset the compromised PIN to affect victim's ability to obtain access to protected resources.
774 CVE-2017-8005 79 XSS 2017-07-17 2021-08-06
3.5
 None Remote Medium ??? None Partial None
The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG products (RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels; RSA Via Lifecycle and Governance version 7.0, all patch levels; RSA Identity Management and Governance (RSA IMG) versions 6.9.1, all patch levels) are affected by multiple stored cross-site scripting vulnerabilities. Remote authenticated malicious users could potentially inject arbitrary HTML code to the application.
775 CVE-2017-8004 20 Exec Code 2017-07-17 2021-08-06
6.5
 None Remote Low ??? Partial Partial Partial
The EMC RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance and RSA IMG products (RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels; RSA Via Lifecycle and Governance version 7.0, all patch levels; RSA Identity Management and Governance (RSA IMG) versions 6.9.1, all patch levels) allow an application administrator to upload arbitrary files that may potentially contain a malicious code. The malicious file could be then executed on the affected system with the privileges of the user the application is running under.
776 CVE-2017-8003 22 Dir. Trav. 2017-07-09 2017-07-17
6.8
 None Remote Low ??? Complete None None
EMC Data Protection Advisor prior to 6.4 contains a path traversal vulnerability. A remote authenticated high privileged user may potentially exploit this vulnerability to access unauthorized information from the underlying OS server by supplying specially crafted strings in input parameters of the application.
777 CVE-2017-8002 89 Exec Code Sql 2017-07-09 2017-07-17
6.5
 None Remote Low ??? Partial Partial Partial
EMC Data Protection Advisor prior to 6.4 contains multiple blind SQL injection vulnerabilities. A remote authenticated attacker may potentially exploit these vulnerabilities to gain information about the application by causing execution of arbitrary SQL commands.
778 CVE-2017-8000 79 XSS 2017-07-17 2017-08-10
3.5
 None Remote Medium ??? None Partial None
In EMC RSA Authentication Manager 8.2 SP1 and earlier, a malicious RSA Security Console Administrator could craft a token profile and store the profile name in the RSA Authentication Manager database. The profile name could include a crafted script (with an XSS payload) that could be executed when viewing or editing the assigned token profile in the token by another administrator's browser session.
779 CVE-2017-7980 119 DoS Exec Code Overflow 2017-07-25 2021-08-04
4.6
 None Local Low Not required Partial Partial Partial
Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.
780 CVE-2017-7977 77 Exec Code Bypass 2017-07-19 2020-07-01
10.0
 None Remote Low Not required Complete Complete Complete
The Screensavercc component in eLux RP before 5.5.0 allows attackers to bypass intended configuration restrictions and execute arbitrary commands with root privileges by inserting commands in a local configuration dialog in the control panel.
781 CVE-2017-7950 20 DoS 2017-07-07 2020-08-04
4.3
 None Remote Medium Not required None None Partial
Nitro Pro 11.0.3 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted PCX file.
782 CVE-2017-7947 200 +Info 2017-07-17 2017-08-08
5.0
 None Remote Low Not required Partial None None
NetApp Clustered Data ONTAP before 8.3.2P11, 9.0 before P4, and 9.1 before P5 allow attackers to obtain sensitive password information by leveraging logging of passwords entered non-interactively on the command line.
783 CVE-2017-7919 287 Bypass 2017-07-03 2019-10-09
7.5
 None Remote Low Not required Partial Partial Partial
An Improper Authentication issue was discovered in Newport XPS-Cx and XPS-Qx. An attacker may bypass authentication by accessing a specific uniform resource locator (URL).
784 CVE-2017-7894 Exec Code 2017-07-05 2019-10-03
6.8
 None Remote Medium Not required Partial Partial Partial
WinDjView 2.1 might allow user-assisted attackers to execute code via a crafted .djvu file, because of a "User Mode Write AV near NULL" in WinDjView.exe. One threat model is a victim who obtains an untrusted .djvu file from a remote location and issues several user-defined commands.
785 CVE-2017-7730 20 DoS 2017-07-11 2021-08-25
7.8
 None Remote Low Not required None None Complete
iSmartAlarm cube devices allow Denial of Service. Sending a SYN flood on port 12345 will freeze the "cube" and it will stop responding.
786 CVE-2017-7729 311 2017-07-11 2021-08-25
5.0
 None Remote Low Not required None Partial None
On iSmartAlarm cube devices, there is Incorrect Access Control because a "new key" is transmitted in cleartext.
787 CVE-2017-7728 Exec Code Bypass 2017-07-11 2021-08-25
7.5
 None Remote Low Not required Partial Partial Partial
On iSmartAlarm cube devices, there is authentication bypass leading to remote execution of commands (e.g., setting the alarm on/off), related to incorrect cryptography.
788 CVE-2017-7726 295 2017-07-11 2021-08-25
5.0
 None Remote Low Not required None Partial None
iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability.
789 CVE-2017-7688 2017-07-17 2019-10-03
5.0
 None Remote Low Not required Partial None None
Apache OpenMeetings 1.0.0 updates user password in insecure manner.
790 CVE-2017-7685 2017-07-17 2019-10-03
5.0
 None Remote Low Not required Partial None None
Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH.
791 CVE-2017-7684 400 DoS 2017-07-17 2019-10-03
5.0
 None Remote Low Not required None None Partial
Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the server.
792 CVE-2017-7683 200 +Info 2017-07-17 2017-07-19
5.0
 None Remote Low Not required Partial None None
Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure.
793 CVE-2017-7682 2017-07-17 2019-10-03
6.4
 None Remote Low Not required Partial Partial None
Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas.
794 CVE-2017-7681 89 Sql 2017-07-17 2017-07-19
6.5
 None Remote Low ??? Partial Partial Partial
Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.
795 CVE-2017-7680 2017-07-17 2019-10-03
5.0
 None Remote Low Not required None Partial None
Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains.
796 CVE-2017-7678 79 XSS 2017-07-12 2017-07-26
4.3
 None Remote Medium Not required None Partial None
In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points to a shared Spark cluster and submits data including MHTML to the Spark master, or history server. This data, which could contain a script, would then be reflected back to the user and could be evaluated and executed by MS Windows-based clients. It is not an attack on Spark itself, but on the user, who may then execute the script inadvertently when viewing elements of the Spark web UIs.
797 CVE-2017-7673 326 2017-07-17 2019-10-03
5.0
 None Remote Low Not required Partial None None
Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection.
798 CVE-2017-7672 20 2017-07-13 2018-07-08
4.3
 None Remote Medium Not required None None Partial
If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.
799 CVE-2017-7670 400 DoS 2017-07-10 2021-06-16
5.0
 None Remote Low Not required None None Partial
The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol.
800 CVE-2017-7666 352 XSS CSRF 2017-07-17 2017-07-19
6.8
 None Remote Medium Not required Partial Partial Partial
Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks.
Total number of vulnerabilities : 1280   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 (This Page)17 18 19 20 21 22 23 24 25 26
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.