CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In July 2017

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
151 CVE-2017-11651 79 XSS 2017-07-26 2020-03-03
4.3
 None Remote Medium Not required None Partial None
NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag.
152 CVE-2017-11648 352 CSRF 2017-07-31 2017-08-04
6.8
 None Remote Medium Not required Partial Partial Partial
Techroutes TR 1803-3G Wireless Cellular Router/Modem 2.4.25 devices do not possess any protection against a CSRF vulnerability, as demonstrated by a goform/BasicSettings request to disable port filtering.
153 CVE-2017-11647 79 XSS 2017-07-28 2017-08-04
3.5
 None Remote Medium ??? None Partial None
NetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 are vulnerable to stored cross-site scripting attacks. Creating an SSID with an XSS payload results in successful exploitation.
154 CVE-2017-11646 352 CSRF 2017-07-28 2017-08-04
6.8
 None Remote Medium Not required Partial Partial Partial
NetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 are vulnerable to CSRF attacks, as demonstrated by using administration.html to disable the firewall. They does not contain any token that can mitigate CSRF vulnerabilities within the device.
155 CVE-2017-11645 287 2017-07-28 2017-08-04
7.5
 None Remote Low Not required Partial Partial Partial
NetComm Wireless 4GT101W routers with Hardware: 0.01 / Software: V1.1.8.8 / Bootloader: 1.1.3 do not require authentication for logfile.html, status.html, or system_config.html.
156 CVE-2017-11644 772 2017-07-26 2019-10-03
4.3
 None Remote Medium Not required None None Partial
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the ReadMATImage() function in coders/mat.c.
157 CVE-2017-11643 119 Overflow 2017-07-26 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
GraphicsMagick 1.3.26 has a heap overflow in the WriteCMYKImage() function in coders/cmyk.c when processing multiple frames that have non-identical widths.
158 CVE-2017-11642 476 2017-07-26 2018-10-18
6.8
 None Remote Medium Not required Partial Partial Partial
GraphicsMagick 1.3.26 has a NULL pointer dereference in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image, a different vulnerability than CVE-2017-11638.
159 CVE-2017-11641 772 2017-07-26 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
GraphicsMagick 1.3.26 has a Memory Leak in the PersistCache function in magick/pixel_cache.c during writing of Magick Persistent Cache (MPC) files.
160 CVE-2017-11640 119 Overflow 2017-07-26 2018-06-14
4.3
 None Remote Medium Not required None None Partial
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to an address access exception in the WritePTIFImage() function in coders/tiff.c.
161 CVE-2017-11639 125 2017-07-26 2019-10-03
4.3
 None Remote Medium Not required None None Partial
When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WriteCIPImage() function in coders/cip.c, related to the GetPixelLuma function in MagickCore/pixel-accessor.h.
162 CVE-2017-11638 20 2017-07-26 2018-10-18
6.8
 None Remote Medium Not required Partial Partial Partial
GraphicsMagick 1.3.26 has a segmentation violation in the WriteMAPImage() function in coders/map.c when processing a non-colormapped image, a different vulnerability than CVE-2017-11642.
163 CVE-2017-11637 476 2017-07-26 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
GraphicsMagick 1.3.26 has a NULL pointer dereference in the WritePCLImage() function in coders/pcl.c during writes of monochrome images.
164 CVE-2017-11636 119 Overflow 2017-07-26 2018-10-18
7.5
 None Remote Low Not required Partial Partial Partial
GraphicsMagick 1.3.26 has a heap overflow in the WriteRGBImage() function in coders/rgb.c when processing multiple frames that have non-identical widths.
165 CVE-2017-11631 89 Sql 2017-07-26 2017-07-31
7.5
 None Remote Low Not required Partial Partial Partial
dapur/app/app_user/controller/status.php in Fiyo CMS 2.0.7 has SQL injection via the id parameter.
166 CVE-2017-11630 22 Dir. Trav. 2017-07-26 2017-07-31
5.0
 None Remote Low Not required None Partial None
dapur\apps\app_config\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request, a different vulnerability than CVE-2017-8853.
167 CVE-2017-11629 79 XSS 2017-07-26 2017-08-09
4.3
 None Remote Medium Not required None Partial None
dayrui FineCms through 5.0.10 has Cross Site Scripting (XSS) in controllers/api.php via the function parameter in a c=api&m=data2 request.
168 CVE-2017-11628 119 DoS Overflow 2017-07-25 2018-05-04
6.8
 None Remote Medium Not required Partial Partial Partial
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function, e.g., a web application for syntax validation of php.ini directives.
169 CVE-2017-11627 835 DoS 2017-07-25 2019-10-03
4.3
 None Remote Medium Not required None None Partial
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the PointerHolder function in PointerHolder.hh, aka an "infinite loop."
170 CVE-2017-11626 835 DoS 2017-07-25 2019-10-03
4.3
 None Remote Medium Not required None None Partial
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."
171 CVE-2017-11625 835 DoS 2017-07-25 2019-10-03
4.3
 None Remote Medium Not required None None Partial
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDF::resolveObjectsInStream function in QPDF.cc, aka an "infinite loop."
172 CVE-2017-11624 835 DoS 2017-07-25 2019-10-03
4.3
 None Remote Medium Not required None None Partial
A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after two consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite loop."
173 CVE-2017-11617 79 XSS 2017-07-25 2017-07-28
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in atmail prior to version 7.8.0.2 allows remote attackers to inject arbitrary web script or HTML within the body of an email via an IMG element with both single quotes and double quotes.
174 CVE-2017-11615 Exec Code 2017-07-26 2019-10-03
6.8
 None Remote Medium Not required Partial Partial Partial
A sandbox escape in the Lua interface in Wube Factorio before 0.15.31 allows remote game servers or user-assisted attackers to execute arbitrary C code by including and loading a C library.
175 CVE-2017-11614 798 +Info 2017-07-25 2017-08-03
7.5
 None Remote Low Not required Partial Partial Partial
MEDHOST Connex contains hard-coded credentials that are used for customer database access. An attacker with knowledge of the hard-coded credentials and the ability to communicate directly with the database may be able to obtain or modify sensitive patient and financial information. Connex utilizes an IBM i DB2 user account for database access. The account name is HMSCXPDN. Its password is hard-coded in multiple places in the application. Customers do not have the option to change this password. The account has elevated DB2 roles, and can access all objects or database tables on the customer DB2 database. This account can access data through ODBC, FTP, and TELNET. Customers without Connex installed are still vulnerable because the MEDHOST setup program creates this account.
176 CVE-2017-11613 20 DoS 2017-07-26 2018-12-01
4.3
 None Remote Medium Not required None None Partial
In LibTIFF 4.0.8, there is a denial of service vulnerability in the TIFFOpen function. A crafted input will lead to a denial of service attack. During the TIFFOpen process, td_imagelength is not checked. The value of td_imagelength can be directly controlled by an input file. In the ChopUpSingleUncompressedStrip function, the _TIFFCheckMalloc function is called based on td_imagelength. If we set the value of td_imagelength close to the amount of system memory, it will hang the system or trigger the OOM killer.
177 CVE-2017-11612 79 XSS 2017-07-26 2017-07-31
4.3
 None Remote Medium Not required None Partial None
In Joomla! before 3.7.4, inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components.
178 CVE-2017-11608 125 DoS 2017-07-24 2019-10-03
4.3
 None Remote Medium Not required None None Partial
There is a heap-based buffer over-read in the Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service attack.
179 CVE-2017-11605 125 DoS 2017-07-24 2019-10-03
4.3
 None Remote Medium Not required None None Partial
There is a heap based buffer over-read in LibSass 3.4.5, related to address 0xb4803ea1. A crafted input will lead to a remote denial of service attack.
180 CVE-2017-11600 125 DoS 2017-07-24 2019-05-14
6.9
 None Local Medium Not required Complete Complete Complete
net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message.
181 CVE-2017-11594 79 XSS 2017-07-24 2017-08-08
3.5
 None Remote Medium ??? None Partial None
Cross-site scripting (XSS) vulnerability in the Markdown parser in Loomio before 1.8.0 allows remote attackers to inject arbitrary web script or HTML via non-sanitized Markdown content in a new thread or a thread comment.
182 CVE-2017-11593 79 XSS 2017-07-24 2017-08-10
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Markdown Preview Plus extension before 0.5.7 for Chrome allows remote attackers to inject arbitrary web script or HTML into some web applications via the upload and display of crafted text, markdown, or rst files that are designed to be viewed in the browser as plain text, but that will be converted to HTML without proper sanitization.
183 CVE-2017-11592 119 DoS Overflow Mem. Corr. 2017-07-24 2017-07-28
5.0
 None Remote Low Not required None None Partial
There is a Mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote denial of service attack (heap memory corruption) via crafted input.
184 CVE-2017-11591 DoS 2017-07-24 2019-10-03
5.0
 None Remote Low Not required None None Partial
There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input.
185 CVE-2017-11590 476 DoS 2017-07-24 2017-07-28
4.3
 None Remote Medium Not required None None Partial
There is a NULL pointer dereference in the caseless_hash function in gxps-archive.c in libgxps 0.2.5. A crafted input will lead to a remote denial of service attack.
186 CVE-2017-11589 22 Dir. Trav. 2017-07-24 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is no access control for info.html, wancfg.cmd, rtroutecfg.cmd, arpview.cmd, cpuview.cmd, memoryview.cmd, statswan.cmd, statsatm.cmd, scsrvcntr.cmd, scacccntr.cmd, logview.cmd, voicesipview.cmd, usbview.cmd, wlmacflt.cmd, wlwds.cmd, wlstationlist.cmd, HPNAShow.cmd, HPNAView.cmd, qoscls.cmd, qosqueue.cmd, portmap.cmd, scmacflt.cmd, scinflt.cmd, scoutflt.cmd, certlocal.cmd, or certca.cmd.
187 CVE-2017-11588 78 Exec Code 2017-07-24 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is remote command execution via shell metacharacters in the pingAddr parameter to the waitPingqry.cgi URI. The command output is visible at /PingMsg.cmd.
188 CVE-2017-11587 22 Dir. Trav. 2017-07-24 2017-08-27
5.0
 None Remote Low Not required Partial None None
On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is directory traversal in the filename parameter to the /download.conf URI.
189 CVE-2017-11586 601 2017-07-24 2017-07-28
5.8
 None Remote Medium Not required Partial Partial None
dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php.
190 CVE-2017-11585 94 Exec Code 2017-07-24 2017-07-28
7.5
 None Remote Low Not required Partial Partial Partial
dayrui FineCms 5.0.9 has remote PHP code execution via the param parameter in an action=cache request to libraries/Template.php, aka Eval Injection.
191 CVE-2017-11584 89 Sql 2017-07-24 2017-07-27
7.5
 None Remote Low Not required Partial Partial Partial
dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php.
192 CVE-2017-11583 89 Sql 2017-07-24 2017-07-27
7.5
 None Remote Low Not required Partial Partial Partial
dayrui FineCms 5.0.9 has SQL Injection via the catid parameter in an action=related request to libraries/Template.php.
193 CVE-2017-11582 89 Sql 2017-07-24 2017-07-27
7.5
 None Remote Low Not required Partial Partial Partial
dayrui FineCms 5.0.9 has SQL Injection via the num parameter in an action=related or action=tags request to libraries/Template.php.
194 CVE-2017-11581 79 XSS 2017-07-24 2017-07-28
4.3
 None Remote Medium Not required None Partial None
dayrui FineCms 5.0.9 has Cross Site Scripting (XSS) in admin/Login.php via a payload in the username field that does not begin with a '<' character.
195 CVE-2017-11577 125 Exec Code 2017-07-23 2020-01-13
6.8
 None Remote Medium Not required Partial Partial Partial
FontForge 20161012 is vulnerable to a buffer over-read in getsid (parsettf.c) resulting in DoS or code execution via a crafted otf file.
196 CVE-2017-11576 119 Overflow 2017-07-23 2020-01-13
4.3
 None Remote Medium Not required None None Partial
FontForge 20161012 does not ensure a positive size in a weight vector memcpy call in readcfftopdict (parsettf.c) resulting in DoS via a crafted otf file.
197 CVE-2017-11575 125 Exec Code 2017-07-23 2020-01-13
6.8
 None Remote Medium Not required Partial Partial Partial
FontForge 20161012 is vulnerable to a buffer over-read in strnmatch (char.c) resulting in DoS or code execution via a crafted otf file, related to a call from the readttfcopyrights function in parsettf.c.
198 CVE-2017-11574 119 Exec Code Overflow 2017-07-23 2020-01-13
6.8
 None Remote Medium Not required Partial Partial Partial
FontForge 20161012 is vulnerable to a heap-based buffer overflow in readcffset (parsettf.c) resulting in DoS or code execution via a crafted otf file.
199 CVE-2017-11573 125 Exec Code 2017-07-23 2020-01-13
6.8
 None Remote Medium Not required Partial Partial Partial
FontForge 20161012 is vulnerable to a buffer over-read in ValidatePostScriptFontName (parsettf.c) resulting in DoS or code execution via a crafted otf file.
200 CVE-2017-11572 125 Exec Code 2017-07-23 2020-01-13
6.8
 None Remote Medium Not required Partial Partial Partial
FontForge 20161012 is vulnerable to a heap-based buffer over-read in readcfftopdicts (parsettf.c) resulting in DoS or code execution via a crafted otf file.
Total number of vulnerabilities : 1280   Page : 1 2 3 4 (This Page)5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.