CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In March 2017

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
251 CVE-2017-6478 79 XSS 2017-03-05 2021-01-08
4.3
None Remote Medium Not required None Partial None
paintballrefjosh/MaNGOSWebV4 before 4.0.8 is vulnerable to a reflected XSS in install/index.php (step parameter).
252 CVE-2017-6474 835 2017-03-04 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by validating record sizes.
253 CVE-2017-6473 20 2017-03-04 2019-03-13
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a K12 file parser crash, triggered by a malformed capture file. This was addressed in wiretap/k12.c by validating the relationships between lengths and offsets.
254 CVE-2017-6472 835 2017-03-04 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an RTMPT dissector infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-rtmpt.c by properly incrementing a certain sequence value.
255 CVE-2017-6471 20 2017-03-04 2019-03-13
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a WSP infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wsp.c by validating the capability length.
256 CVE-2017-6470 835 2017-03-04 2019-10-03
7.8
None Remote Low Not required None None Complete
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an IAX2 infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-iax2.c by constraining packet lateness.
257 CVE-2017-6469 20 2017-03-04 2019-03-13
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is an LDSS dissector crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-ldss.c by ensuring that memory is allocated for a certain data structure.
258 CVE-2017-6468 20 2017-03-04 2019-03-13
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a NetScaler file parser crash, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by validating the relationship between pages and records.
259 CVE-2017-6467 835 2017-03-04 2019-10-03
5.0
None Remote Low Not required None None Partial
In Wireshark 2.2.0 to 2.2.4 and 2.0.0 to 2.0.10, there is a Netscaler file parser infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by changing the restrictions on file size.
260 CVE-2017-6466 20 2017-03-11 2017-03-14
9.3
None Remote Medium Not required Complete Complete Complete
F-Secure Software Updater 2.20, as distributed in several F-Secure products, downloads installation packages over plain http and does not perform file integrity validation after download. Man-in-the-middle attackers can replace the file with their own executable which will be executed under the SYSTEM account. Note that when Software Updater is configured to install updates automatically, it checks if the downloaded file is digitally signed by default, but does not check the author of the signature. When running in manual mode (default), no signature check is performed.
261 CVE-2017-6465 119 Exec Code Overflow 2017-03-10 2017-03-14
7.5
None Remote Low Not required Partial Partial Partial
Remote Code Execution was discovered in FTPShell Client 6.53. By default, the client sends a PWD command to the FTP server it is connecting to; however, it doesn't check the response's length, leading to a buffer overflow situation.
262 CVE-2017-6464 20 DoS 2017-03-27 2018-04-12
4.0
None Remote Low ??? None None Partial
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.
263 CVE-2017-6463 20 DoS 2017-03-27 2019-01-24
4.0
None Remote Low ??? None None Partial
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.
264 CVE-2017-6462 119 Overflow 2017-03-27 2019-01-24
4.6
None Local Low Not required Partial Partial Partial
Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.
265 CVE-2017-6460 119 Overflow 2017-03-27 2017-10-24
6.5
None Remote Low ??? Partial Partial Partial
Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.
266 CVE-2017-6459 119 Overflow 2017-03-27 2017-10-24
2.1
None Local Low Not required None None Partial
The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to an argument with multiple null bytes.
267 CVE-2017-6458 119 Overflow 2017-03-27 2021-07-12
6.5
None Remote Low ??? Partial Partial Partial
Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.
268 CVE-2017-6455 94 +Priv 2017-03-27 2017-10-24
4.4
None Local Medium Not required Partial Partial Partial
NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPI_DLLS environment variable.
269 CVE-2017-6452 119 Overflow 2017-03-27 2017-10-24
4.6
None Local Low Not required Partial Partial Partial
Stack-based buffer overflow in the Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via an application path on the command line.
270 CVE-2017-6451 787 Exec Code 2017-03-27 2017-10-24
4.6
None Local Low Not required Partial Partial Partial
The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.
271 CVE-2017-6446 79 XSS 2017-03-05 2017-03-08
4.3
None Remote Medium Not required None Partial None
XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters.
272 CVE-2017-6445 347 2017-03-05 2019-10-03
7.6
None Remote High Not required Complete Complete Complete
The auto-update feature of Open Embedded Linux Entertainment Center (OpenELEC) 6.0.3, 7.0.1, and 8.0.4 uses neither encrypted connections nor signed updates. A man-in-the-middle attacker could manipulate the update packages to gain root access remotely.
273 CVE-2017-6444 400 DoS 2017-03-12 2021-05-25
7.8
None Remote Low Not required None None Complete
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many ACK packets. After the attacker stops the exploit, the CPU usage is 100% and the router requires a reboot for normal operation.
274 CVE-2017-6443 79 XSS 2017-03-15 2017-03-16
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in EPSON TMNet WebConfig 1.00 allows remote attackers to inject arbitrary web script or HTML via the W_AD1 parameter to Forms/oadmin_1.
275 CVE-2017-6440 20 DoS 2017-03-15 2019-10-03
1.9
None Local Medium Not required None None Partial
The parse_data_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.
276 CVE-2017-6439 787 DoS Overflow 2017-03-15 2017-04-04
1.9
None Local Medium Not required None None Partial
Heap-based buffer overflow in the parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) via a crafted plist file.
277 CVE-2017-6438 787 DoS Exec Code Overflow 2017-03-15 2017-04-04
4.4
None Local Medium Not required Partial Partial Partial
Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file.
278 CVE-2017-6437 125 DoS 2017-03-15 2017-04-04
1.9
None Local Medium Not required None None Partial
The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds read) via a crafted plist file.
279 CVE-2017-6436 119 DoS Overflow 2017-03-15 2019-10-03
1.9
None Local Medium Not required None None Partial
The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.
280 CVE-2017-6435 119 DoS Overflow Mem. Corr. 2017-03-15 2017-04-14
1.9
None Local Medium Not required None None Partial
The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory corruption) via a crafted plist file.
281 CVE-2017-6432 319 2017-03-09 2019-10-03
9.3
None Remote Medium Not required Complete Complete Complete
An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unencrypted, binary protocol. Performing a Man-in-the-Middle attack allows both sniffing and injections of packets, which allows creation of fully privileged new users, in addition to capture of sensitive information.
282 CVE-2017-6430 125 DoS 2017-03-15 2020-02-26
4.3
None Remote Medium Not required None None Partial
The compile_tree function in ef_compiler.c in the Etterfilter utility in Ettercap 0.8.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted filter.
283 CVE-2017-6429 119 Overflow 2017-03-15 2022-06-03
6.8
None Remote Medium Not required Partial Partial Partial
Buffer overflow in the tcpcapinfo utility in Tcpreplay before 4.2.0 Beta 1 allows remote attackers to have unspecified impact via a pcap file with an over-size packet.
284 CVE-2017-6427 119 Overflow 2017-03-10 2017-03-15
5.0
None Remote Low Not required None None Partial
A Buffer Overflow was discovered in EvoStream Media Server 1.7.1. A crafted HTTP request with a malicious header will cause a crash. An example attack methodology may include a long message-body in a GET request.
285 CVE-2017-6417 427 Exec Code Bypass 2017-03-21 2019-10-03
7.2
None Local Low Not required Complete Complete Complete
Code injection vulnerability in Avira Total Security Suite 15.0 (and earlier), Optimization Suite 15.0 (and earlier), Internet Security Suite 15.0 (and earlier), and Free Security Suite 15.0 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Avira process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.
286 CVE-2017-6416 119 Exec Code Overflow 2017-03-06 2017-03-08
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in SysGauge 1.5.18. A buffer overflow vulnerability in SMTP connection verification leads to arbitrary code execution. The attack vector is a crafted SMTP daemon that sends a long 220 (aka "Service ready") string.
287 CVE-2017-6415 476 DoS 2017-03-02 2020-10-15
4.3
None Remote Medium Not required None None Partial
The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DEX file.
288 CVE-2017-6414 772 DoS 2017-03-15 2020-05-20
4.9
None Local Low Not required None None Complete
Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.
289 CVE-2017-6413 287 Bypass 2017-03-02 2017-03-07
5.0
None Remote Low Not required None Partial None
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
290 CVE-2017-6412 384 2017-03-30 2017-04-15
6.8
None Remote Medium Not required Partial Partial Partial
In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310.
291 CVE-2017-6411 352 CSRF 2017-03-06 2017-03-08
6.8
None Remote Medium Not required Partial Partial Partial
Cross Site Request Forgery (CSRF) on D-Link DSL-2730U C1 IN_1.00 devices allows remote attackers to change the DNS or firewall configuration or any password.
292 CVE-2017-6410 319 +Info 2017-03-02 2019-10-03
4.3
None Remote Medium Not required Partial None None
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
293 CVE-2017-6409 306 2017-03-02 2019-10-03
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. Unauthenticated CORBA interfaces permit inappropriate access.
294 CVE-2017-6408 362 2017-03-02 2019-10-03
4.4
None Local Medium Not required Partial Partial Partial
An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. A local-privilege-escalation race condition in pbx_exchange can occur when a local user connects to a socket before permissions are secured.
295 CVE-2017-6407 Exec Code 2017-03-02 2019-10-03
7.2
None Local Low Not required Complete Complete Complete
An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2. Privileged remote command execution on NetBackup Server and Client (on the server or a connected client) can occur.
296 CVE-2017-6406 Exec Code 2017-03-02 2019-10-03
7.2
None Local Low Not required Complete Complete Complete
An issue was discovered in Veritas NetBackup Before 7.7.2 and NetBackup Appliance Before 2.7.2. Arbitrary privileged command execution, using whitelist directory escape with "../" substrings, can occur.
297 CVE-2017-6405 290 2017-03-02 2019-10-03
5.0
None Remote Low Not required None Partial None
An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. Hostname-based security is open to DNS spoofing.
298 CVE-2017-6404 276 2017-03-02 2019-10-03
2.1
None Local Low Not required None Partial None
An issue was discovered in Veritas NetBackup Before 7.7 and NetBackup Appliance Before 2.7. There are world-writable log files, allowing destruction or spoofing of log data.
299 CVE-2017-6403 798 2017-03-02 2017-03-07
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Veritas NetBackup Before 8.0 and NetBackup Appliance Before 3.0. NetBackup Cloud Storage Service uses a hardcoded username and password.
300 CVE-2017-6402 DoS 2017-03-02 2019-10-03
4.0
None Remote Low ??? None None Partial
An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. Denial of service affecting NetBackup server can occur.
Total number of vulnerabilities : 1305   Page : 1 2 3 4 5 6 (This Page)7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.