CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2017

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
401 CVE-2017-7475 476 2017-05-19 2021-03-04
4.3
 None Remote Medium Not required None None Partial
Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.
402 CVE-2017-7474 Bypass 2017-05-12 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.
403 CVE-2017-7472 404 DoS 2017-05-11 2019-10-03
4.9
 None Local Low Not required None None Complete
The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.
404 CVE-2017-7440 20 2017-05-02 2017-05-15
4.3
 None Remote Medium Not required None Partial None
Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows remote attackers to conduct clickjacking attacks via a crafted e-mail message.
405 CVE-2017-7439 200 +Info 2017-05-26 2017-06-02
5.0
 None Remote Low Not required Partial None None
NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors involving error messages.
406 CVE-2017-7433 22 Dir. Trav. 2017-05-18 2017-06-01
4.0
 None Remote Low ??? Partial None None
An absolute path traversal vulnerability (CWE-36) in Micro Focus Vibe 4.0.2 and earlier allows a remote authenticated attacker to download arbitrary files from the server by submitting a specially crafted request to the viewFile endpoint. Note that the attack can be performed without authentication if Guest access is enabled (Guest access is disabled by default).
407 CVE-2017-7432 2017-05-03 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a webshell upload vulnerability.
408 CVE-2017-7431 352 CSRF 2017-05-03 2017-05-15
6.8
 None Remote Medium Not required Partial Partial Partial
Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have persistent CSRF in object management.
409 CVE-2017-7430 79 XSS 2017-05-03 2017-05-12
4.3
 None Remote Medium Not required None Partial None
Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a persistent XSS vulnerability in Framework.
410 CVE-2017-7428 20 2017-05-03 2017-05-15
5.0
 None Remote Low Not required None None Partial
NetIQ iManager 3.x before 3.0.3.1 has an issue in the renegotiation of connection parameters with Tomcat.
411 CVE-2017-7343 601 Exec Code 2017-05-27 2017-05-31
5.8
 None Remote Medium Not required Partial Partial None
An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url parameter.
412 CVE-2017-7339 79 Exec Code XSS 2017-05-27 2017-05-31
4.3
 None Remote Medium Not required None Partial None
A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the 'Name' and 'Description' inputs in the 'Add Revision Backup' functionality.
413 CVE-2017-7338 200 +Info 2017-05-27 2017-05-31
5.0
 None Remote Low Not required Partial None None
A password management vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to carry out information disclosure via the FortiAnalyzer Management View.
414 CVE-2017-7337 732 CSRF 2017-05-27 2019-10-03
6.4
 None Remote Low Not required Partial Partial None
An improper Access Control vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to interact with unauthorized VDOMs or enumerate other ADOMs via another user's stolen session and CSRF tokens or the adomName parameter in the /fpc/sec/customer/policy/getAdomVersion request.
415 CVE-2017-7296 79 XSS 2017-05-28 2017-06-06
4.3
 None Remote Medium Not required None Partial None
An issue was discovered in Contiki Operating System 3.0. A Persistent XSS vulnerability is present in the MQTT/IBM Cloud Config page (aka mqtt.html) of cc26xx-web-demo. The cc26xx-web-demo features a webserver that runs on a constrained device. That particular page allows a user to remotely configure that device's operation by sending HTTP POST requests. The vulnerability consists of improper input sanitisation of the text fields on the MQTT/IBM Cloud config page, allowing for JavaScript code injection.
416 CVE-2017-7295 416 DoS 2017-05-28 2017-06-06
7.8
 None Remote Low Not required None None Complete
An issue was discovered in Contiki Operating System 3.0. A use-after-free vulnerability exists in httpd-simple.c in cc26xx-web-demo httpd, where upon a connection close event, the http_state structure was not deallocated properly, resulting in a NULL pointer dereference in the output processing function. This resulted in a board crash, which can be used to perform denial of service.
417 CVE-2017-7288 79 XSS 2017-05-23 2020-06-04
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) before 8.7.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
418 CVE-2017-7236 89 Exec Code Sql 2017-05-26 2017-06-02
5.0
 None Remote Low Not required Partial None None
SQL injection vulnerability in NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
419 CVE-2017-7229 326 DoS 2017-05-03 2017-05-16
6.4
 None Remote Low Not required Partial None Partial
PGP/MIME encrypted messages injected into a Vaultive O365 (before 4.5.21) frontend via IMAP or SMTP have their Content-Type changed from 'Content-Type: multipart/encrypted; protocol="application/pgp-encrypted"; boundary="abc123abc123"' to 'Content-Type: text/plain' - this results in the encrypted message being structured in such a way that most PGP/MIME-capable mail user agents are unable to decrypt it cleanly. The outcome is that encrypted mail passing through this device does not work (Denial of Service), and a common real-world consequence is a request to resend the mail in the clear (Information Disclosure).
420 CVE-2017-7216 200 +Info 2017-05-02 2020-02-17
4.0
 None Remote Low ??? Partial None None
The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to obtain sensitive information via unspecified request parameters.
421 CVE-2017-7213 20 2017-05-15 2017-05-23
10.0
 None Remote Low Not required Complete Complete Complete
Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected active desktops via unspecified vectors.
422 CVE-2017-6999 119 DoS Exec Code Overflow Mem. Corr. 2017-05-22 2019-03-08
9.3
 None Remote Medium Not required Complete Complete Complete
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
423 CVE-2017-6998 119 DoS Exec Code Overflow Mem. Corr. 2017-05-22 2019-03-08
9.3
 None Remote Medium Not required Complete Complete Complete
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
424 CVE-2017-6997 119 DoS Exec Code Overflow Mem. Corr. 2017-05-22 2019-03-08
9.3
 None Remote Medium Not required Complete Complete Complete
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
425 CVE-2017-6996 119 DoS Exec Code Overflow Mem. Corr. 2017-05-22 2019-03-08
9.3
 None Remote Medium Not required Complete Complete Complete
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
426 CVE-2017-6995 119 DoS Exec Code Overflow Mem. Corr. 2017-05-22 2019-03-08
9.3
 None Remote Medium Not required Complete Complete Complete
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
427 CVE-2017-6994 119 DoS Exec Code Overflow Mem. Corr. 2017-05-22 2019-03-08
9.3
 None Remote Medium Not required Complete Complete Complete
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
428 CVE-2017-6991 119 DoS Exec Code Overflow Mem. Corr. 2017-05-22 2017-07-08
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
429 CVE-2017-6990 Bypass 2017-05-22 2019-10-03
4.3
 None Remote Medium Not required Partial None None
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "HFS" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
430 CVE-2017-6989 119 DoS Exec Code Overflow Mem. Corr. 2017-05-22 2019-03-08
9.3
 None Remote Medium Not required Complete Complete Complete
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
431 CVE-2017-6988 295 2017-05-22 2017-07-08
4.3
 None Remote Medium Not required Partial None None
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "802.1X" component. It allows remote attackers to discover the network credentials of arbitrary users by operating a crafted network that requires 802.1X authentication, because EAP-TLS certificate validation mishandles certificate changes.
432 CVE-2017-6987 200 Bypass +Info 2017-05-22 2019-03-08
4.3
 None Remote Medium Not required Partial None None
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
433 CVE-2017-6986 119 DoS Overflow Mem. Corr. 2017-05-22 2017-07-08
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "iBooks" component. It allows attackers to conduct sandbox-escape attacks or cause a denial of service (memory corruption) via a crafted app.
434 CVE-2017-6985 119 DoS Exec Code Overflow Mem. Corr. 2017-05-22 2017-07-08
9.3
 None Remote Medium Not required Complete Complete Complete
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "NVIDIA Graphics Drivers" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
435 CVE-2017-6984 119 DoS Exec Code Overflow Mem. Corr. 2017-05-22 2019-03-08
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. iTunes before 12.6.1 on Windows is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
436 CVE-2017-6983 119 DoS Exec Code Overflow Mem. Corr. 2017-05-22 2017-09-09
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "SQLite" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
437 CVE-2017-6982 119 DoS Overflow 2017-05-22 2017-08-13
4.3
 None Remote Medium Not required None None Partial
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. The issue involves the "Notifications" component. It allows attackers to cause a denial of service via a crafted app.
438 CVE-2017-6981 59 Exec Code 2017-05-22 2019-10-03
9.3
 None Remote Medium Not required Complete Complete Complete
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "iBooks" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app that uses symlinks.
439 CVE-2017-6980 119 DoS Exec Code Overflow Mem. Corr. 2017-05-22 2019-03-08
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
440 CVE-2017-6979 362 Exec Code 2017-05-22 2019-10-03
7.6
 None Remote High Not required Complete Complete Complete
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "IOSurface" component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.
441 CVE-2017-6978 119 DoS Exec Code Overflow Mem. Corr. 2017-05-22 2017-08-13
9.3
 None Remote Medium Not required Complete Complete Complete
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Accessibility Framework" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
442 CVE-2017-6977 119 DoS Overflow Mem. Corr. 2017-05-22 2017-07-08
6.8
 None Remote Medium Not required Partial Partial Partial
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Speech Framework" component. It allows attackers to conduct sandbox-escape attacks or cause a denial of service (memory corruption) via a crafted app.
443 CVE-2017-6953 119 Exec Code Overflow 2017-05-08 2017-05-19
4.6
 None Local Low Not required Partial Partial Partial
Gemalto SmartDiag Diagnosis Tool v2.5 has a stack-based Buffer Overflow with SEH Overwrite via long "Register a new card" input fields. There may be a risk of local code execution with untrusted input to SmartDiag.exe or SymDiag.exe.
444 CVE-2017-6891 119 Overflow 2017-05-22 2021-06-29
6.8
 None Remote Medium Not required Partial Partial Partial
Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.
445 CVE-2017-6890 119 Overflow 2017-05-15 2017-05-25
7.5
 None Remote Low Not required Partial Partial Partial
A boundary error within the "foveon_load_camf()" function (dcraw_foveon.c) when initializing a huffman table in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a stack-based buffer overflow.
446 CVE-2017-6889 190 Overflow 2017-05-15 2017-05-24
7.5
 None Remote Low Not required Partial Partial Partial
An integer overflow error within the "foveon_load_camf()" function (dcraw_foveon.c) in LibRaw-demosaic-pack-GPL2 before 0.18.2 can be exploited to cause a heap-based buffer overflow.
447 CVE-2017-6887 119 Overflow Mem. Corr. 2017-05-16 2017-11-04
6.8
 None Remote Medium Not required Partial Partial Partial
A boundary error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to cause a memory corruption via e.g. a specially crafted KDC file with model set to "DSLR-A100" and containing multiple sequences of 0x100 and 0x14A TAGs.
448 CVE-2017-6886 119 Overflow 2017-05-16 2017-11-04
7.5
 None Remote Low Not required Partial Partial Partial
An error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to corrupt memory.
449 CVE-2017-6885 +Priv 2017-05-16 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
An error when handling certain external commands and services related to the FlexNet Inventory Agent and FlexNet Beacon of the Flexera Software FlexNet Manager Suite 2017 before 2017 R1 and 2014 R3 through 2016 R1 SP1 can be exploited to gain elevated privileges.
450 CVE-2017-6867 20 2017-05-11 2018-06-14
4.0
 None Remote Low ??? None None Partial
A vulnerability was discovered in Siemens SIMATIC WinCC (V7.3 before Upd 11 and V7.4 before SP1), SIMATIC WinCC Runtime Professional (V13 before SP2 and V14 before SP1), SIMATIC WinCC (TIA Portal) Professional (V13 before SP2 and V14 before SP1) that could allow an authenticated, remote attacker who is member of the "administrators" group to crash services by sending specially crafted messages to the DCOM interface.
Total number of vulnerabilities : 1015   Page : 1 2 3 4 5 6 7 8 9 (This Page)10 11 12 13 14 15 16 17 18 19 20 21
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.