CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2017 (CVSS score >= 6)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-14076 89 Sql 2017-08-31 2017-09-05
7.5
None Remote Low Not required Partial Partial Partial
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.
2 CVE-2017-14069 89 Sql 2017-08-31 2017-09-07
7.5
None Remote Low Not required Partial Partial Partial
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.
3 CVE-2017-14064 119 Overflow 2017-08-31 2019-05-13
7.5
None Remote Low Not required Partial Partial Partial
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.
4 CVE-2017-14062 190 DoS Overflow 2017-08-31 2020-12-07
7.5
None Remote Low Not required Partial Partial Partial
Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
5 CVE-2017-14061 190 DoS Overflow 2017-08-31 2019-10-21
7.5
None Remote Low Not required Partial Partial Partial
Integer overflow in the _isBidi function in bidi.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
6 CVE-2017-14059 834 2017-08-31 2019-10-03
7.1
None Remote Medium Not required None None Complete
In FFmpeg 3.3.3, a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption. When a crafted CINE file, which claims a large "duration" field in the header but does not contain sufficient backing data, is provided, the image-offset parsing loop would consume huge CPU and memory resources, since there is no EOF check inside the loop.
7 CVE-2017-14057 834 2017-08-31 2019-10-03
7.1
None Remote Medium Not required None None Complete
In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large "name_len" or "count" field in the header but does not contain sufficient backing data, is provided, the loops over the name and markers would consume huge CPU and memory resources, since there is no EOF check inside these loops.
8 CVE-2017-14056 834 2017-08-31 2019-10-03
7.1
None Remote Medium Not required None None Complete
In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted RL2 file, which claims a large "frame_count" field in the header but does not contain sufficient backing data, is provided, the loops (for offset and size tables) would consume huge CPU and memory resources, since there is no EOF check inside these loops.
9 CVE-2017-14055 834 2017-08-31 2019-10-03
7.1
None Remote Medium Not required None None Complete
In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop.
10 CVE-2017-14054 834 2017-08-31 2019-10-03
7.1
None Remote Medium Not required None None Complete
In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted IVR file, which claims a large "len" field in the header but does not contain sufficient backing data, is provided, the first type==4 loop would consume huge CPU resources, since there is no EOF check inside the loop.
11 CVE-2017-14050 434 Exec Code 2017-08-31 2017-09-01
6.5
None Remote Low ??? Partial Partial Partial
In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file.
12 CVE-2017-14048 352 CSRF 2017-08-31 2017-09-01
6.5
None Remote Low ??? Partial Partial Partial
BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php. NOTE: this can be exploited via CSRF.
13 CVE-2017-14041 787 DoS Exec Code Overflow 2017-08-30 2021-02-02
6.8
None Remote Medium Not required Partial Partial Partial
A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
14 CVE-2017-14040 787 DoS 2017-08-30 2021-02-02
6.8
None Remote Medium Not required Partial Partial Partial
An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. The vulnerability may lead to remote denial of service or possibly unspecified other impact.
15 CVE-2017-14039 787 DoS Overflow 2017-08-30 2021-02-02
6.8
None Remote Medium Not required Partial Partial Partial
A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in lib/openjp2/t2.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.
16 CVE-2017-14035 502 2017-08-30 2017-09-01
7.5
None Remote Low Not required Partial Partial Partial
CrushFTP 8.x before 8.2.0 has a serialization vulnerability.
17 CVE-2017-14032 287 Bypass 2017-08-30 2017-11-08
6.8
None Remote Medium Not required Partial Partial Partial
ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL name are not affected.
18 CVE-2017-13777 834 DoS 2017-08-30 2019-12-16
7.1
None Remote Medium Not required None None Complete
GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version==10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it.
19 CVE-2017-13776 834 DoS 2017-08-30 2019-12-16
7.1
None Remote Medium Not required None None Complete
GraphicsMagick 1.3.26 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version!=10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it.
20 CVE-2017-13775 DoS 2017-08-30 2019-10-03
7.1
None Remote Medium Not required None None Complete
GraphicsMagick 1.3.26 has a denial of service issue in ReadJNXImage() in coders/jnx.c whereby large amounts of CPU and memory resources may be consumed although the file itself does not support the requests.
21 CVE-2017-13767 20 2017-08-30 2019-10-03
7.8
None Remote Low Not required None None Complete
In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSDP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-msdp.c by adding length validation.
22 CVE-2017-13740 119 DoS Overflow 2017-08-29 2017-12-02
6.8
None Remote Medium Not required Partial Partial Partial
There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function parseChars() in compileTranslationTable.c, that will lead to denial of service or possibly unspecified other impact.
23 CVE-2017-13739 119 DoS Exec Code Overflow 2017-08-29 2017-09-07
6.8
None Remote Medium Not required Partial Partial Partial
There is a heap-based buffer overflow that causes a more than two thousand bytes out-of-bounds write in Liblouis 3.2.0, triggered in the function resolveSubtable() in compileTranslationTable.c. It will lead to denial of service or remote code execution.
24 CVE-2017-13738 125 2017-08-29 2017-12-02
6.8
None Remote Medium Not required Partial Partial Partial
There is an illegal address access in the _lou_getALine function in compileTranslationTable.c:346 in Liblouis 3.2.0.
25 CVE-2017-13716 770 DoS 2017-08-28 2019-10-03
7.1
None Remote Medium Not required None None Complete
The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).
26 CVE-2017-13715 20 DoS Exec Code 2017-08-29 2017-09-08
10.0
None Remote Low Not required Complete Complete Complete
The __skb_flow_dissect function in net/core/flow_dissector.c in the Linux kernel before 4.3 does not ensure that n_proto, ip_proto, and thoff are initialized, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a single crafted MPLS packet.
27 CVE-2017-13709 20 2017-08-27 2017-09-06
6.4
None Remote Low Not required None Partial Partial
In FlightGear before version 2017.3.1, Main/logger.cxx in the FGLogger subsystem allows one to overwrite any file via a resource that affects the contents of the global Property Tree.
28 CVE-2017-13708 119 Exec Code Overflow 2017-08-31 2017-09-05
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the web server service in VX Search Enterprise 10.0.14 allows remote attackers to execute arbitrary code via a crafted GET request.
29 CVE-2017-13707 269 Exec Code +Priv 2017-08-27 2020-05-28
10.0
None Remote Low Not required Complete Complete Complete
Privilege escalation in Replibit Backup Manager earlier than version 2017.08.04 allows attackers to gain root privileges via sudo command execution. The vi program can be accessed through sudo, in order to navigate the filesystem and modify a critical file such as /etc/passwd.
30 CVE-2017-13686 476 DoS 2017-08-24 2017-08-30
7.2
None Local Low Not required Complete Complete Complete
net/ipv4/route.c in the Linux kernel 4.13-rc1 through 4.13-rc6 is too late to check for a NULL fi field when RTM_F_FIB_MATCH is set, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via crafted system calls. NOTE: this does not affect any stable release.
31 CVE-2017-13669 89 Sql 2017-08-24 2017-08-28
7.5
None Remote Low Not required Partial Partial Partial
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
32 CVE-2017-13147 20 2017-08-23 2019-12-03
6.8
None Remote Medium Not required Partial Partial Partial
In GraphicsMagick 1.3.26, an allocation failure vulnerability was found in the function ReadMNGImage in coders/png.c when a small MNG file has a MEND chunk with a large length value.
33 CVE-2017-13146 772 2017-08-23 2020-10-14
6.8
None Remote Medium Not required Partial Partial Partial
In ImageMagick before 6.9.8-5 and 7.x before 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.
34 CVE-2017-13139 125 2017-08-23 2020-10-14
7.5
None Remote Low Not required Partial Partial Partial
In ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1, the ReadOneMNGImage function in coders/png.c has an out-of-bounds read with the MNG CLIP chunk.
35 CVE-2017-13137 89 Sql 2017-08-23 2021-09-10
7.5
None Remote Low Not required Partial Partial Partial
The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php.
36 CVE-2017-13133 770 DoS 2017-08-23 2020-09-08
7.1
None Remote Medium Not required None None Complete
In ImageMagick 7.0.6-8, the load_level function in coders/xcf.c lacks offset validation, which allows attackers to cause a denial of service (load_tile memory exhaustion) via a crafted file.
37 CVE-2017-13130 427 +Priv 2017-08-23 2019-10-03
7.2
None Local Low Not required Complete Complete Complete
mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the RPATH variable begins with the .: substring.
38 CVE-2017-12983 119 DoS Overflow 2017-08-21 2018-06-14
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the ReadSFWImage function in coders/sfw.c in ImageMagick 7.0.6-8 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file.
39 CVE-2017-12981 89 Sql 2017-08-21 2017-08-25
7.5
None Remote Low Not required Partial Partial Partial
NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an addforum action.
40 CVE-2017-12977 89 Sql 2017-08-21 2019-07-08
6.5
None Remote Low ??? Partial Partial Partial
The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() in photo-gallery.php and edit_tag() in admin/controllers/BWGControllerTags_bwg.php. It is exploitable by administrators via the tag_id parameter.
41 CVE-2017-12976 20 Exec Code 2017-08-20 2018-09-06
6.8
None Remote Medium Not required Partial Partial Partial
git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.
42 CVE-2017-12970 352 CSRF 2017-08-23 2019-05-03
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authentication of authenticated users for requests that (1) add or (2) delete user accounts via a request to phpsftpd/users.php.
43 CVE-2017-12965 384 2017-08-23 2019-05-06
7.5
None Remote Low Not required Partial Partial Partial
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
44 CVE-2017-12964 674 DoS 2017-08-18 2019-10-03
7.8
None Remote Low Not required None None Complete
There is a stack consumption issue in LibSass 3.4.5 that is triggered in the function Sass::Eval::operator() in eval.cpp. It will lead to a remote denial of service attack.
45 CVE-2017-12955 119 DoS Overflow 2017-08-18 2017-08-22
6.8
None Remote Medium Not required Partial Partial Partial
There is a heap-based buffer overflow in basicio.cpp of Exiv2 0.26. The vulnerability causes an out-of-bounds write in Exiv2::Image::printIFDStructure(), which may lead to remote denial of service or possibly unspecified other impact.
46 CVE-2017-12949 89 Sql CSRF 2017-08-18 2017-08-24
6.5
None Remote Low ??? Partial Partial Partial
lib\modules\contributors\contributor_list_table.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF.
47 CVE-2017-12947 89 Sql 2017-08-18 2017-08-22
6.5
None Remote Low ??? Partial Partial Partial
classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators.
48 CVE-2017-12946 89 Sql 2017-08-18 2017-08-22
6.5
None Remote Low ??? Partial Partial Partial
classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators.
49 CVE-2017-12942 119 Overflow 2017-08-18 2018-06-16
7.5
None Remote Low Not required Partial Partial Partial
libunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ function.
50 CVE-2017-12941 125 2017-08-18 2018-06-16
7.5
None Remote Low Not required Partial Partial Partial
libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function.
Total number of vulnerabilities : 676   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.