CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In June 2017

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
451 CVE-2017-7676 20 2017-06-14 2017-06-19
7.5
None Remote Low Not required Partial Partial Partial
Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can result in unintended behavior.
452 CVE-2017-7669 20 2017-06-05 2017-06-09
8.5
None Remote Medium ??? Complete Complete Complete
In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.
453 CVE-2017-7668 20 2017-06-20 2021-06-06
7.5
None Remote Low Not required Partial Partial Partial
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
454 CVE-2017-7667 346 2017-06-12 2017-06-19
5.0
None Remote Low Not required None Partial None
Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin.
455 CVE-2017-7665 79 XSS 2017-06-12 2017-06-19
4.3
None Remote Medium Not required None Partial None
In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient.
456 CVE-2017-7629 640 2017-06-15 2017-06-22
5.0
None Remote Low Not required None Partial None
QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function.
457 CVE-2017-7564 20 DoS 2017-06-07 2017-06-15
5.0
None Remote Low Not required None None Partial
In ARM Trusted Firmware through 1.3, the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of service (secure world panic) via vectors involving debug exceptions and debug registers.
458 CVE-2017-7563 732 Bypass 2017-06-07 2019-10-03
6.8
None Remote Medium Not required Partial Partial Partial
In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT_EXECUTE_NEVER protection mechanism. This issue occurs because of inconsistency in the number of execute-never bits (one bit versus two bits).
459 CVE-2017-7524 522 2017-06-27 2019-10-09
5.0
None Remote Low Not required Partial None None
tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC.
460 CVE-2017-7522 476 2017-06-27 2017-07-07
4.0
None Remote Low ??? None None Partial
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.
461 CVE-2017-7521 415 2017-06-27 2019-10-03
4.3
None Remote Medium Not required None None Partial
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension().
462 CVE-2017-7520 125 2017-06-27 2019-10-03
4.0
None Remote High Not required Partial None Partial
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.
463 CVE-2017-7515 674 2017-06-06 2019-10-09
4.3
None Remote Medium Not required None None Partial
poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-of-service.
464 CVE-2017-7508 617 2017-06-27 2019-10-03
5.0
None Remote Low Not required None None Partial
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.
465 CVE-2017-7507 476 2017-06-16 2018-01-05
5.0
None Remote Low Not required None None Partial
GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application.
466 CVE-2017-7496 755 2017-06-26 2019-10-09
4.4
None Local Medium Not required Partial Partial Partial
fedora-arm-installer up to and including 1.99.16 is vulnerable to local privilege escalation due to lack of checking the error condition of mount operation failure on unsafely created temporary directories.
467 CVE-2017-7459 74 Http R.Spl. 2017-06-26 2019-10-03
5.0
None Remote Low Not required None Partial None
ntopng before 3.0 allows HTTP Response Splitting.
468 CVE-2017-7458 476 DoS 2017-06-26 2017-06-29
5.0
None Remote Low Not required None None Partial
The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty field that should have contained a hostname or IP address.
469 CVE-2017-7416 79 XSS 2017-06-26 2017-06-29
4.3
None Remote Medium Not required None Partial None
ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated.
470 CVE-2017-7384 79 XSS 2017-06-01 2017-06-09
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in FlipBuilder Flip PDF allows remote attackers to inject arbitrary web script or HTML via the currentHTMLURL parameter.
471 CVE-2017-7373 415 2017-06-13 2017-07-08
9.3
None Remote Medium Not required Complete Complete Complete
In all Android releases from CAF using the Linux kernel, a double free vulnerability exists in a display driver.
472 CVE-2017-7372 119 Overflow 2017-06-13 2017-07-08
7.6
None Remote High Not required Complete Complete Complete
In all Android releases from CAF using the Linux kernel, a race condition exists in a video driver potentially leading to buffer overflow or write to arbitrary pointer location.
473 CVE-2017-7371 416 2017-06-13 2017-07-08
9.3
None Remote Medium Not required Complete Complete Complete
In all Android releases from CAF using the Linux kernel, a data pointer is potentially used after it has been freed when SLIMbus is turned off by Bluetooth.
474 CVE-2017-7370 416 2017-06-13 2017-07-08
7.6
None Remote High Not required Complete Complete Complete
In all Android releases from CAF using the Linux kernel, a race condition exists in a video driver potentially leading to a use-after-free condition.
475 CVE-2017-7369 20 2017-06-13 2017-07-08
9.3
None Remote Medium Not required Complete Complete Complete
In all Android releases from CAF using the Linux kernel, an array index in an ALSA routine is not properly validating potentially leading to kernel stack corruption.
476 CVE-2017-7368 362 2017-06-13 2017-07-08
7.6
None Remote High Not required Complete Complete Complete
In all Android releases from CAF using the Linux kernel, a race condition potentially exists in the ioctl handler of a sound driver.
477 CVE-2017-7367 191 2017-06-13 2017-07-08
9.3
None Remote Medium Not required Complete Complete Complete
In all Android releases from CAF using the Linux kernel, an integer underflow vulnerability exists while processing the boot image.
478 CVE-2017-7366 20 2017-06-13 2017-07-08
4.3
None Remote Medium Not required None Partial None
In all Android releases from CAF using the Linux kernel, a KGSL ioctl was not validating all of its parameters.
479 CVE-2017-7365 125 2017-06-13 2019-10-03
9.3
None Remote Medium Not required Complete Complete Complete
In all Android releases from CAF using the Linux kernel, a buffer overread can occur if a particular string is not NULL terminated.
480 CVE-2017-7314 287 2017-06-07 2017-06-14
5.0
None Remote Low Not required Partial None None
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, while creating a new role, a list of database tables and their columns is available.
481 CVE-2017-7313 200 +Info 2017-06-07 2017-06-14
5.0
None Remote Low Not required Partial None None
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, it is possible to read any customer name, master Customer Id, and email address. In other words, anyone can search for users/customers in the system - no authentication is required.
482 CVE-2017-7312 269 2017-06-07 2020-05-13
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Personify360 e-Business 7.5.2 through 7.6.1. When going to the /TabId/275 URI, anyone can add a vendor account or read existing vendor account data (including usernames and passwords).
483 CVE-2017-7180 428 Bypass 2017-06-08 2021-05-25
6.9
None Local Medium Not required Complete Complete Complete
Net Monitor for Employees Pro through 5.3.4 has an unquoted service path, which allows a Security Feature Bypass of its documented "Block applications" design goal. The local attacker must have privileges to write to program.exe in a protected directory, such as the %SYSTEMDRIVE% directory, and thus the issue is not interpreted as a direct privilege escalation. However, the local attacker might have the goal of executing program.exe even though program.exe is a blocked application.
484 CVE-2017-6899 476 DoS 2017-06-16 2017-07-05
4.9
None Local Low Not required None None Complete
The msm_bus_dbg_update_request_write function in drivers/platform/msm/msm_bus/msm_bus_dbg.c in android_kernel_huawei_msm8916 through 2017-06-16 in LineageOS, and possibly other kernels for MSM devices, allows attackers to cause a denial of service (NULL pointer dereference and device crash) via a crafted /sys/kernel/debug/msm-bus-dbg/client-data/update-request write request.
485 CVE-2017-6892 119 Overflow 2017-06-12 2020-10-29
6.8
None Remote Medium Not required Partial Partial Partial
In libsndfile version 1.0.28, an error in the "aiff_read_chanmap()" function (aiff.c) can be exploited to cause an out-of-bounds read memory access via a specially crafted AIFF file.
486 CVE-2017-6697 200 +Info 2017-06-13 2017-06-20
4.0
None Remote Low ??? Partial None None
A vulnerability in the web interface of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to access sensitive system credentials that are stored in an affected system. More Information: CSCvd76339. Known Affected Releases: 2.2(9.76).
487 CVE-2017-6696 200 +Info 2017-06-13 2017-06-20
2.1
None Local Low Not required Partial None None
A vulnerability in the file system of Cisco Elastic Services Controllers could allow an authenticated, local attacker to gain access to sensitive user credentials that are stored in an affected system. More Information: CSCvd73677. Known Affected Releases: 2.3(2).
488 CVE-2017-6695 200 +Info 2017-06-13 2017-06-20
2.1
None Local Low Not required Partial None None
A vulnerability in the ConfD server in Cisco Ultra Services Platform could allow an authenticated, local attacker to view sensitive information. More Information: CSCvd29398. Known Affected Releases: 21.0.v0.65839.
489 CVE-2017-6694 522 2017-06-13 2019-10-03
2.1
None Local Low Not required Partial None None
A vulnerability in the Virtual Network Function Manager's (VNFM) logging function of Cisco Ultra Services Platform could allow an authenticated, local attacker to view sensitive data (cleartext credentials) on an affected system. More Information: CSCvd29355. Known Affected Releases: 21.0.v0.65839.
490 CVE-2017-6693 862 2017-06-13 2019-10-03
2.1
None Local Low Not required Partial None None
A vulnerability in the ConfD server component of Cisco Elastic Services Controllers could allow an authenticated, local attacker to access information stored in the file system of an affected system, aka Unauthorized Directory Access. More Information: CSCvd76286. Known Affected Releases: 2.2(9.76) 2.3(1).
491 CVE-2017-6692 1188 2017-06-13 2019-10-03
9.0
None Remote Low ??? Complete Complete Complete
A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker to log in to the device with the privileges of the root user, aka an Insecure Default Account Information Vulnerability. More Information: CSCvd85710. Known Affected Releases: 21.0.v0.65839.
492 CVE-2017-6691 200 +Info 2017-06-13 2017-06-20
4.0
None Remote Low ??? Partial None None
A vulnerability in the ConfD CLI of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to access sensitive information on an affected system. More Information: CSCvd29403. Known Affected Releases: 2.3(2).
493 CVE-2017-6690 20 2017-06-13 2019-10-03
4.0
None Remote Low ??? None Partial None
A vulnerability in the file check operation of Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, remote attacker to overwrite or modify arbitrary files on an affected system. More Information: CSCvd73726. Known Affected Releases: 21.0.v0.65839 21.3.M0.67005. Known Fixed Releases: 21.4.A0.67087 21.4.A0.67079 21.4.A0.67013 21.3.M0.67084 21.3.M0.67077 21.3.M0.66994 21.3.J0.66993 21.1.v0.67082 21.1.V0.67083.
494 CVE-2017-6689 1188 2017-06-13 2019-10-03
6.5
None Remote Low ??? Partial Partial Partial
A vulnerability in the ConfD CLI of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to log in to an affected system as the admin user, aka an Insecure Default Administrator Credentials Vulnerability. More Information: CSCvc76661. Known Affected Releases: 2.2(9.76).
495 CVE-2017-6688 1188 2017-06-13 2019-10-03
9.0
None Remote Low ??? Complete Complete Complete
A vulnerability in Cisco Elastic Services Controllers could allow an authenticated, remote attacker to log in to an affected system as the Linux root user, aka an Insecure Default Password Vulnerability. More Information: CSCvc76631. Known Affected Releases: 2.2(9.76).
496 CVE-2017-6687 1188 2017-06-13 2019-10-03
6.5
None Remote Low ??? Partial Partial Partial
A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker with access to the management network to log in to the affected device using default credentials present on the system, aka an Insecure Default Password Vulnerability. More Information: CSCvc76695. Known Affected Releases: 21.0.0.
497 CVE-2017-6686 1188 2017-06-13 2019-10-03
6.5
None Remote Low ??? Partial Partial Partial
A vulnerability in Cisco Ultra Services Framework Element Manager could allow an authenticated, remote attacker with access to the management network to log in as an admin or oper user of the affected device, aka an Insecure Default Credentials Vulnerability. More Information: CSCvc76699. Known Affected Releases: 21.0.0.
498 CVE-2017-6685 1188 2017-06-13 2019-10-03
6.5
None Remote Low ??? Partial Partial Partial
A vulnerability in Cisco Ultra Services Framework Staging Server could allow an authenticated, remote attacker with access to the management network to log in as an admin user of the affected device, aka an Insecure Default Credentials Vulnerability. More Information: CSCvc76681. Known Affected Releases: 21.0.0.
499 CVE-2017-6684 1188 2017-06-13 2019-10-03
9.0
None Remote Low ??? Complete Complete Complete
A vulnerability in Cisco Elastic Services Controllers could allow an authenticated, remote attacker to log in to an affected system as the Linux admin user, aka an Insecure Default Credentials Vulnerability. More Information: CSCvc76651. Known Affected Releases: 21.0.0.
500 CVE-2017-6683 78 Exec Code 2017-06-13 2017-06-23
9.0
None Remote Low ??? Complete Complete Complete
A vulnerability in the esc_listener.py script of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to execute arbitrary commands as the tomcat user on an affected system, aka an Authentication Request Processing Arbitrary Command Execution Vulnerability. More Information: CSCvc76642. Known Affected Releases: 2.2(9.76).
Total number of vulnerabilities : 1037   Page : 1 2 3 4 5 6 7 8 9 10 (This Page)11 12 13 14 15 16 17 18 19 20 21
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.