Vulnerabilities (CVE)

CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2017-0612 1 Linux 1 Linux Kernel 2019-10-03 7.6 HIGH 7.0 HIGH
An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-34389303. References: QC-CR#1061845.
CVE-2017-0613 1 Linux 1 Linux Kernel 2019-10-03 7.6 HIGH 7.0 HIGH
An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35400457. References: QC-CR#1086140.
CVE-2017-0614 1 Linux 1 Linux Kernel 2019-10-03 7.6 HIGH 7.0 HIGH
An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35399405. References: QC-CR#1080290.
CVE-2017-0615 1 Google 1 Android 2019-10-03 7.6 HIGH 7.0 HIGH
An elevation of privilege vulnerability in the MediaTek power driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-34259126. References: M-ALPS03150278.
CVE-2017-0616 1 Google 1 Android 2019-10-03 7.6 HIGH 7.0 HIGH
An elevation of privilege vulnerability in the MediaTek system management interrupt driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-34470286. References: M-ALPS03149160.
CVE-2017-16365 1 Adobe 4 Acrobat, Acrobat Dc, Acrobat Reader and 1 more 2019-10-03 9.3 HIGH 8.8 HIGH
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the True Type2 Font parsing module. A corrupted cmap table input leads to a computation where the pointer arithmetic results in a location outside valid memory locations belonging to the buffer. An attack can be used to obtain sensitive information, such as object heap addresses, etc.
CVE-2017-1612 1 Ibm 1 Websphere Mq 2019-10-03 4.6 MEDIUM 7.8 HIGH
IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: 132953.
CVE-2017-17935 2 Debian, Wireshark 2 Debian Linux, Wireshark 2019-10-03 5.0 MEDIUM 7.5 HIGH
The File_read_line function in epan/wslua/wslua_file.c in Wireshark through 2.2.11 does not properly strip '\n' characters, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet that triggers the attempted processing of an empty line.
CVE-2017-0617 1 Google 1 Android 2019-10-03 7.6 HIGH 7.0 HIGH
An elevation of privilege vulnerability in the MediaTek video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-34471002. References: M-ALPS03149173.
CVE-2017-14227 1 Mongodb 1 Mongodb 2019-10-03 5.0 MEDIUM 7.5 HIGH
In MongoDB libbson 1.7.0, the bson_iter_codewscope function in bson-iter.c miscalculates a bson_utf8_validate length argument, which allows remote attackers to cause a denial of service (heap-based buffer over-read in the bson_utf8_validate function in bson-utf8.c), as demonstrated by bson-to-json.c.
CVE-2017-0618 1 Google 1 Android 2019-10-03 7.6 HIGH 7.0 HIGH
An elevation of privilege vulnerability in the MediaTek command queue driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-35100728. References: M-ALPS03161536.
CVE-2017-16374 1 Adobe 4 Acrobat, Acrobat Dc, Acrobat Reader and 1 more 2019-10-03 9.3 HIGH 8.8 HIGH
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the JPEG 2000 module. An invalid JPEG 2000 input code stream leads to a computation where the pointer arithmetic results in a location outside valid memory locations belonging to the buffer. An attack can be used to obtain sensitive information, such as object heap addresses, etc.
CVE-2017-0636 1 Google 1 Android 2019-10-03 7.6 HIGH 7.0 HIGH
An elevation of privilege vulnerability in the MediaTek command queue driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-35310230. References: M-ALPS03162263.
CVE-2017-14198 1 Squiz 1 Matrix 2019-10-03 6.5 MEDIUM 8.8 HIGH
An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. Authenticated users with permissions to edit design assets can cause Remote Code Execution (RCE) via a maliciously crafted time_format tag.
CVE-2017-0638 1 Google 1 Android 2019-10-03 6.8 MEDIUM 7.8 HIGH
A remote code execution vulnerability in System UI component could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High because it is a remote arbitrary code execution in an unprivileged process. Product: Android. Versions: 7.1.1, 7.1.2. Android ID: A-36368305.
CVE-2017-14178 1 Snapcraft 1 Snapd 2019-10-03 5.0 MEDIUM 7.5 HIGH
In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileged, unauthenticated users to bypass systemd-journald's access restrictions.
CVE-2017-14176 2 Canonical, Debian 3 Bazaar, Ubuntu Linux, Debian Linux 2019-10-03 9.3 HIGH 8.8 HIGH
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
CVE-2017-16363 1 Adobe 4 Acrobat, Acrobat Dc, Acrobat Reader and 1 more 2019-10-03 9.3 HIGH 8.8 HIGH
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the module that handles character codes for certain textual representations. Invalid input leads to a computation where the pointer arithmetic results in a location outside valid memory locations belonging to the buffer. An attack can be used to obtain sensitive information, such as object heap addresses, etc.
CVE-2017-16674 1 Datto 1 Windows Agent 2019-10-03 4.9 MEDIUM 8.0 HIGH
Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary whitelisted command and a secondary non-whitelisted command. This affects Datto Windows Agent (DWA) 1.0.5.0 and earlier. In other words, an attacker could combine this "primary/secondary" attack with the CVE-2017-16673 "rogue pairing" attack to achieve unauthenticated access to all agent machines running these older DWA versions.
CVE-2017-0648 1 Linux 1 Linux Kernel 2019-10-03 9.3 HIGH 7.8 HIGH
An elevation of privilege vulnerability in the kernel FIQ debugger could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-36101220.
CVE-2017-16857 1 Atlassian 1 Bitbucket Auto Unapprove Plugin 2019-10-03 6.0 MEDIUM 8.5 HIGH
It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end. This allows an attacker to merge any code into unsuspecting repositories. This affects all versions of the auto-unapprove plugin, however since the auto-unapprove plugin is not bundled with Bitbucket Server it does not affect any particular version of Bitbucket.
CVE-2017-16939 1 Linux 1 Linux Kernel 2019-10-03 7.2 HIGH 7.8 HIGH
The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.
CVE-2017-14111 1 Philips 2 Intellispace Cardiovascular, Xcelera 2019-10-03 4.0 MEDIUM 7.2 HIGH
The workstation logging function in Philips IntelliSpace Cardiovascular (ISCV) 2.3.0 and earlier and Xcelera R4.1L1 and earlier records domain authentication credentials, which if accessed allows an attacker to use credentials to access the application, or other user entitlements.
CVE-2017-14086 1 Trendmicro 1 Officescan 2019-10-03 7.8 HIGH 7.5 HIGH
Pre-authorization Start Remote Process vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan server to start the fcgiOfcDDA.exe executable or cause a potential INI corruption, which may cause the server disk space to be consumed with dump files from continuous HTTP requests.
CVE-2017-0667 1 Google 1 Android 2019-10-03 9.3 HIGH 7.8 HIGH
A elevation of privilege vulnerability in the Android framework. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37478824.
CVE-2017-14084 1 Trendmicro 1 Officescan 2019-10-03 6.8 MEDIUM 8.1 HIGH
A potential Man-in-the-Middle (MitM) attack vulnerability in Trend Micro OfficeScan 11.0 and XG may allow attackers to execute arbitrary code on vulnerable installations.
CVE-2017-14083 1 Trendmicro 1 Officescan 2019-10-03 5.0 MEDIUM 7.5 HIGH
A vulnerability in Trend Micro OfficeScan 11.0 and XG allows remote unauthenticated users who can access the system to download the OfficeScan encryption file.
CVE-2017-1694 1 Ibm 1 Integration Bus 2019-10-03 4.3 MEDIUM 8.1 HIGH
IBM Integration Bus 9.0 and 10.0 transmits user credentials in plain in clear text which can be read by an attacker using man in the middle techniques. IBM X-Force ID: 134165.
CVE-2017-0683 1 Google 1 Android 2019-10-03 9.3 HIGH 7.8 HIGH
A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36591008.
CVE-2017-0684 1 Google 1 Android 2019-10-03 9.3 HIGH 7.8 HIGH
A elevation of privilege vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35421151.
CVE-2017-0703 1 Google 1 Android 2019-10-03 9.3 HIGH 7.8 HIGH
A elevation of privilege vulnerability in the Android system ui. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-33123882.
CVE-2017-16873 1 Hashicorp 1 Vagrant Vmware Fusion 2019-10-03 7.2 HIGH 7.8 HIGH
It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to escalate to root privileges.
CVE-2017-0704 1 Google 1 Android 2019-10-03 6.8 MEDIUM 7.8 HIGH
A elevation of privilege vulnerability in the Android system ui. Product: Android. Versions: 7.1.1, 7.1.2. Android ID: A-33059280.
CVE-2017-0716 1 Google 1 Android 2019-10-03 9.3 HIGH 7.8 HIGH
A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37203196.
CVE-2017-13989 1 Hp 2 Arcsight Enterprise Security Manager, Arcsight Enterprise Security Manager Express 2019-10-03 5.5 MEDIUM 8.1 HIGH
An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to retrieve or modify storage information.
CVE-2017-0718 1 Google 1 Android 2019-10-03 9.3 HIGH 7.8 HIGH
A remote code execution vulnerability in the Android media framework (mpeg2 decoder). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37273547.
CVE-2017-0719 1 Google 1 Android 2019-10-03 9.3 HIGH 7.8 HIGH
A remote code execution vulnerability in the Android media framework (mpeg2 decoder). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37273673.
CVE-2017-0720 1 Google 1 Android 2019-10-03 9.3 HIGH 7.8 HIGH
A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37430213.
CVE-2017-0727 1 Google 1 Android 2019-10-03 6.8 MEDIUM 7.8 HIGH
A elevation of privilege vulnerability in the Android media framework (libgui). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-33004354.
CVE-2017-13903 1 Apple 2 Iphone Os, Tvos 2019-10-03 5.0 MEDIUM 7.5 HIGH
An issue was discovered in certain Apple products. iOS before 11.2.1 is affected. tvOS before 11.2.1 is affected. The issue involves the "HomeKit" component. It allows remote attackers to modify the application state by leveraging incorrect message handling, as demonstrated by use of an Apple Watch to obtain an encryption key and unlock a door.
CVE-2017-0728 1 Google 1 Android 2019-10-03 4.3 MEDIUM 7.8 HIGH
A denial of service vulnerability in the Android media framework (hevc decoder). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37469795.
CVE-2017-13871 1 Apple 1 Mac Os X 2019-10-03 5.0 MEDIUM 7.5 HIGH
An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Mail" component. It allows remote attackers to read cleartext e-mail content (for which S/MIME encryption was intended) by leveraging the lack of installation of an S/MIME certificate by the recipient.
CVE-2017-0729 1 Google 1 Android 2019-10-03 6.8 MEDIUM 7.8 HIGH
A elevation of privilege vulnerability in the Android media framework (mediadrmserver). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37710346.
CVE-2017-0762 1 Google 1 Android 2019-10-03 9.3 HIGH 7.8 HIGH
A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-62214264.
CVE-2017-0763 1 Google 1 Android 2019-10-03 9.3 HIGH 7.8 HIGH
A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62534693.
CVE-2017-13837 1 Apple 1 Mac Os X 2019-10-03 5.0 MEDIUM 7.5 HIGH
An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the "Installer" component. It does not properly restrict an app's entitlements for accessing the FileVault unlock key.
CVE-2017-0764 1 Google 1 Android 2019-10-03 9.3 HIGH 7.8 HIGH
A remote code execution vulnerability in the Android media framework (libvorbis). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62872015.
CVE-2017-0765 1 Google 1 Android 2019-10-03 9.3 HIGH 7.8 HIGH
A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62872863.
CVE-2017-0766 1 Google 1 Android 2019-10-03 9.3 HIGH 7.8 HIGH
A remote code execution vulnerability in the Android media framework (libjhead). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37776688.
CVE-2017-11564 1 Dlink 2 Eyeon Baby Monitor, Eyeon Baby Monitor Firmware 2019-10-03 9.0 HIGH 8.8 HIGH
The D-Link EyeOn Baby Monitor (DCS-825L) 1.08.1 has multiple command injection vulnerabilities in the web service framework. An attacker can forge malicious HTTP requests to execute commands; authentication is required before executing the attack.