CVEs from 2017
Total
11,681
critical
critical 1,647
high
high 5,041
medium
medium 4,168
low
low 159
% Critical
14.1%
% with KEV
0.7%
% with exploit
9.8%
Top vendors
Top products
- imagemagick 1,426
- joomla\! 932
- kanboard 848
- ntp 762
- tomcat 676
- mahara 572
- postgresql 492
- asterisk 435
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-7798 | critical | — | 9.5 | — | The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code. In the worst case, this could allow arbitrary code execution when open… | |||
| CVE-2017-5374 | critical | — | 9.5 | — | Memory safety bugs were reported in Firefox 50.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary… | |||
| CVE-2017-5407 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-5419 | critical | — | 9.5 | — | If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the operating system. This is a denial of servi… | |||
| CVE-2017-5400 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7779 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-15398 | critical | — | 9.5 | — | arbitrary code execution in chromium | |||
| CVE-2017-7838 | critical | — | 9.5 | — | Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-domain triggers the punycode display instead of the primary domain being displayed … | |||
| CVE-2017-7000 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-5432 | critical | — | 9.5 | — | A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR … | |||
| CVE-2017-5446 | critical | — | 9.5 | — | An out-of-bounds read when an HTTP/2 connection to a servers sends "DATA" frames with incorrect data content. This leads to a potentially exploitable crash. This vulnerability affects Thunderbird < 5… | |||
| CVE-2017-7791 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7792 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7802 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-15399 | critical | — | 9.5 | — | arbitrary code execution in chromium | |||
| CVE-2017-15396 | critical | — | 9.5 | — | arbitrary code execution in chromium | |||
| CVE-2017-15415 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-7803 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-5472 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7828 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-5436 | critical | — | 9.5 | — | An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as… | |||
| CVE-2017-5405 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-5393 | critical | — | 9.5 | — | The "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessible site. This could allow malicious extensions to install additional extensions… | |||
| CVE-2017-15389 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-5391 | critical | — | 9.5 | — | Special "about:" pages used by web content, such as RSS feeds, can load privileged "about:" pages in an iframe. If a content-injection bug were found in one of those pages this could allow for potent… | |||
| CVE-2017-15427 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-7749 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-15410 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-5373 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-15424 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-7752 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-5376 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-15420 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-5420 | critical | — | 9.5 | — | A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to spoof an existing page without the malicious pag… | |||
| CVE-2017-7800 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7778 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-5378 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7753 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-15418 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-5380 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7784 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7787 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-5398 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7785 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7786 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-15417 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-5131 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-7830 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-5402 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7826 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-15411 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-5401 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-15392 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-7762 | critical | — | 9.5 | — | When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. This vulnerabilit… | |||
| CVE-2017-15391 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-15394 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-5129 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-7819 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-5125 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-5390 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7814 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7823 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-5383 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7810 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7807 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-5396 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-5410 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7809 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-7801 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-5454 | critical | — | 9.5 | — | A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This all… | |||
| CVE-2017-5443 | critical | — | 9.5 | — | An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. | |||
| CVE-2017-5427 | critical | — | 9.5 | — | A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user with local access puts chrome.manifest and other referenced f… | |||
| CVE-2017-5403 | critical | — | 9.5 | — | When adding a range to an object in the DOM, it is possible to use "addRange" to add the range to an incorrect root object. This triggers a use-after-free, resulting in a potentially exploitable cras… | |||
| CVE-2017-5455 | critical | — | 9.5 | — | The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with another vulnerability that resulted in remote code execution i… | |||
| CVE-2017-5469 | critical | — | 9.5 | — | Fixed potential buffer overflows in generated Firefox code due to CVE-2016-6354 issue in Flex. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. | |||
| CVE-2017-5466 | critical | — | 9.5 | — | If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page with its origin set in… | |||
| CVE-2017-12375 | critical | — | 9.5 | — | The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device… | |||
| CVE-2017-5458 | critical | — | 9.5 | — | When a "javascript:" URL is drag and dropped by a user into the addressbar, the URL will be processed and executed. This allows for users to be socially engineered to execute an XSS attack on themsel… | |||
| CVE-2017-5456 | critical | — | 9.5 | — | A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. T… | |||
| CVE-2017-12379 | critical | — | 9.5 | — | ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute ar… | |||
| CVE-2017-5414 | critical | — | 9.5 | — | The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead to information disclosure, such as the operating system or … | |||
| CVE-2017-5413 | critical | — | 9.5 | — | A segmentation fault can occur during some bidirectional layout operations. This vulnerability affects Firefox < 52 and Thunderbird < 52. | |||
| CVE-2017-2885 | critical | — | 9.5 | — | An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker … | |||
| CVE-2017-5433 | critical | — | 9.5 | — | A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller while still in use. This results in a poten… | |||
| CVE-2017-5412 | critical | — | 9.5 | — | A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects Firefox < 52 and Thunderbird < 52. | |||
| CVE-2017-7788 | critical | — | 9.5 | — | When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's Content Security Policy (CSP) as it should unless the sandb… | |||
| CVE-2017-7818 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-15425 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-5422 | critical | — | 9.5 | — | If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploitable browser crash when the hyperlink is selected. This was fixed by no longer … | |||
| CVE-2017-7751 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-5417 | critical | — | 9.5 | — | When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that the displayed location following navigation does not match t… | |||
| CVE-2017-5460 | critical | — | 9.5 | — | A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This results in a potentially exploitable crash. This vulnerability… | |||
| CVE-2017-5459 | critical | — | 9.5 | — | A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox… | |||
| CVE-2017-7794 | critical | — | 9.5 | — | On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though the sandbox explicitly only has read access to the local file system and no wr… | |||
| CVE-2017-5444 | critical | — | 9.5 | — | A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains improperly formatted data. This allows for an out-of-bounds read of data from mem… | |||
| CVE-2017-7750 | critical | — | 9.5 | — | multiple issues in thunderbird | |||
| CVE-2017-5434 | critical | — | 9.5 | — | A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR … | |||
| CVE-2017-12374 | critical | — | 9.5 | — | The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device… | |||
| CVE-2017-15408 | critical | — | 9.5 | — | multiple issues in chromium | |||
| CVE-2017-5430 | critical | — | 9.5 | — | Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these c… |