CVEs from 2017
Total
11,933
critical
critical 1,647
high
high 5,043
medium
medium 4,165
low
low 159
% Critical
13.8%
% with KEV
0.7%
% with exploit
0.8%
Top vendors
Top products
- imagemagick 1,426
- joomla\! 932
- kanboard 848
- ntp 762
- tomcat 676
- mahara 572
- postgresql 492
- asterisk 435
| CVE | Severity | CVSS | Risk | Published | Description | Impact |
|---|---|---|---|---|---|---|
| CVE-2017-13044 | critical | 9.8 | 9.8 | 9y ago | The HNCP parser in tcpdump before 4.9.2 has a buffer over-read in print-hncp.c:dhcpv4_print(). | |
| CVE-2017-13043 | critical | 9.8 | 9.8 | 9y ago | The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:decode_multicast_vpn(). | |
| CVE-2017-13042 | critical | 9.8 | 9.8 | 9y ago | The HNCP parser in tcpdump before 4.9.2 has a buffer over-read in print-hncp.c:dhcpv6_print(). | |
| CVE-2017-13041 | critical | 9.8 | 9.8 | 9y ago | The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_nodeinfo_print(). | |
| CVE-2017-13040 | critical | 9.8 | 9.8 | 9y ago | The MPTCP parser in tcpdump before 4.9.2 has a buffer over-read in print-mptcp.c, several functions. | |
| CVE-2017-13039 | critical | 9.8 | 9.8 | 9y ago | The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c, several functions. | |
| CVE-2017-13038 | critical | 9.8 | 9.8 | 9y ago | The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:handle_mlppp(). | |
| CVE-2017-13037 | critical | 9.8 | 9.8 | 9y ago | The IP parser in tcpdump before 4.9.2 has a buffer over-read in print-ip.c:ip_printts(). | |
| CVE-2017-13036 | critical | 9.8 | 9.8 | 9y ago | The OSPFv3 parser in tcpdump before 4.9.2 has a buffer over-read in print-ospf6.c:ospf6_decode_v3(). | |
| CVE-2017-13035 | critical | 9.8 | 9.8 | 9y ago | The ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print_id(). | |
| CVE-2017-13034 | critical | 9.8 | 9.8 | 9y ago | The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print(). | |
| CVE-2017-13033 | critical | 9.8 | 9.8 | 9y ago | The VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print(). | |
| CVE-2017-13032 | critical | 9.8 | 9.8 | 9y ago | The RADIUS parser in tcpdump before 4.9.2 has a buffer over-read in print-radius.c:print_attr_string(). | |
| CVE-2017-13031 | critical | 9.8 | 9.8 | 9y ago | The IPv6 fragmentation header parser in tcpdump before 4.9.2 has a buffer over-read in print-frag6.c:frag6_print(). | |
| CVE-2017-13030 | critical | 9.8 | 9.8 | 9y ago | The PIM parser in tcpdump before 4.9.2 has a buffer over-read in print-pim.c, several functions. | |
| CVE-2017-13029 | critical | 9.8 | 9.8 | 9y ago | The PPP parser in tcpdump before 4.9.2 has a buffer over-read in print-ppp.c:print_ccp_config_options(). | |
| CVE-2017-13028 | critical | 9.8 | 9.8 | 9y ago | The BOOTP parser in tcpdump before 4.9.2 has a buffer over-read in print-bootp.c:bootp_print(). | |
| CVE-2017-13027 | critical | 9.8 | 9.8 | 9y ago | The LLDP parser in tcpdump before 4.9.2 has a buffer over-read in print-lldp.c:lldp_mgmt_addr_tlv_print(). | |
| CVE-2017-13026 | critical | 9.8 | 9.8 | 9y ago | The ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c, several functions. | |
| CVE-2017-13025 | critical | 9.8 | 9.8 | 9y ago | The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print(). | |
| CVE-2017-13024 | critical | 9.8 | 9.8 | 9y ago | The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print(). | |
| CVE-2017-13023 | critical | 9.8 | 9.8 | 9y ago | The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print(). | |
| CVE-2017-13022 | critical | 9.8 | 9.8 | 9y ago | The IP parser in tcpdump before 4.9.2 has a buffer over-read in print-ip.c:ip_printroute(). | |
| CVE-2017-13021 | critical | 9.8 | 9.8 | 9y ago | The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_print(). | |
| CVE-2017-13020 | critical | 9.8 | 9.8 | 9y ago | The VTP parser in tcpdump before 4.9.2 has a buffer over-read in print-vtp.c:vtp_print(). | |
| CVE-2017-13019 | critical | 9.8 | 9.8 | 9y ago | The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print(). | |
| CVE-2017-13018 | critical | 9.8 | 9.8 | 9y ago | The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print(). | |
| CVE-2017-13017 | critical | 9.8 | 9.8 | 9y ago | The DHCPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-dhcp6.c:dhcp6opt_print(). | |
| CVE-2017-13016 | critical | 9.8 | 9.8 | 9y ago | The ISO ES-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:esis_print(). | |
| CVE-2017-13015 | critical | 9.8 | 9.8 | 9y ago | The EAP parser in tcpdump before 4.9.2 has a buffer over-read in print-eap.c:eap_print(). | |
| CVE-2017-13014 | critical | 9.8 | 9.8 | 9y ago | The White Board protocol parser in tcpdump before 4.9.2 has a buffer over-read in print-wb.c:wb_prep(), several functions. | |
| CVE-2017-13013 | critical | 9.8 | 9.8 | 9y ago | The ARP parser in tcpdump before 4.9.2 has a buffer over-read in print-arp.c, several functions. | |
| CVE-2017-13012 | critical | 9.8 | 9.8 | 9y ago | The ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print(). | |
| CVE-2017-13011 | critical | 9.8 | 9.8 | 9y ago | Several protocol parsers in tcpdump before 4.9.2 could cause a buffer overflow in util-print.c:bittok2str_internal(). | |
| CVE-2017-13010 | critical | 9.8 | 9.8 | 9y ago | The BEEP parser in tcpdump before 4.9.2 has a buffer over-read in print-beep.c:l_strnstart(). | |
| CVE-2017-13009 | critical | 9.8 | 9.8 | 9y ago | The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_print(). | |
| CVE-2017-13008 | critical | 9.8 | 9.8 | 9y ago | The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_11.c:parse_elements(). | |
| CVE-2017-13007 | critical | 9.8 | 9.8 | 9y ago | The Apple PKTAP parser in tcpdump before 4.9.2 has a buffer over-read in print-pktap.c:pktap_if_print(). | |
| CVE-2017-13006 | critical | 9.8 | 9.8 | 9y ago | The L2TP parser in tcpdump before 4.9.2 has a buffer over-read in print-l2tp.c, several functions. | |
| CVE-2017-13005 | critical | 9.8 | 9.8 | 9y ago | The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:xid_map_enter(). | |
| CVE-2017-13004 | critical | 9.8 | 9.8 | 9y ago | The Juniper protocols parser in tcpdump before 4.9.2 has a buffer over-read in print-juniper.c:juniper_parse_header(). | |
| CVE-2017-13003 | critical | 9.8 | 9.8 | 9y ago | The LMP parser in tcpdump before 4.9.2 has a buffer over-read in print-lmp.c:lmp_print(). | |
| CVE-2017-13002 | critical | 9.8 | 9.8 | 9y ago | The AODV parser in tcpdump before 4.9.2 has a buffer over-read in print-aodv.c:aodv_extension(). | |
| CVE-2017-13001 | critical | 9.8 | 9.8 | 9y ago | The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:nfs_printfh(). | |
| CVE-2017-13000 | critical | 9.8 | 9.8 | 9y ago | The IEEE 802.15.4 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_15_4.c:ieee802_15_4_if_print(). | |
| CVE-2017-12999 | critical | 9.8 | 9.8 | 9y ago | The IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print(). | |
| CVE-2017-12998 | critical | 9.8 | 9.8 | 9y ago | The IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print_extd_ip_reach(). | |
| CVE-2017-12997 | critical | 9.8 | 9.8 | 9y ago | The LLDP parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in print-lldp.c:lldp_private_8021_print(). | |
| CVE-2017-12996 | critical | 9.8 | 9.8 | 9y ago | The PIMv2 parser in tcpdump before 4.9.2 has a buffer over-read in print-pim.c:pimv2_print(). | |
| CVE-2017-12995 | critical | 9.8 | 9.8 | 9y ago | The DNS parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in print-domain.c:ns_print(). | |
| CVE-2017-12994 | critical | 9.8 | 9.8 | 9y ago | The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:bgp_attr_print(). | |
| CVE-2017-12993 | critical | 9.8 | 9.8 | 9y ago | The Juniper protocols parser in tcpdump before 4.9.2 has a buffer over-read in print-juniper.c, several functions. | |
| CVE-2017-12992 | critical | 9.8 | 9.8 | 9y ago | The RIPng parser in tcpdump before 4.9.2 has a buffer over-read in print-ripng.c:ripng_print(). | |
| CVE-2017-12991 | critical | 9.8 | 9.8 | 9y ago | The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:bgp_attr_print(). | |
| CVE-2017-12990 | critical | 9.8 | 9.8 | 9y ago | The ISAKMP parser in tcpdump before 4.9.2 could enter an infinite loop due to bugs in print-isakmp.c, several functions. | |
| CVE-2017-12988 | critical | 9.8 | 9.8 | 9y ago | The telnet parser in tcpdump before 4.9.2 has a buffer over-read in print-telnet.c:telnet_parse(). | |
| CVE-2017-12987 | critical | 9.8 | 9.8 | 9y ago | The IEEE 802.11 parser in tcpdump before 4.9.2 has a buffer over-read in print-802_11.c:parse_elements(). | |
| CVE-2017-12986 | critical | 9.8 | 9.8 | 9y ago | The IPv6 routing header parser in tcpdump before 4.9.2 has a buffer over-read in print-rt6.c:rt6_print(). | |
| CVE-2017-12985 | critical | 9.8 | 9.8 | 9y ago | The IPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-ip6.c:ip6_print(). | |
| CVE-2017-12902 | critical | 9.8 | 9.8 | 9y ago | The Zephyr parser in tcpdump before 4.9.2 has a buffer over-read in print-zephyr.c, several functions. | |
| CVE-2017-12901 | critical | 9.8 | 9.8 | 9y ago | The EIGRP parser in tcpdump before 4.9.2 has a buffer over-read in print-eigrp.c:eigrp_print(). | |
| CVE-2017-12900 | critical | 9.8 | 9.8 | 9y ago | Several protocol parsers in tcpdump before 4.9.2 could cause a buffer over-read in util-print.c:tok2strbuf(). | |
| CVE-2017-12899 | critical | 9.8 | 9.8 | 9y ago | The DECnet parser in tcpdump before 4.9.2 has a buffer over-read in print-decnet.c:decnet_print(). | |
| CVE-2017-12898 | critical | 9.8 | 9.8 | 9y ago | The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:interp_reply(). | |
| CVE-2017-12897 | critical | 9.8 | 9.8 | 9y ago | The ISO CLNS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isoclns_print(). | |
| CVE-2017-12896 | critical | 9.8 | 9.8 | 9y ago | The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c:isakmp_rfc3948_print(). | |
| CVE-2017-12895 | critical | 9.8 | 9.8 | 9y ago | The ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print(). | |
| CVE-2017-12894 | critical | 9.8 | 9.8 | 9y ago | Several protocol parsers in tcpdump before 4.9.2 could cause a buffer over-read in addrtoname.c:lookup_bytestring(). | |
| CVE-2017-12893 | critical | 9.8 | 9.8 | 9y ago | The SMB/CIFS parser in tcpdump before 4.9.2 has a buffer over-read in smbutil.c:name_len(). | |
| CVE-2017-14429 | critical | 9.8 | 9.8 | 9y ago | The DHCP client on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allows unauthenticated remote code execution as root beca… | |
| CVE-2017-14421 | critical | 9.8 | 9.8 | 9y ago | D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices have a hardcoded password of wrgac25_dlink.2013gui_dir850l for the Alphanetworks account upon device reset, which allows remote attac… | |
| CVE-2017-14417 | critical | 9.8 | 9.8 | 9y ago | register_send.php on D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices does not require authentication, which can result in unintended enrollment in mydlink Cloud Services. | |
| CVE-2017-11462 | critical | 9.8 | 9.8 | 9y ago | Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error. | |
| CVE-2017-11351 | critical | 9.8 | 9.8 | 9y ago | Axesstel MU553S MU55XS-V1.14 devices have a default password of admin for the admin account. | |
| CVE-2017-14403 | critical | 9.8 | 9.8 | 9y ago | The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the term parameter to module/admin_group/search.php. | |
| CVE-2017-14402 | critical | 9.8 | 9.8 | 9y ago | The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT CREATION" section, related to lack of input v… | |
| CVE-2017-14401 | critical | 9.8 | 9.8 | 9y ago | The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT UPDATE" section. | |
| CVE-2017-8686 | critical | 9.8 | 9.8 | 9y ago | The Windows Server DHCP service in Windows Server 2012 Gold and R2, and Windows Server 2016 allows an attacker to either run arbitrary code on the DHCP failover server or cause the DHCP service to be… | |
| CVE-2017-14397 | critical | 9.8 | 9.8 | 9y ago | AnyDesk before 3.6.1 on Windows has a DLL injection vulnerability. | |
| CVE-2017-14396 | critical | 9.8 | 9.8 | 9y ago | In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php. | |
| CVE-2017-8015 | critical | 9.8 | 9.8 | 9y ago | EMC AppSync (all versions prior to 3.5) contains a SQL injection vulnerability that could potentially be exploited by malicious users to compromise the affected system. | |
| CVE-2017-14346 | critical | 9.8 | 9.8 | 9y ago | upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file. | |
| CVE-2017-14345 | critical | 9.8 | 9.8 | 9y ago | SQL Injection exists in tianchoy/blog through 2017-09-12 via the id parameter to view.php. | |
| CVE-2017-7649 | critical | 9.8 | 9.8 | 9y ago | The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is le… | |
| CVE-2017-14269 | critical | 9.8 | 9.8 | 9y ago | EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices allow remote attackers to obtain sensitive information via a JSONP endpoint, as demonstrated by passwords and SMS content. | |
| CVE-2017-14265 | critical | 9.8 | 9.8 | 9y ago | A Stack-based Buffer Overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3. It could allow a remote denial of service or code execution attack. | |
| CVE-2017-14252 | critical | 9.8 | 9.8 | 9y ago | SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the group_id cookie to side.php. | |
| CVE-2017-14247 | critical | 9.8 | 9.8 | 9y ago | SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the user_id cookie to header.php, a related issue to CVE-2017-1000060. | |
| CVE-2017-14242 | critical | 9.8 | 9.8 | 9y ago | Dolibarr SQL injection vulnerability in don/list.php | |
| CVE-2017-14238 | critical | 9.8 | 9.8 | 9y ago | Dolibarr SQL injection vulnerability in admin/menus/edit.php | |
| CVE-2017-12733 | critical | 9.8 | 9.8 | 9y ago | A Missing Authentication for Critical Function issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSite ATG consoles with the fol… | |
| CVE-2017-12731 | critical | 9.8 | 9.8 | 9y ago | A SQL Injection issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSite ATG consoles with the following software versions: older… | |
| CVE-2017-11161 | critical | 9.8 | 9.8 | 9y ago | Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php;… | |
| CVE-2017-9834 | critical | 9.8 | 9.8 | 9y ago | SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watupro_questions parameter in a watupro_submit action… | |
| CVE-2017-14147 | critical | 9.8 | 9.8 | 9y ago | An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a router to its factory settings by simply browsing to the link ht… | |
| CVE-2017-9458 | critical | 9.8 | 9.8 | 9y ago | XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before 7.1.12, and 8.0.x be… | |
| CVE-2017-13771 | critical | 9.8 | 9.8 | 9y ago | Lexmark Scan To Network (SNF) 3.2.9 and earlier stores network configuration credentials in plaintext and transmits them in requests, which allows remote attackers to obtain sensitive information via… | |
| CVE-2017-14145 | critical | 9.8 | 9.8 | 9y ago | HelpDEZk 1.1.1 has SQL Injection in app\modules\admin\controllers\loginController.php via the admin/login/getWarningInfo/id/ PATH_INFO, related to the selectWarning function. | |
| CVE-2017-14138 | critical | 9.8 | 9.8 | 9y ago | ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in certain error cases, as demonstrated by VP8 errors. | |
| CVE-2017-14135 | critical | 9.8 | 9.8 | 9y ago | enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py in the webadmin plugin for opendreambox 2.0.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the com… |