Filtered by CWE-20
Filtered by vendor Subscriptions
Total 12616 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-12488 1 Hp 1 Intelligent Management Center 2024-11-21 N/A
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.
CVE-2017-12487 1 Hp 1 Intelligent Management Center 2024-11-21 N/A
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version PLAT 7.3 (E0504) was found. The problem was resolved in HPE Intelligent Management Center PLAT v7.3 (E0506) or any subsequent version.
CVE-2017-12473 1 Ccn-lite 1 Ccn-lite 2024-11-21 N/A
ccnl_ccntlv_bytes2pkt in CCN-lite allows context-dependent attackers to cause a denial of service (application crash) via vectors involving packets with "wrong L values."
CVE-2017-12197 3 Debian, Libpam4j Project, Redhat 5 Debian Linux, Libpam4j, Enterprise Linux and 2 more 2024-11-21 N/A
It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
CVE-2017-12194 1 Spice-gtk Project 1 Spice-gtk 2024-11-21 N/A
A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are believed to be vulnerable.
CVE-2017-12174 2 Apache, Redhat 5 Activemq Artemis, Enterprise Linux, Hornetq and 2 more 2024-11-21 7.5 High
It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError.
CVE-2017-12173 2 Fedoraproject, Redhat 7 Sssd, Enterprise Linux, Enterprise Linux Desktop and 4 more 2024-11-21 N/A
It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve it.
CVE-2017-12171 2 Apache, Redhat 5 Http Server, Enterprise Linux, Enterprise Linux Desktop and 2 more 2024-11-21 N/A
A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource.
CVE-2017-12148 1 Redhat 3 Ansible Tower, Cloudforms, Cloudforms Managementengine 2024-11-21 N/A
A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project (SCM repository) definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that, when executed by Tower, modifies the checked out SCM repository to add git hooks. These git hooks could, in turn, cause arbitrary command and code execution as the user Tower runs as.
CVE-2017-12124 1 Moxa 2 Edr-810, Edr-810 Firmware 2024-11-21 6.5 Medium
An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP URI can cause a null pointer dereference resulting in the web server crashing. An attacker can send a crafted URI to trigger this vulnerability.
CVE-2017-12088 1 Rockwellautomation 2 Micrologix 1400, Micrologix 1400 B Firmware 2024-11-21 N/A
An exploitable denial of service vulnerability exists in the Ethernet functionality of the Allen Bradley Micrologix 1400 Series B FRN 21.2 and below. A specially crafted packet can cause a device power cycle resulting in a fault state and deletion of ladder logic. An attacker can send one unauthenticated packet to trigger this vulnerability
CVE-2017-12070 1 Opcfoundation 1 Ua-.net-legacy 2024-11-21 N/A
Unsigned versions of the DLLs distributed by the OPC Foundation may be replaced with malicious code.
CVE-2017-11740 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 N/A
In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occurrence of an alarm. An attacker can abuse this functionality by uploading a malicious script that can be executed on the remote system.
CVE-2017-1002157 1 Redhat 1 Modulemd 2024-11-21 9.8 Critical
modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution.
CVE-2017-1000600 1 Wordpress 1 Wordpress 2024-11-21 N/A
WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely fixed in WordPress 4.9
CVE-2017-1000469 1 Cobbler Project 1 Cobbler 2024-11-21 N/A
Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.
CVE-2017-1000423 1 B2evolution 1 B2evolution 2024-11-21 N/A
b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup.
CVE-2017-1000402 1 Jenkins 1 Swarm 2024-11-21 N/A
Jenkins Swarm Plugin Client 3.4 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks.
CVE-2017-1000401 1 Jenkins 1 Jenkins 2024-11-21 N/A
The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API keys). The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations of Jenkins, and made available to users with access to these log files. Form validation for <f:password/> is now always sent via POST, which is typically not logged.
CVE-2017-1000397 1 Jenkins 1 Maven 2024-11-21 N/A
Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer has a dependency on commons-httpclient.