Total
13257 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-1000469 | 1 Cobbler Project | 1 Cobbler | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user. | |||||
| CVE-2017-1000423 | 1 B2evolution | 1 B2evolution | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup. | |||||
| CVE-2017-1000402 | 1 Jenkins | 1 Swarm | 2026-06-17 | 4.3 MEDIUM | 5.9 MEDIUM |
| Jenkins Swarm Plugin Client 3.4 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. | |||||
| CVE-2017-1000401 | 1 Jenkins | 1 Jenkins | 2026-06-17 | 1.2 LOW | 2.2 LOW |
| The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API keys). The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations of Jenkins, and made available to users with access to these log files. Form validation for <f:password/> is now always sent via POST, which is typically not logged. | |||||
| CVE-2017-1000397 | 1 Jenkins | 1 Maven | 2026-06-17 | 4.3 MEDIUM | 5.9 MEDIUM |
| Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer has a dependency on commons-httpclient. | |||||
| CVE-2017-1000394 | 1 Jenkins | 1 Jenkins | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-fileupload library with the denial-of-service vulnerability known as CVE-2016-3092. The fix for that vulnerability has been backported to the version of the library bundled with Jenkins. | |||||
| CVE-2017-1000391 | 1 Jenkins | 1 Jenkins | 2026-06-17 | 4.9 MEDIUM | 7.3 HIGH |
| Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files. | |||||
| CVE-2017-1000368 | 1 Sudo Project | 1 Sudo | 2026-06-17 | 7.2 HIGH | 8.2 HIGH |
| Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation (embedded newlines) in the get_process_ttyname() function resulting in information disclosure and command execution. | |||||
| CVE-2017-1000252 | 1 Linux | 1 Linux Kernel | 2026-06-17 | 2.1 LOW | 5.5 MEDIUM |
| The KVM subsystem in the Linux kernel through 4.13.3 allows guest OS users to cause a denial of service (assertion failure, and hypervisor hang or crash) via an out-of bounds guest_irq value, related to arch/x86/kvm/vmx.c and virt/kvm/eventfd.c. | |||||
| CVE-2017-1000247 | 1 Codeigniter | 1 Codeigniter | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resulting in HTTP Header Injection flaws. | |||||
| CVE-2017-1000230 | 1 Snap7 Project | 1 Snap7 Server | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The Snap7 Server version 1.4.1 can be crashed when the ItemCount field of the ReadVar or WriteVar functions of the S7 protocol implementation in Snap7 are provided with unexpected input, thus resulting in denial of service attack. | |||||
| CVE-2017-1000228 | 1 Ejs | 1 Ejs | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function | |||||
| CVE-2017-1000201 | 1 Tcmu-runner Project | 1 Tcmu-runner | 2026-06-17 | 2.1 LOW | 5.5 MEDIUM |
| The tcmu-runner daemon in tcmu-runner version 1.0.5 to 1.2.0 is vulnerable to a local denial of service attack | |||||
| CVE-2017-1000189 | 1 Ejs | 1 Ejs | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile() | |||||
| CVE-2017-1000169 | 1 Quickerbb Project | 1 Quickerbb | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| QuickerBB version <= 0.7.2 is vulnerable to arbitrary file writes which can lead to remote code execution. This can lead to the complete takeover of the server hosting QuickerBB. | |||||
| CVE-2017-1000122 | 1 Webkitgtk | 1 Webkitgtk\+ | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromised secondary process to cause a denial of service (release assertion) of the UI process. This vulnerability does not affect Apple products. | |||||
| CVE-2017-1000048 | 1 Qs Project | 1 Qs | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash. | |||||
| CVE-2017-1000039 | 1 Framasoft | 1 Framadate | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution | |||||
| CVE-2017-1000018 | 1 Phpmyadmin | 1 Phpmyadmin | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name | |||||
| CVE-2017-1000016 | 1 Phpmyadmin | 1 Phpmyadmin | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18. | |||||